<?php

use DisableFileEditing\Module;
use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! isset( $module_id ) || $module_id === '' ) {
	$module_id = 'disable-file-editing';
}

if ( ! class_exists( Module::class ) && defined( 'WP_POWERSUITE_MODULES_DIR' ) ) {
	$module_file = WP_POWERSUITE_MODULES_DIR . 'disable-file-editing' . DIRECTORY_SEPARATOR . 'module.php';
	if ( is_readable( $module_file ) ) {
		require_once $module_file;
	}
}

$stored   = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
$settings = class_exists( Module::class )
	? Module::normalizeSettings( is_array( $stored ) ? $stored : [] )
	: array_merge(
		[
			'disable_theme_editor'  => true,
			'disable_plugin_editor' => true,
		],
		is_array( $stored ) ? $stored : []
	);

$module_enabled    = OptionStoreModuleSettingsRepository::isModuleEnabled( $module_id );
$wp_config_blocks  = defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT;
$protection_active = $wp_config_blocks || Module::isProtectionConfigured( $settings );

?>

<div class="wp-powersuite-module-settings" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form class="wp-powersuite-module-settings-form" data-module-id="<?php echo esc_attr( $module_id ); ?>">
		<?php wp_nonce_field( 'wp_powersuite_save_module_settings_' . $module_id, 'wp_powersuite_nonce' ); ?>

		<p class="description wpps-module-settings-lead">
			<?php esc_html_e( 'Prevent editing of theme and plugin files from the WordPress admin area. This is a security best practice to prevent unauthorized code changes.', 'wp-powersuite' ); ?>
		</p>

		<?php if ( $protection_active ) : ?>
			<div class="wpps-settings-alert wpps-settings-alert--info" role="status">
				<p>
					<strong><?php esc_html_e( 'Current status', 'wp-powersuite' ); ?></strong>
					<?php
					if ( $wp_config_blocks ) {
						esc_html_e( 'File editing is disabled site-wide via DISALLOW_FILE_EDIT in wp-config.php.', 'wp-powersuite' );
					} else {
						$parts = [];
						if ( ! empty( $settings['disable_theme_editor'] ) ) {
							$parts[] = __( 'theme editor blocked', 'wp-powersuite' );
						}
						if ( ! empty( $settings['disable_plugin_editor'] ) ) {
							$parts[] = __( 'plugin editor blocked', 'wp-powersuite' );
						}
						echo esc_html( implode( '; ', $parts ) );
					}
					?>
				</p>
			</div>
		<?php elseif ( $module_enabled ) : ?>
			<div class="wpps-settings-alert wpps-settings-alert--warning" role="alert">
				<p>
					<strong><?php esc_html_e( 'No editors are blocked', 'wp-powersuite' ); ?></strong>
					<?php esc_html_e( 'This module is enabled but both toggles are off, so dashboard file editing is still allowed. Enable at least one toggle or disable the module.', 'wp-powersuite' ); ?>
				</p>
			</div>
		<?php endif; ?>

		<table class="form-table" role="presentation">
			<tbody>
				<tr>
					<th scope="row">
						<?php esc_html_e( 'Disable editors', 'wp-powersuite' ); ?>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: disable file editing', 'wp-powersuite' ),
							__( 'When enabled, administrators cannot change theme or plugin source from the dashboard. Use SFTP, Git deploy, or your host file manager for real edits. Other PowerSuite tools (such as Code Snippets) may still allow admin code changes.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<label>
							<input type="checkbox"
								name="disable_theme_editor"
								class="wp-powersuite-advanced-setting"
								data-setting-key="disable_theme_editor"
								value="1"
								<?php checked( ! empty( $settings['disable_theme_editor'] ) ); ?>
							/>
							<strong><?php esc_html_e( 'Disable theme editor', 'wp-powersuite' ); ?></strong>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: theme editor', 'wp-powersuite' ),
								__( 'Blocks Appearance → Theme File Editor, the Site Editor (block themes), and the related AJAX editor.', 'wp-powersuite' )
							);
							?>
						</label>
						<p class="description"><?php esc_html_e( 'Prevents editing of theme files from Appearance → Theme Editor, Site Editor, and the AJAX file editor.', 'wp-powersuite' ); ?></p>

						<label class="wpps-settings-option-spaced">
							<input type="checkbox"
								name="disable_plugin_editor"
								class="wp-powersuite-advanced-setting"
								data-setting-key="disable_plugin_editor"
								value="1"
								<?php checked( ! empty( $settings['disable_plugin_editor'] ) ); ?>
							/>
							<strong><?php esc_html_e( 'Disable plugin editor', 'wp-powersuite' ); ?></strong>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: plugin editor', 'wp-powersuite' ),
								__( 'Blocks Plugins → Plugin File Editor and the related AJAX editor.', 'wp-powersuite' )
							);
							?>
						</label>
						<p class="description"><?php esc_html_e( 'Prevents editing of plugin files from Plugins → Plugin File Editor (including the AJAX file editor).', 'wp-powersuite' ); ?></p>
					</td>
				</tr>
			</tbody>
		</table>

		<div class="wpps-settings-alert wpps-settings-alert--warning" role="note">
			<p>
				<strong><?php esc_html_e( 'wp-config.php', 'wp-powersuite' ); ?></strong>
				<?php esc_html_e( 'If DISALLOW_FILE_EDIT is already set in wp-config.php, WordPress enforces that globally and overrides partial choices here. To rely only on these toggles, leave DISALLOW_FILE_EDIT unset or false.', 'wp-powersuite' ); ?>
			</p>
			<p>
				<strong><?php esc_html_e( 'Installs and updates', 'wp-powersuite' ); ?></strong>
				<?php esc_html_e( 'This module does not block plugin/theme installation, activation, deletion, or updates. DISALLOW_FILE_MODS in wp-config.php is a separate, stricter setting that blocks those actions from the dashboard.', 'wp-powersuite' ); ?>
			</p>
		</div>
		<p class="description">
			<?php esc_html_e( 'Once editors are disabled, edit files via SFTP, deployment, or your host file manager.', 'wp-powersuite' ); ?>
		</p>
	</form>
</div>
