<?php
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;

if ( ! class_exists( \BlockUsernames\Module::class, false ) && defined( 'WP_POWERSUITE_MODULES_DIR' ) ) {
	$mod = WP_POWERSUITE_MODULES_DIR . 'block-usernames' . DIRECTORY_SEPARATOR . 'module.php';
	if ( is_readable( $mod ) ) {
		require_once $mod;
	}
}

$settings = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
if ( ! is_array( $settings ) ) {
	$settings = [];
}

$settings = class_exists( \BlockUsernames\Module::class )
	? \BlockUsernames\Module::normalizeSettings( $settings )
	: $settings;

$blocked_usernames_text = implode(
	"\n",
	array_filter(
		array_map( 'strval', $settings['blocked_usernames'] ?? [] ),
		static function ( $username ) {
			return $username !== '';
		}
	)
);

$use_default_blocklist = ! empty( $settings['use_default_blocklist'] );
$default_blocked       = class_exists( \BlockUsernames\Module::class )
	? \BlockUsernames\Module::getDefaultBlockedUsernames()
	: [ 'admin', 'administrator', 'root', 'test', 'demo', 'support', 'webmaster' ];
$max_blocked           = class_exists( \BlockUsernames\Module::class )
	? \BlockUsernames\Module::MAX_BLOCKED_USERNAMES
	: 500;

?>
<div class="wp-powersuite-module-settings" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form class="wp-powersuite-module-settings-form" data-module-id="<?php echo esc_attr( $module_id ); ?>">

		<p class="description">
			<?php esc_html_e( 'Block commonly attacked usernames from being registered. This prevents spam bots and reduces brute force attack targets.', 'wp-powersuite' ); ?>
		</p>

		<table class="form-table" role="presentation">
			<tbody>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_use_default_blocklist">
							<?php esc_html_e( 'Use Default Blacklist', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: default blacklist', 'wp-powersuite' ),
							__( 'Blocks common target usernames such as admin, administrator, root, support, and webmaster.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<label>
							<input
								type="checkbox"
								id="<?php echo esc_attr( $module_id ); ?>_use_default_blocklist"
								name="<?php echo esc_attr( $module_id ); ?>[use_default_blocklist]"
								value="1"
								<?php checked( $use_default_blocklist, true ); ?>
								class="wp-powersuite-advanced-setting"
								data-setting-key="use_default_blocklist"
							/>
							<?php esc_html_e( 'Enable default blacklist', 'wp-powersuite' ); ?>
						</label>
						<p class="description">
							<?php esc_html_e( 'When enabled, the following usernames are automatically blocked:', 'wp-powersuite' ); ?>
							<code><?php echo esc_html( implode( ', ', $default_blocked ) ); ?></code>
						</p>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_blocked_usernames">
							<?php esc_html_e( 'Blocked Usernames', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: custom blocked usernames', 'wp-powersuite' ),
							__( 'Add one username per line. Matching is case-insensitive and exact (blocking "admin" also blocks "Admin", but not partial matches like "admin1").', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<textarea
							id="<?php echo esc_attr( $module_id ); ?>_blocked_usernames"
							name="<?php echo esc_attr( $module_id ); ?>[blocked_usernames]"
							rows="10"
							cols="50"
							class="large-text code wp-powersuite-advanced-setting"
							data-setting-key="blocked_usernames"
							placeholder="<?php echo esc_attr( implode( "\n", [ 'example1', 'example2', 'example3' ] ) ); ?>"
						><?php echo esc_textarea( $blocked_usernames_text ); ?></textarea>
						<p class="description">
							<?php
							printf(
								/* translators: %d: maximum number of custom blocked usernames */
								esc_html__( 'Enter one username per line (up to %d custom entries). Invalid characters are removed when saved.', 'wp-powersuite' ),
								(int) $max_blocked
							);
							?>
						</p>
					</td>
				</tr>
			</tbody>
		</table>

		<div class="wp-powersuite-info-box wpps-module-callout">
			<p>
				<strong><?php esc_html_e( 'How it works', 'wp-powersuite' ); ?>:</strong>
				<?php esc_html_e( 'Blocked names are enforced through the WordPress illegal-login list, so registration, admin user creation, and the REST API share the same rules. Matching is case-insensitive and exact.', 'wp-powersuite' ); ?>
			</p>
		</div>

		<div class="wp-powersuite-info-box wpps-module-callout wpps-module-notice--warning">
			<p>
				<strong><?php esc_html_e( 'Existing users are not affected', 'wp-powersuite' ); ?>:</strong>
				<?php esc_html_e( 'Accounts that already use a blocked username can still log in. This module only prevents new registrations and username changes to disallowed values.', 'wp-powersuite' ); ?>
			</p>
		</div>

		<div class="wp-powersuite-info-box wpps-module-callout">
			<p>
				<strong><?php esc_html_e( 'Unicode and lookalike usernames', 'wp-powersuite' ); ?>:</strong>
				<?php esc_html_e( 'Blocking uses exact login matches after WordPress username sanitization. Visually similar names using different characters (homoglyphs) are not automatically blocked unless you add them to the custom list.', 'wp-powersuite' ); ?>
			</p>
		</div>
	</form>
</div>
