<?php
/**
 * Shared “Account linking & security” settings shown on each social sign-in module admin panel.
 *
 * @package WP_PowerSuite\OAuth\Admin
 */

namespace WP_PowerSuite\OAuth\Admin;

use WP_PowerSuite\Core\OptionStorePluginSettingsRepository;
use WP_PowerSuite\OAuth\Accounts\AccountLinkSettings;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class LinkingPolicySection {

	/**
	 * @param array{as_accordion?: bool, uid?: string, open?: bool} $args
	 */
	public static function render( array $args = [] ): void {
		$as_accordion = ! empty( $args['as_accordion'] );
		$uid          = preg_replace( '/[^a-z0-9_-]/i', '', (string) ( $args['uid'] ?? 'social' ) );
		$open         = ! empty( $args['open'] );
		$s            = AccountLinkSettings::get();
		$debug        = (bool) OptionStorePluginSettingsRepository::instance()->get( 'social_oauth_debug', false );

		if ( $as_accordion ) {
			$head_id = $uid . '_acc_head_linking';
			$body_id = $uid . '_acc_body_linking';
			?>
			<div class="wpps-ts-accordion<?php echo $open ? ' is-open' : ''; ?>">
				<button type="button" class="wpps-ts-accordion-header" id="<?php echo esc_attr( $head_id ); ?>" aria-expanded="<?php echo $open ? 'true' : 'false'; ?>" aria-controls="<?php echo esc_attr( $body_id ); ?>">
					<span class="wpps-ts-accordion-title"><?php esc_html_e( 'Account linking & security', 'wp-powersuite' ); ?></span>
					<span class="dashicons dashicons-arrow-down-alt2 wpps-ts-accordion-chevron" aria-hidden="true"></span>
				</button>
				<div class="wpps-ts-accordion-body" id="<?php echo esc_attr( $body_id ); ?>" role="region" aria-labelledby="<?php echo esc_attr( $head_id ); ?>">
					<p class="description" style="margin-top:0;">
						<?php esc_html_e( 'These settings apply to all social sign-in providers on this site.', 'wp-powersuite' ); ?>
					</p>
					<?php self::renderFieldsTable( $s, $debug ); ?>
				</div>
			</div>
			<?php
			return;
		}
		?>
		<hr style="margin: 2em 0;" />
		<h3><?php esc_html_e( 'Account linking & security', 'wp-powersuite' ); ?></h3>
		<p class="description">
			<?php esc_html_e( 'These settings apply to all social sign-in providers on this site.', 'wp-powersuite' ); ?>
		</p>
		<?php
		self::renderFieldsTable( $s, $debug );
	}

	/**
	 * @param array<string, mixed> $s
	 */
	private static function renderFieldsTable( array $s, bool $debug ): void {
		?>
		<table class="form-table" role="presentation">
			<tbody>
				<tr>
					<th scope="row"><?php esc_html_e( 'Account linking', 'wp-powersuite' ); ?></th>
					<td>
						<label>
							<input
								type="checkbox"
								class="wp-powersuite-advanced-setting"
								data-setting-key="social_accounts.linking_enabled"
								value="1"
								<?php checked( ! empty( $s['linking_enabled'] ) ); ?>
							/>
							<?php esc_html_e( 'Allow logged-in users to connect or disconnect providers from My Account', 'wp-powersuite' ); ?>
						</label>
					</td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'Existing email match', 'wp-powersuite' ); ?></th>
					<td>
						<fieldset>
							<label style="display:block;margin-bottom:6px;">
								<input
									type="radio"
									name="wpps_social_email_on_login"
									class="wp-powersuite-advanced-setting"
									data-setting-key="social_accounts.email_on_login"
									value="auto"
									<?php checked( ( $s['email_on_login'] ?? 'auto' ), 'auto' ); ?>
								/>
								<?php esc_html_e( 'Auto-link when provider email matches an existing WordPress user (email must be verified by the provider)', 'wp-powersuite' ); ?>
							</label>
							<label style="display:block;">
								<input
									type="radio"
									name="wpps_social_email_on_login"
									class="wp-powersuite-advanced-setting"
									data-setting-key="social_accounts.email_on_login"
									value="manual"
									<?php checked( ( $s['email_on_login'] ?? 'auto' ), 'manual' ); ?>
								/>
								<?php esc_html_e( 'Require password login first, then connect from My Account (safer for shared domains)', 'wp-powersuite' ); ?>
							</label>
						</fieldset>
					</td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'Connect flow', 'wp-powersuite' ); ?></th>
					<td>
						<label>
							<input
								type="checkbox"
								class="wp-powersuite-advanced-setting"
								data-setting-key="social_accounts.require_email_match_to_connect"
								value="1"
								<?php checked( ! empty( $s['require_email_match_to_connect'] ) ); ?>
							/>
							<?php esc_html_e( 'Provider email must match the WordPress account email when connecting (GitHub noreply addresses are exempt)', 'wp-powersuite' ); ?>
						</label>
					</td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'WooCommerce UI', 'wp-powersuite' ); ?></th>
					<td>
						<label>
							<input
								type="checkbox"
								class="wp-powersuite-advanced-setting"
								data-setting-key="social_accounts.show_on_my_account"
								value="1"
								<?php checked( ! empty( $s['show_on_my_account'] ) ); ?>
							/>
							<?php esc_html_e( 'Show “Connected accounts” in WooCommerce My Account menu', 'wp-powersuite' ); ?>
						</label>
					</td>
				</tr>
				<tr>
					<th scope="row"><?php esc_html_e( 'OAuth debug log', 'wp-powersuite' ); ?></th>
					<td>
						<label>
							<input
								type="checkbox"
								class="wp-powersuite-advanced-setting"
								data-setting-key="social_accounts.oauth_debug"
								value="1"
								<?php checked( $debug ); ?>
							/>
							<?php esc_html_e( 'Write OAuth errors to the PHP error log (also logs when WP_DEBUG is on)', 'wp-powersuite' ); ?>
						</label>
					</td>
				</tr>
			</tbody>
		</table>
		<?php
	}
}
