<?php
/**
 * WP-CLI: wp upload-vault audit|status|protect|unprotect
 *
 * JSON output is free (fleet policy: never gate CLI/JSON).
 *
 * @package Upload_Vault
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Audit and protect Gravity Forms uploads from the command line.
 */
class Uvgf_CLI {

	/**
	 * Run a full exposure audit.
	 *
	 * ## OPTIONS
	 *
	 * [--format=<format>]
	 * : table (default) or json.
	 *
	 * @param array $args       Positional args.
	 * @param array $assoc_args Assoc args.
	 */
	public function audit( $args, $assoc_args ) {
		unset( $args );
		$audit  = Uvgf_Auditor::audit();
		$format = isset( $assoc_args['format'] ) ? $assoc_args['format'] : 'table';

		if ( 'json' === $format ) {
			WP_CLI::line( (string) wp_json_encode( $audit ) );
			return;
		}

		WP_CLI::line( 'Verdict: ' . $audit['verdict'] );
		WP_CLI::line( 'Folders: ' . count( $audit['folders'] ) . '  Exposed: ' . (int) $audit['exposed'] . '  Browsable listings: ' . (int) $audit['listings'] . '  Files indexed: ' . (int) $audit['indexed'] );
		foreach ( $audit['folders'] as $row ) {
			WP_CLI::line( sprintf( '%-40s %-10s HTTP %-4d %s', $row['folder'], $row['status'], (int) $row['http'], $row['listing'] ? 'LISTING-OPEN' : '' ) );
		}
		if ( 'exposed' === $audit['verdict'] ) {
			WP_CLI::warning( 'Direct upload URLs are served to anyone who has them. Run: wp upload-vault protect' );
		}
	}

	/**
	 * Show the last stored audit without re-running it.
	 *
	 * ## OPTIONS
	 *
	 * [--format=<format>]
	 * : table (default) or json.
	 *
	 * @param array $args       Positional args.
	 * @param array $assoc_args Assoc args.
	 */
	public function status( $args, $assoc_args ) {
		unset( $args );
		$audit = get_option( 'uvgf_audit', array() );
		if ( empty( $audit ) ) {
			WP_CLI::line( 'No audit stored yet. Run: wp upload-vault audit' );
			return;
		}
		$format = isset( $assoc_args['format'] ) ? $assoc_args['format'] : 'table';
		if ( 'json' === $format ) {
			WP_CLI::line( (string) wp_json_encode( $audit ) );
			return;
		}
		WP_CLI::line( 'Verdict: ' . ( isset( $audit['verdict'] ) ? $audit['verdict'] : '?' ) . ' (checked ' . ( isset( $audit['checked_at'] ) ? gmdate( 'Y-m-d H:i', (int) $audit['checked_at'] ) . ' UTC' : 'never' ) . ')' );
	}

	/**
	 * Install protection rules, then re-audit.
	 *
	 * @param array $args       Positional args.
	 * @param array $assoc_args Assoc args.
	 */
	public function protect( $args, $assoc_args ) {
		unset( $args, $assoc_args );
		$res = Uvgf_Protector::protect();
		if ( empty( $res['ok'] ) ) {
			WP_CLI::error( 'Could not write rules: ' . $res['error'], false );
		}
		$audit = Uvgf_Auditor::audit();
		WP_CLI::line( 'Rules written. Post-protect verdict: ' . $audit['verdict'] );
		if ( 'protected' !== $audit['verdict'] ) {
			WP_CLI::warning( 'Not yet verified as refused by the server — see the admin screen for the matching server snippet.' );
		}
	}

	/**
	 * Remove protection rules, then re-audit.
	 *
	 * @param array $args       Positional args.
	 * @param array $assoc_args Assoc args.
	 */
	public function unprotect( $args, $assoc_args ) {
		unset( $args, $assoc_args );
		Uvgf_Protector::unprotect();
		$audit = Uvgf_Auditor::audit();
		WP_CLI::line( 'Rules removed. Verdict: ' . $audit['verdict'] );
	}
}
