<?php

use DisablePasswordReset\Module;
use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! isset( $module_id ) || $module_id === '' ) {
	$module_id = 'disable-password-reset';
}

if ( ! class_exists( Module::class ) && defined( 'WP_POWERSUITE_MODULES_DIR' ) ) {
	$module_file = WP_POWERSUITE_MODULES_DIR . 'disable-password-reset' . DIRECTORY_SEPARATOR . 'module.php';
	if ( is_readable( $module_file ) ) {
		require_once $module_file;
	}
}

$stored   = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
$settings = class_exists( Module::class )
	? Module::normalizeSettings( is_array( $stored ) ? $stored : [] )
	: [
		'allow_admin_reset_emails' => true,
		'disabled_message'         => '',
	];

$module_enabled = OptionStoreModuleSettingsRepository::isModuleEnabled( $module_id );

?>

<div class="wp-powersuite-module-settings" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form class="wp-powersuite-module-settings-form" data-module-id="<?php echo esc_attr( $module_id ); ?>">
		<?php wp_nonce_field( 'wp_powersuite_save_module_settings_' . $module_id, 'wp_powersuite_nonce' ); ?>

		<p class="description wpps-module-settings-lead">
			<?php esc_html_e( 'Block public “forgot password” self-service while keeping normal login, registration, and logged-in password changes working.', 'wp-powersuite' ); ?>
		</p>

		<?php if ( $module_enabled ) : ?>
			<div class="wpps-settings-alert wpps-settings-alert--warning" role="alert">
				<p>
					<strong><?php esc_html_e( 'Account recovery impact', 'wp-powersuite' ); ?></strong>
					<?php esc_html_e( 'Users cannot recover accounts by email on their own. Outstanding password reset links stop working immediately. Plan an admin recovery process before enabling this on production sites.', 'wp-powersuite' ); ?>
				</p>
			</div>
		<?php endif; ?>

		<table class="form-table" role="presentation">
			<tbody>
				<tr>
					<th scope="row">
						<?php esc_html_e( 'Admin recovery', 'wp-powersuite' ); ?>
					</th>
					<td>
						<label>
							<input type="checkbox"
								name="allow_admin_reset_emails"
								class="wp-powersuite-advanced-setting"
								data-setting-key="allow_admin_reset_emails"
								value="1"
								<?php checked( ! empty( $settings['allow_admin_reset_emails'] ) ); ?>
							/>
							<strong><?php esc_html_e( 'Allow admins to send password reset links', 'wp-powersuite' ); ?></strong>
						</label>
						<p class="description">
							<?php esc_html_e( 'When enabled, users with permission to edit users can still email reset links from Users screens. Public lost-password forms remain blocked.', 'wp-powersuite' ); ?>
						</p>
						<p class="description">
							<?php esc_html_e( 'Admins can always set a new password directly on a user profile or via WP-CLI regardless of this setting.', 'wp-powersuite' ); ?>
						</p>
					</td>
				</tr>
				<tr>
					<th scope="row">
						<label for="wpps-dpr-disabled-message"><?php esc_html_e( 'Disabled message', 'wp-powersuite' ); ?></label>
					</th>
					<td>
						<textarea
							id="wpps-dpr-disabled-message"
							name="disabled_message"
							class="large-text wp-powersuite-advanced-setting"
							data-setting-key="disabled_message"
							rows="3"
						><?php echo esc_textarea( (string) ( $settings['disabled_message'] ?? '' ) ); ?></textarea>
						<p class="description">
							<?php esc_html_e( 'Shown on the login screen when someone tries to use password recovery. Leave blank for the default message.', 'wp-powersuite' ); ?>
						</p>
					</td>
				</tr>
			</tbody>
		</table>

		<div class="wpps-settings-alert wpps-settings-alert--info" role="note">
			<p>
				<strong><?php esc_html_e( 'What stays allowed', 'wp-powersuite' ); ?></strong>
				<?php esc_html_e( 'Normal login, logout, registration (if enabled), logged-in profile password changes, and direct admin password updates are not affected.', 'wp-powersuite' ); ?>
			</p>
			<p>
				<strong><?php esc_html_e( 'WooCommerce', 'wp-powersuite' ); ?></strong>
				<?php esc_html_e( 'My Account lost-password links are hidden and the endpoint redirects to the account page with a notice.', 'wp-powersuite' ); ?>
			</p>
		</div>
	</form>
</div>
