<?php

use DisableRESTAPI\Module;
use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! isset( $module_id ) || $module_id === '' ) {
	$module_id = 'disable-rest-api';
}

if ( ! class_exists( Module::class ) && defined( 'WP_POWERSUITE_MODULES_DIR' ) ) {
	$module_file = WP_POWERSUITE_MODULES_DIR . 'disable-rest-api' . DIRECTORY_SEPARATOR . 'module.php';
	if ( is_readable( $module_file ) ) {
		require_once $module_file;
	}
}

$stored   = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
$settings = class_exists( Module::class )
	? Module::normalizeSettings( is_array( $stored ) ? $stored : [] )
	: array_merge(
		[
			'mode'                  => 'disable_public',
			'remove_link_from_head' => true,
		],
		is_array( $stored ) ? $stored : []
	);

$complete_disable_confirm = __( 'Disable REST API completely? This will break the block editor, Site Editor, media library uploads, WordPress mobile apps, WP-CLI REST commands, and any plugin that relies on the REST API. Use “Disable public access only” unless you are certain this site does not need REST.', 'wp-powersuite' );

?>

<div class="wp-powersuite-module-settings" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form
		class="wp-powersuite-module-settings-form"
		data-module-id="<?php echo esc_attr( $module_id ); ?>"
		data-saved-mode="<?php echo esc_attr( $settings['mode'] ); ?>"
	>
		<p class="description wpps-settings-intro">
			<?php esc_html_e( 'Configure how WordPress REST API should be handled. The REST API is used by WordPress core, the block editor, and many plugins.', 'wp-powersuite' ); ?>
		</p>

		<table class="form-table" role="presentation">
			<tbody>
				<tr>
					<th scope="row">
						<?php esc_html_e( 'REST API mode', 'wp-powersuite' ); ?>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: REST modes', 'wp-powersuite' ),
							__( '“Public only” blocks anonymous access to WordPress core REST routes (wp/v2, wp-site-health, and similar). Third-party plugin REST routes are left alone. “Disable completely” blocks all REST and is intended only when you accept breaking the block editor, apps, and plugin integrations.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<fieldset>
							<label>
								<input type="radio"
									name="mode"
									class="wp-powersuite-advanced-setting"
									data-setting-key="mode"
									value="disable_public"
									<?php checked( $settings['mode'], 'disable_public' ); ?>
								/>
								<strong><?php esc_html_e( 'Disable public access only', 'wp-powersuite' ); ?></strong>
								<p class="description"><?php esc_html_e( 'Blocks anonymous access to WordPress core REST only (users, settings, themes, plugins, and similar). WooCommerce, form plugins, and other third-party REST routes keep working. Logged-in users keep full REST access.', 'wp-powersuite' ); ?></p>
							</label>
						</fieldset>

						<fieldset class="wpps-settings-option-spaced">
							<label>
								<input type="radio"
									name="mode"
									class="wp-powersuite-advanced-setting"
									data-setting-key="mode"
									value="disable_completely"
									<?php checked( $settings['mode'], 'disable_completely' ); ?>
								/>
								<strong><?php esc_html_e( 'Disable completely', 'wp-powersuite' ); ?></strong>
								<p class="description"><?php esc_html_e( 'Disables REST API for all users (authenticated and non-authenticated). Integrations can opt out via the wpps_disable_rest_api_allow_route filter. WARNING: This may break the block editor, mobile apps, and plugins that rely on REST API.', 'wp-powersuite' ); ?></p>
							</label>
						</fieldset>
					</td>
				</tr>
				<tr>
					<th scope="row">
						<?php esc_html_e( 'Discovery', 'wp-powersuite' ); ?>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: REST discovery', 'wp-powersuite' ),
							__( 'Removes REST API discovery from HTML head, HTTP Link header, and the XML-RPC RSD endpoint.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<label>
							<input type="checkbox"
								name="remove_link_from_head"
								class="wp-powersuite-advanced-setting"
								data-setting-key="remove_link_from_head"
								value="1"
								<?php checked( ! empty( $settings['remove_link_from_head'] ) ); ?>
							/>
							<?php esc_html_e( 'Remove REST API link from HTML head', 'wp-powersuite' ); ?>
						</label>
					</td>
				</tr>
			</tbody>
		</table>

		<div class="wpps-settings-alert wpps-settings-alert--info" role="note">
			<p>
				<strong><?php esc_html_e( 'Note:', 'wp-powersuite' ); ?></strong>
				<?php esc_html_e( 'Public mode does not block third-party plugin REST routes (WooCommerce Store API, membership plugins, forms, headless integrations, and similar). Only WordPress core namespaces are restricted for anonymous visitors.', 'wp-powersuite' ); ?>
			</p>
		</div>

		<div class="wpps-settings-alert wpps-settings-alert--warning" role="note">
			<p>
				<strong><?php esc_html_e( 'Important:', 'wp-powersuite' ); ?></strong>
				<?php esc_html_e( 'Disabling REST API completely may break the block editor, WordPress mobile apps, and plugins that depend on REST API. Use “Disable public access only” for a safer option.', 'wp-powersuite' ); ?>
			</p>
		</div>
	</form>
</div>
<script>
(function () {
	var mid = <?php echo wp_json_encode( $module_id ); ?>;
	var confirmMessage = <?php echo wp_json_encode( $complete_disable_confirm ); ?>;
	if (!window.wpPowerSuite) {
		return;
	}
	window.wpPowerSuite.confirmBeforeSave = window.wpPowerSuite.confirmBeforeSave || {};
	window.wpPowerSuite.confirmBeforeSave[mid] = function (settingsEl) {
		if (!settingsEl) {
			return true;
		}
		var completeRadio = settingsEl.querySelector('input[data-setting-key="mode"][value="disable_completely"]');
		if (!completeRadio || !completeRadio.checked) {
			return true;
		}
		var savedMode = settingsEl.getAttribute('data-saved-mode') || 'disable_public';
		if (savedMode === 'disable_completely') {
			return true;
		}
		return window.confirm(confirmMessage);
	};
})();
</script>
