<?php
namespace CustomLoginErrorMessages;

use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! isset( $module_id ) || empty( $module_id ) ) {
	$module_id = 'custom-login-error-messages';
}

$settings     = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
if ( ! is_array( $settings ) ) {
	$settings = [];
}

$default_settings = [
	'generic_error_message' => __( 'Invalid username or password.', 'wp-powersuite' ),
];

$settings = array_merge( $default_settings, $settings );

$login_id_warning = '';
if ( OptionStoreModuleSettingsRepository::isModuleEnabled( 'login-id-type'  ) ) {
	$login_id_settings = OptionStoreModuleSettingsRepository::forModule( 'login-id-type' )->all( [] );
	$login_id_mode     = is_array( $login_id_settings ) ? (string) ( $login_id_settings['login_id_type'] ?? 'username_email' ) : 'username_email';
	if ( $login_id_mode === 'both' ) {
		$login_id_mode = 'username_email';
	}
	if ( $login_id_mode !== 'username_email' ) {
		$login_id_warning = __( 'Login ID Type is enabled in a restricted mode and also rewrites login errors. For predictable behavior, use either Generic Login Error Message or Login ID Type (username + email mode), not both.', 'wp-powersuite' );
	}
}

?>

<div class="wp-powersuite-module-settings" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form class="wp-powersuite-module-settings-form" data-module-id="<?php echo esc_attr( $module_id ); ?>">
		<?php wp_nonce_field( 'wp_powersuite_save_module_settings_' . $module_id, 'wp_powersuite_nonce' ); ?>

					<p class="description" style="margin-bottom: 16px;">
						<?php esc_html_e( 'Use a generic error message for credential failures on wp-login, WooCommerce My Account, REST authentication, XML-RPC, and PowerSuite 2FA AJAX login. WordPress normally uses different messages for unknown users vs wrong passwords.', 'wp-powersuite' ); ?>
					</p>

					<?php if ( $login_id_warning !== '' ) : ?>
					<div class="notice notice-warning inline" style="margin: 0 0 16px; padding: 10px 12px;">
						<p style="margin: 0;"><?php echo esc_html( $login_id_warning ); ?></p>
					</div>
					<?php endif; ?>

					<table class="form-table">
						<tbody>
							<tr>
								<th scope="row">
									<label for="<?php echo esc_attr( $module_id . '_generic_error_message' ); ?>">
										<?php esc_html_e( 'Generic Error Message:', 'wp-powersuite' ); ?>
									</label>
									<?php
									wpps_render_modal_settings_tip(
										__( 'Help: generic error', 'wp-powersuite' ),
										__( 'Shown for both unknown usernames and wrong passwords. Other login errors (lockouts, 2FA, etc.) remain unchanged.', 'wp-powersuite' )
									);
									?>
								</th>
								<td>
									<input type="text"
										id="<?php echo esc_attr( $module_id . '_generic_error_message' ); ?>"
										name="<?php echo esc_attr( $module_id ); ?>[generic_error_message]"
										class="wp-powersuite-advanced-setting regular-text"
										data-setting-key="generic_error_message"
										value="<?php echo esc_attr( $settings['generic_error_message'] ?? '' ); ?>"
									/>
									<p class="description">
										<?php esc_html_e( 'Shown when login fails due to an unknown user or wrong password. Other notices (empty fields, lockouts, session expired, two-factor, etc.) are left unchanged.', 'wp-powersuite' ); ?>
									</p>
								</td>
							</tr>
						</tbody>
					</table>

					<p class="description" style="margin-top: 20px; padding: 10px; background: #e7f3ff; border-left: 4px solid #2271b1;">
						<strong><?php esc_html_e( 'Security Benefit:', 'wp-powersuite' ); ?></strong>
						<?php esc_html_e( 'Attackers cannot tell from the message alone whether an account exists, which makes targeted guessing harder. Lockouts, 2FA, and social-login errors are left unchanged.', 'wp-powersuite' ); ?>
					</p>
					<p class="description" style="margin-top: 12px;">
						<?php esc_html_e( 'Third-party LMS or membership login forms can opt in via the wp_powersuite_is_credential_login_request filter.', 'wp-powersuite' ); ?>
					</p>
</form>
</div>
