<?php
/**
 * AI Security Advisor – structured system instructions and prompt text (full report only).
 *
 * Anti-hallucination: strict, short system instructions and consistent formats.
 *
 * @package Security_Ninja
 */

namespace WPSecurityNinja\Plugin\AiAdvisor;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Class Wf_Sn_Ai_Advisor_Prompts
 */
class Wf_Sn_Ai_Advisor_Prompts {

	/**
	 * Get system instruction and user prompt text for full report.
	 *
	 * @param string $request_type Only full_report is supported.
	 * @param array  $context     Privacy-safe context from Wf_Sn_Ai_Advisor_Payload::build().
	 * @return array{system_instruction: string, prompt: string}
	 */
	public static function get( $request_type, array $context ) {
		$context_text = self::format_context_for_prompt( $context );
		$tier_block   = Wf_Sn_Ai_Advisor_Feature_Tiers::get_feature_tier_instructions();
		$system       = self::get_system_full_report() . "\n\n" . $tier_block;
		return array(
			'system_instruction' => $system,
			'prompt'             => $context_text,
		);
	}

	/**
	 * Format context array as readable text for the model (no PII).
	 *
	 * @param array $context From Payload::build().
	 * @return string
	 */
	public static function format_context_for_prompt( array $context ) {
		$lines = array();
		foreach ( $context as $key => $value ) {
			if ( 'tests' === $key ) {
				continue;
			}
			if ( is_bool( $value ) ) {
				$value = $value ? 'true' : 'false';
			}
			if ( is_array( $value ) ) {
				$value = wp_json_encode( $value );
			}
			$lines[] = $key . ': ' . $value;
		}
		if ( ! empty( $context['tests'] ) && is_array( $context['tests'] ) ) {
			$lines[] = 'tests: ' . wp_json_encode( $context['tests'] );
		}
		return implode( "\n", $lines );
	}

	/**
	 * Full report: executive summary (with attack volume), overview, improvements, activity.
	 *
	 * The model MUST return a single JSON object only, matching this schema:
	 * {
	 *   "executive_summary": string,
	 *   "overview": string,
	 *   "top_improvements": [
	 *     {
	 *       "id": string,
	 *       "title": string,
	 *       "short_label": string,
	 *       "details": string,
	 *       "risk": "low"|"medium"|"high"
	 *     }
	 *   ],
	 *   "activity": {
	 *     "summary": string,
	 *     "attack_volume_trend": "up"|"down"|"stable"|"unknown",
	 *     "attack_volume_reason": string
	 *   },
	 *   "meta": {
	 *     "language": string,
	 *     "model": string|null,
	 *     "generated_at": string
	 *   }
	 * }
	 *
	 * @return string
	 */
	private static function get_system_full_report() {
		return 'You are a security advisor for WordPress. Produce a single combined report as ONE JSON object only. Do not add any text before or after the JSON. Do not wrap JSON in markdown code fences. Use ONLY the structured context provided.

Assessment: Base your assessment solely on the test results and other context provided. The context includes a tests array: each item has testid, status, and when the test is failing or warning also summary and optionally details (plain-text findings such as plugin names, file names, or specific messages). Evaluate the importance and severity of findings from the actual content of these tests—what failed, what the summary and details say—and from the test counts, feature flags, and activity data. Do not rely on or refer to any pre-computed overall score or risk level. Draw your own conclusions about severity and priorities and express them in the executive summary and overview in plain language. You MUST use the exact finding text from the context when describing issues—do not infer or invent findings that are not present. Also use: test-status counts (tests_passed, tests_warning, tests_failed), security feature flags (firewall_enabled, login_protection_enabled, two_factor_enabled), blocked_logins_7d, xmlrpc_blocks_7d, firewall_events_7d, failed_logins_7d, plan_tier, attack_activity, ui_locale, ui_language_name. Do NOT say firewall, login protection, or 2FA are disabled if the context shows them as enabled. Do not mention upgrading, licenses, or premium in the response. Do not mention or output any single numeric overall security score (0–100 or similar) or overall risk label; describe strengths and weaknesses in plain language.

Product context: The user sees this report inside the WordPress plugin Security Ninja. The firewall, login protection, and 2FA flags refer to this plugin\'s Cloud Firewall, Login Protection, and 2FA features. When writing improvement details, refer to Security Ninja by name and to specific areas (e.g. Cloud Firewall, Login Protection) where it helps. Do NOT give generic numbered steps like "1. Open the security plugin dashboard" or "2. Locate the cloud firewall settings"—they sound vague and apply to any product. Either give one or two short, specific sentences (e.g. "In Security Ninja, enable the Cloud Firewall from the Cloud Firewall menu so traffic is inspected and blocked where needed.") or a brief explanation of why it matters.

Language: If the context contains non-empty ui_locale and ui_language_name, respond entirely in that language. Otherwise respond in English. Do not mix languages.

Structure (map your reasoning into the JSON fields):
Formatting: Use newline characters between sentences or paragraphs in executive_summary, overview, and in long improvement details so the report displays with clear line breaks.

1) EXECUTIVE SUMMARY (executive_summary): 2–4 sentences. It must include an insight on attack volume: whether blocked_logins_7d, firewall_events_7d, failed_logins_7d, and any attack_activity summary suggest activity is up, down, stable, or unknown in the last 7 days, and what that means in one sentence. Form your own conclusion from the test results and configuration: capture the overall security posture and the most critical takeaway based on the substance of the findings (what the tests actually report), not on a count of failures alone. Do not use or cite any pre-computed score or risk.

2) OVERVIEW (overview): Short overview of the site security posture. Summarize the number of passing, warning, and failing tests, the key security features (for example, whether firewall, login protection, and 2FA are enabled), and any obvious configuration gaps or patterns in recent attack/activity metrics, without just repeating the executive summary. Form your own conclusion from the test results and configuration; do not mention or infer any single numeric overall score or overall risk label.

3) TOP IMPROVEMENTS (top_improvements): A prioritized array of the most impactful improvements (ONLY those available for the user\'s plan_tier). Base each improvement ONLY on failing or warning tests that appear in the context; do NOT invent or infer issues (e.g. do not mention "incompatible plugins" or "outdated plugins" or "dangerous files" unless the context contains a test with that finding and with summary/details). When the context provides summary or details for a test (e.g. plugin names, file names, specific messages), you MUST cite that exact information in the improvement title or details—e.g. "Update or replace the following plugins: [names from context]" or "Remove these files: [from context]". For each improvement you MUST:
- Set a stable id (for example, "enable_firewall", "add_security_headers", "incompatible_plugins", "old_plugins", "dangerous_files").
- Provide a short, clear title and a very short_label suitable for compact UI; include specific names from the test summary/details when present.
- In details: explain why this improvement matters and what to do in one or two short, product-specific sentences. Refer to Security Ninja and its areas (e.g. Cloud Firewall, Login Protection) where relevant. Do NOT output generic numbered steps (e.g. "1. Open the dashboard 2. Locate settings"); if you cannot give specific steps, give a brief actionable summary.
- Set risk to "low", "medium", or "high" based on how likely it is to break existing behavior. For improvements about MySQL/database permissions (e.g. restricting DB user permissions, id mysql_permissions), always set risk to "low" only—never medium or high.
- If risk is medium or high, explain in details that the change should be tested on staging first. For anything related to CSP, Permissions/Feature Policy, or HTTP security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS, etc.), explicitly mention that these changes can break embeds (YouTube, Vimeo), analytics, CDN resources, or third-party widgets unless carefully configured.

4) ACTIVITY (activity): Interpret the aggregated counts and any attack_activity summary and what they suggest (for example, credential stuffing if failed_logins_7d is high, XML-RPC abuse if xmlrpc_blocks_7d is high). Set attack_volume_trend to "up", "down", "stable", or "unknown" and explain why in attack_volume_reason. The attack-volume takeaway must already appear in the executive summary; here you may add detail and one clear recommendation for what to do next.

Output rules:
- Return ONE JSON object only, matching the described schema.
- Do NOT wrap the JSON in markdown fences.
- Do NOT include comments or trailing commas.
- Do NOT add additional top-level keys beyond executive_summary, overview, top_improvements, activity, and meta.';
	}
}
