<?php
/**
 * WooCommerce Security settings service.
 *
 * @package Polanger_Dashboard_Tools
 */

if ( ! defined( 'ABSPATH' ) ) {
  exit;
}

class PDT_WC_Security_Settings {

  /**
   * Option name.
   */
  const OPTION_NAME = 'pdt_wc_security_settings';

  /**
   * Get persisted settings with defaults applied.
   *
   * @return array
   */
  public function get_settings() {
    $settings = get_option( self::OPTION_NAME, array() );
    $settings = is_array( $settings ) ? $settings : array();

    $settings = wp_parse_args(
      $settings,
      array(
        'rate_limit_enabled' => true,
        'protection_mode'    => 'balanced',
      )
    );

    $settings['rate_limit_enabled'] = ! empty( $settings['rate_limit_enabled'] );
    $settings['protection_mode']    = $this->sanitize_mode( $settings['protection_mode'] );

    return $settings;
  }

  /**
   * Save settings payload.
   *
   * @param array $raw Raw submitted values.
   * @return array
   */
  public function save_settings( $raw ) {
    $raw      = is_array( $raw ) ? $raw : array();
    $settings = $this->get_settings();

    $settings['rate_limit_enabled'] = ! empty( $raw['rate_limit_enabled'] );
    $settings['protection_mode']    = $this->sanitize_mode(
      isset( $raw['protection_mode'] ) ? $raw['protection_mode'] : 'balanced'
    );

    update_option( self::OPTION_NAME, $settings );

    return $settings;
  }

  /**
   * Whether rate limiting is enabled.
   *
   * @return bool
   */
  public function is_rate_limit_enabled() {
    $settings = $this->get_settings();
    return ! empty( $settings['rate_limit_enabled'] );
  }

  /**
   * Get supported protection modes.
   *
   * @return array
   */
  public function get_modes() {
    return array(
      'relaxed'  => array(
        'label'       => __( 'Relaxed', 'polanger-admin-menu-manager' ),
        'description' => __( 'A lighter profile for busy membership sites that still want abuse protection without aggressive lockouts.', 'polanger-admin-menu-manager' ),
        'limits'      => array(
          'login'        => array(
            'max_attempts'    => 8,
            'ip_max_attempts' => 16,
            'window_minutes'  => 10,
          ),
          'register'     => array(
            'max_attempts'    => 4,
            'ip_max_attempts' => 8,
            'window_minutes'  => 30,
          ),
          'lostpassword' => array(
            'max_attempts'    => 4,
            'ip_max_attempts' => 8,
            'window_minutes'  => 30,
          ),
        ),
      ),
      'balanced' => array(
        'label'       => __( 'Balanced', 'polanger-admin-menu-manager' ),
        'description' => __( 'Recommended for most stores. It limits automated abuse while keeping normal customer login and recovery flows comfortable.', 'polanger-admin-menu-manager' ),
        'limits'      => array(
          'login'        => array(
            'max_attempts'    => 5,
            'ip_max_attempts' => 10,
            'window_minutes'  => 10,
          ),
          'register'     => array(
            'max_attempts'    => 3,
            'ip_max_attempts' => 6,
            'window_minutes'  => 30,
          ),
          'lostpassword' => array(
            'max_attempts'    => 3,
            'ip_max_attempts' => 6,
            'window_minutes'  => 30,
          ),
        ),
      ),
      'strict'   => array(
        'label'       => __( 'Strict', 'polanger-admin-menu-manager' ),
        'description' => __( 'Tighter limits for stores facing repeated attacks or low-volume sites where stricter protection is acceptable.', 'polanger-admin-menu-manager' ),
        'limits'      => array(
          'login'        => array(
            'max_attempts'    => 3,
            'ip_max_attempts' => 6,
            'window_minutes'  => 15,
          ),
          'register'     => array(
            'max_attempts'    => 2,
            'ip_max_attempts' => 4,
            'window_minutes'  => 60,
          ),
          'lostpassword' => array(
            'max_attempts'    => 2,
            'ip_max_attempts' => 4,
            'window_minutes'  => 60,
          ),
        ),
      ),
    );
  }

  /**
   * Get the active protection mode key.
   *
   * @return string
   */
  public function get_active_mode_key() {
    $settings = $this->get_settings();
    return $this->sanitize_mode( $settings['protection_mode'] );
  }

  /**
   * Get the active protection mode definition.
   *
   * @return array
   */
  public function get_active_mode() {
    $modes = $this->get_modes();
    $key   = $this->get_active_mode_key();

    return isset( $modes[ $key ] ) ? $modes[ $key ] : $modes['balanced'];
  }

  /**
   * Get a specific rate limit profile by action key.
   *
   * @param string $action Action key.
   * @return array
   */
  public function get_rate_limit_profile( $action ) {
    $mode   = $this->get_active_mode();
    $limits = isset( $mode['limits'] ) && is_array( $mode['limits'] ) ? $mode['limits'] : array();

    return isset( $limits[ $action ] ) && is_array( $limits[ $action ] )
      ? $limits[ $action ]
      : array(
        'max_attempts'    => 5,
        'ip_max_attempts' => 10,
        'window_minutes'  => 10,
      );
  }

  /**
   * Sanitize a mode key against supported choices.
   *
   * @param string $mode Submitted mode.
   * @return string
   */
  private function sanitize_mode( $mode ) {
    $mode  = sanitize_key( (string) $mode );
    $modes = $this->get_modes();

    return isset( $modes[ $mode ] ) ? $mode : 'balanced';
  }
}
