<?php
declare(strict_types=1);
namespace ConfManager\Members;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}


use ConfManager\Traits\Singleton;
use ConfManager\Security\Encryption;
use ConfManager\Security\RateLimiter;
use ConfManager\Security\AuditLog;

/**
 * フロントエンドからの自己登録（会員/非会員）
 *
 * OTPメール認証 → プロフィール入力 → 会員レコード作成 のフローを管理。
 *
 * @since 1.1.0
 */
class SelfRegistration {

	use Singleton;

	/**
	 * OTP有効期限（秒）
	 */
	private const OTP_TTL = 600;

	/**
	 * OTP最大試行回数（IP単位）
	 */
	private const OTP_MAX_ATTEMPTS = 5;

	/**
	 * OTPグローバル最大試行回数（メール単位、IP非依存）
	 * 分散ブルートフォース攻撃対策
	 */
	private const OTP_GLOBAL_MAX_ATTEMPTS = 10;

	/**
	 * 登録トークン有効期限（秒）
	 */
	private const TOKEN_TTL = 900;

	/**
	 * 有効な registered_via 値
	 */
	private const VALID_VIA = [ 'admin', 'csv', 'self_registration' ];

	protected function init(): void {}

	/**
	 * OTPを生成してメール送信する
	 *
	 * メール列挙攻撃を防ぐため、既存会員の場合も同一レスポンスを返す。
	 *
	 * @param string $email メールアドレス
	 * @return array{sent: bool}|\WP_Error
	 */
	public function send_otp( string $email ): array|\WP_Error {
		$email = sanitize_email( $email );
		if ( empty( $email ) || ! is_email( $email ) ) {
			return new \WP_Error( 'invalid_email', __( 'Please enter a valid email address.', 'conferencemanager' ), [ 'status' => 400 ] );
		}

		$email_hash = Encryption::hash_email( $email );

		// IP + メール複合レート制限
		$rate_check = RateLimiter::instance()->check_composite( 'self_register_otp', 'otp_per_email', $email_hash );
		if ( is_wp_error( $rate_check ) ) {
			return $rate_check;
		}

		// 既存会員チェック（列挙攻撃防止: 同一レスポンスを返す）
		$existing = MemberManager::instance()->get_by_email( $email );
		if ( null !== $existing ) {
			// 既存会員にはログイン案内メールを送信（OTPは発行しない）
			$subject = __( '[Registration] Information', 'conferencemanager' );
			$body    = __( "This email address is already registered.\n\nPlease log in from My Page to register for the event.\n\nIf you do not recognize this request, please ignore this email.", 'conferencemanager' );
			wp_mail( $email, $subject, $body );

			AuditLog::instance()->log( 'self_register_existing_member', 'member', (int) $existing['id'], [
				'email_hash' => $email_hash,
			] );

			return [ 'sent' => true ];
		}

		// 6桁OTP生成
		$otp = str_pad( (string) random_int( 0, 999999 ), 6, '0', STR_PAD_LEFT );

		// ハッシュしてTransientに保存
		$otp_key = 'conf_selfreg_otp_' . $email_hash;
		set_transient( $otp_key, wp_hash( $otp ), self::OTP_TTL );

		// 試行回数リセット（IP単位 + グローバル）
		delete_transient( 'conf_selfreg_attempts_' . $email_hash );
		delete_transient( 'conf_selfreg_gattempts_' . $email_hash );

		// メール送信
		$subject = __( '[Registration] Email Verification Code', 'conferencemanager' );
		$body    = sprintf(
			/* translators: 1: OTP code */
			__( "Here is your email verification code for registration.\n\nVerification code: %s\n\nThis code is valid for 10 minutes.\nIf you did not request this, please ignore this email.", 'conferencemanager' ),
			$otp
		);

		wp_mail( $email, $subject, $body );

		AuditLog::instance()->log( 'self_register_otp_sent', 'member', null, [
			'email_hash' => $email_hash,
		] );

		return [ 'sent' => true ];
	}

	/**
	 * OTPを検証して登録トークンを発行する
	 *
	 * @param string $email メールアドレス
	 * @param string $otp   OTPコード
	 * @return array{verified: bool, registration_token: string}|\WP_Error
	 */
	public function verify_otp( string $email, string $otp ): array|\WP_Error {
		$rate_check = RateLimiter::instance()->check( 'login' );
		if ( is_wp_error( $rate_check ) ) {
			return $rate_check;
		}

		$email = sanitize_email( $email );
		$otp   = sanitize_text_field( $otp );

		if ( empty( $email ) || ! is_email( $email ) || empty( $otp ) ) {
			return new \WP_Error( 'invalid_params', __( 'Email address and verification code are required.', 'conferencemanager' ), [ 'status' => 400 ] );
		}

		$email_hash          = Encryption::hash_email( $email );
		$otp_key             = 'conf_selfreg_otp_' . $email_hash;
		$attempts_key        = 'conf_selfreg_attempts_' . $email_hash;
		$global_attempts_key = 'conf_selfreg_gattempts_' . $email_hash;

		// グローバル試行回数チェック（IP非依存、分散攻撃対策）
		$global_attempts = (int) get_transient( $global_attempts_key );
		if ( $global_attempts >= self::OTP_GLOBAL_MAX_ATTEMPTS ) {
			delete_transient( $otp_key );
			return new \WP_Error( 'too_many_attempts', __( 'Maximum attempts reached. Please resend the verification code.', 'conferencemanager' ), [ 'status' => 429 ] );
		}

		// IP単位の試行回数チェック
		$attempts = (int) get_transient( $attempts_key );
		if ( $attempts >= self::OTP_MAX_ATTEMPTS ) {
			delete_transient( $otp_key );
			return new \WP_Error( 'too_many_attempts', __( 'Maximum attempts reached. Please resend the verification code.', 'conferencemanager' ), [ 'status' => 429 ] );
		}

		$stored_hash = get_transient( $otp_key );
		if ( false === $stored_hash ) {
			return new \WP_Error( 'otp_expired', __( 'Verification code has expired. Please resend.', 'conferencemanager' ), [ 'status' => 401 ] );
		}

		if ( ! hash_equals( $stored_hash, wp_hash( $otp ) ) ) {
			set_transient( $attempts_key, $attempts + 1, self::OTP_TTL );
			set_transient( $global_attempts_key, $global_attempts + 1, self::OTP_TTL );
			return new \WP_Error( 'otp_invalid', __( 'Incorrect verification code.', 'conferencemanager' ), [ 'status' => 401 ] );
		}

		// OTP消費
		delete_transient( $otp_key );
		delete_transient( $attempts_key );
		delete_transient( $global_attempts_key );

		// 登録トークンを発行（メールアドレスを暗号化して紐付け）
		$token     = bin2hex( random_bytes( 32 ) );
		$token_key = 'conf_selfreg_token_' . $token;
		set_transient( $token_key, Encryption::instance()->encrypt( $email ), self::TOKEN_TTL );

		AuditLog::instance()->log( 'self_register_otp_verified', 'member', null, [
			'email_hash' => $email_hash,
		] );

		return [
			'verified'           => true,
			'registration_token' => $token,
		];
	}

	/**
	 * 登録トークンを検証しプロフィールで会員レコードを作成する
	 *
	 * @param string $token 登録トークン
	 * @param array  $data  {
	 *     @type string $name_sei      姓（必須）
	 *     @type string $name_mei      名（必須）
	 *     @type string $name_sei_kana 姓カナ
	 *     @type string $name_mei_kana 名カナ
	 *     @type string $org_name      所属
	 *     @type string $org_dept      部署
	 *     @type bool   $is_member     会員として登録するか
	 *     @type string $member_type   会員種別（会員の場合のみ）
	 * }
	 * @return array{member_id: int, is_member: bool, auth_token: string}|\WP_Error
	 */
	public function complete( string $token, array $data ): array|\WP_Error {
		$rate_check = RateLimiter::instance()->check( 'registration' );
		if ( is_wp_error( $rate_check ) ) {
			return $rate_check;
		}

		$token         = sanitize_text_field( $token );
		$token_key     = 'conf_selfreg_token_' . $token;
		$encrypted_email = get_transient( $token_key );

		if ( false === $encrypted_email ) {
			return new \WP_Error( 'invalid_token', __( 'Registration token is invalid or expired. Please start over.', 'conferencemanager' ), [ 'status' => 401 ] );
		}

		// トークン消費
		delete_transient( $token_key );

		// 暗号化されたメールを復号（旧形式の平文にも対応）
		$email = Encryption::instance()->decrypt( $encrypted_email );
		if ( false === $email ) {
			// 旧形式（平文）のTransientの場合はそのまま使用
			$email = is_email( $encrypted_email ) ? $encrypted_email : null;
		}

		if ( empty( $email ) ) {
			return new \WP_Error( 'invalid_token', __( 'Registration token is invalid or expired. Please start over.', 'conferencemanager' ), [ 'status' => 401 ] );
		}

		// 念のため重複チェック
		$existing = MemberManager::instance()->get_by_email( $email );
		if ( null !== $existing ) {
			return new \WP_Error( 'already_registered', __( 'This email address is already registered.', 'conferencemanager' ), [ 'status' => 409 ] );
		}

		$is_member   = ! empty( $data['is_member'] );
		$member_type = $is_member
			? sanitize_text_field( $data['member_type'] ?? 'regular' )
			: 'general';

		$require_approval = (bool) get_option( 'conf_manager_require_approval', false );

		$create_data = [
			'email'           => $email,
			'name_sei'        => $data['name_sei'] ?? '',
			'name_mei'        => $data['name_mei'] ?? '',
			'name_sei_kana'   => $data['name_sei_kana'] ?? '',
			'name_mei_kana'   => $data['name_mei_kana'] ?? '',
			'org_name'        => $data['org_name'] ?? '',
			'org_dept'        => $data['org_dept'] ?? '',
			'is_member'       => $is_member,
			'member_type'     => $member_type,
			'email_verified'  => true,
			'registered_via'  => 'self_registration',
			'approval_status' => $require_approval ? 'pending' : 'auto_approved',
			'status'          => $require_approval ? 'inactive' : 'active',
		];

		$member_id = MemberManager::instance()->create( $create_data );
		if ( is_wp_error( $member_id ) ) {
			return $member_id;
		}

		AuditLog::instance()->log( 'self_register_complete', 'member', $member_id, [
			'is_member'        => $is_member,
			'member_type'      => $member_type,
			'require_approval' => $require_approval,
		] );

		// 承認待ちの場合はセッショントークンを発行しない（申込不可）
		if ( $require_approval ) {
			return [
				'member_id'        => $member_id,
				'is_member'        => $is_member,
				'pending_approval' => true,
			];
		}

		// セッショントークンを発行（申込フローで使用）
		$auth_token = bin2hex( random_bytes( 32 ) );
		set_transient( 'conf_otp_session_' . $auth_token, $member_id, self::TOKEN_TTL );

		$member = MemberManager::instance()->get( $member_id );

		return [
			'member_id'   => $member_id,
			'is_member'   => $is_member,
			'auth_token'  => $auth_token,
			'email_hash'  => $member['email_hash'] ?? Encryption::hash_email( $email ),
			'name_sei'    => $member['name_sei'] ?? '',
			'name_mei'    => $member['name_mei'] ?? '',
			'member_type' => $member['member_type'] ?? $member_type,
			'org_name'    => $member['org_name'] ?? '',
		];
	}
}
