<?php
/**
 * VMPFence Password Enforcement Controller
 *
 * Handles WordPress password validation hooks for enforcing
 * strong passwords during profile updates and password resets.
 *
 * @package VMPFence
 * @since 2.0.0
 */

// Prevent direct access
if (!defined('ABSPATH')) {
    exit;
}

/**
 * Password Enforcement Controller Class
 *
 * Integrates strong password validation into WordPress
 * user profile and password reset workflows.
 */
class VMPFence_Password_Enforcement_Controller {

    /**
     * Initialize password enforcement hooks
     */
    public function __construct() {
        // Only hook if user is logged in (prevents interference with login/registration)
        if (is_user_logged_in()) {
            add_action('user_profile_update_errors', array($this, 'validate_profile_update'), 0, 3);
        }
        
        // Hook password reset validation
        add_action('validate_password_reset', array($this, 'validate_password_reset'), 10, 2);
    }

    /**
     * Validate password during profile update
     *
     * @param WP_Error $errors Error object passed by reference
     * @param bool $update Whether this is an update or new user
     * @param stdClass $user_data User data object
     */
    public function validate_profile_update($errors, $update, $user_data) {
        // Check if strong password enforcement is enabled
        if (!VMPFence_Config::get('enforce_strong_passwords', 1)) {
            return;
        }

        // Get password from POST data
        $password = isset($_POST['pass1']) && trim($_POST['pass1']) ? $_POST['pass1'] : false;
        
        // Skip validation if no password provided
        if ($password === false) {
            return;
        }

        // Skip validation if there are already password errors
        if ($errors->get_error_data('pass')) {
            return;
        }

        // Get user information
        $user_id = isset($user_data->ID) ? $user_data->ID : false;
        $username = isset($_POST['user_login']) ? $_POST['user_login'] : $user_data->user_login;

        // Check if enforcement applies to this user
        $scope = VMPFence_Config::get('strong_passwords_scope', 'recommended');
        if (!VMPFence_Strong_Password_Validator::should_enforce_for_user($user_id, $scope)) {
            return;
        }

        // Validate password strength
        $validation_result = VMPFence_Strong_Password_Validator::validate_password($password, $username);

        // Add error if validation failed
        if ($validation_result !== true) {
            $error_message = VMPFence_Strong_Password_Validator::format_error_message($validation_result['errors']);
            $errors->add('pass', $error_message);
        }
    }

    /**
     * Validate password during password reset
     *
     * @param WP_Error $errors Error object passed by reference
     * @param stdClass $user_data User data object
     */
    public function validate_password_reset($errors, $user_data) {
        // Check if strong password enforcement is enabled
        if (!VMPFence_Config::get('enforce_strong_passwords', 1)) {
            return;
        }

        // Get password from POST data
        $password = isset($_POST['pass1']) && trim($_POST['pass1']) ? $_POST['pass1'] : false;
        
        // Skip validation if no password provided
        if ($password === false) {
            return;
        }

        // Skip validation if there are already password errors
        if ($errors->get_error_data('pass')) {
            return;
        }

        // Get user information
        $user_id = isset($user_data->ID) ? $user_data->ID : false;
        $username = $user_data->user_login;

        // Check if enforcement applies to this user
        $scope = VMPFence_Config::get('strong_passwords_scope', 'recommended');
        if (!VMPFence_Strong_Password_Validator::should_enforce_for_user($user_id, $scope)) {
            return;
        }

        // Validate password strength
        $validation_result = VMPFence_Strong_Password_Validator::validate_password($password, $username);

        // Add error if validation failed
        if ($validation_result !== true) {
            $error_message = VMPFence_Strong_Password_Validator::format_error_message($validation_result['errors']);
            $errors->add('pass', $error_message);
        }
    }

    /**
     * Get configuration for this feature
     *
     * @return array Configuration array
     */
    public function get_config() {
        return array(
            'enabled' => VMPFence_Config::get('enforce_strong_passwords', 1),
            'scope' => VMPFence_Config::get('strong_passwords_scope', 'recommended')
        );
    }

    /**
     * Check if feature is enabled and configured
     *
     * @return bool True if enabled and properly configured
     */
    public function is_enabled() {
        return VMPFence_Config::get('enforce_strong_passwords', 1) == 1;
    }
}