<?php

namespace UltraguardPro\modules\authenticator\pages;

if ( ! defined( 'ABSPATH' ) ) { exit; }

use UltraguardPro\Plugin;
use UltraguardPro\modules\core\BasePage;

class TwoFactorSettings extends BasePage {

    public function __construct( Plugin $plugin ) {
        parent::__construct( $plugin );
        $this->ajax_nonce_action = 'ultraguard_admin_nonce';
    }

    public function get_scheme( $context ): array {
        $is_pro         = \UltraguardPro\support\LicenseInfo::instance()->isPro();
        $settings       = $this->settings->get_module_settings( 'two_factor' );
        $required_roles = (array) ( $settings['two_factor_required_roles'] ?? [] );
        $role_options   = [];

        foreach ( wp_roles()->get_names() as $slug => $label ) {
            $role_options[] = [
                'value'    => $slug,
                'label'    => translate_user_role( $label ),
                'selected' => in_array( $slug, $required_roles, true ),
            ];
        }

        return [
            'type'      => 'page',
            'id'        => 'ultraguard-two-factor-settings',
            'page_slug' => 'two-factor-settings',
            'header'    => [
                'title'    => __( 'Two-Factor Settings', 'ultraguard-security-suite' ),
                'subtitle' => __( 'Control enrollment, required roles, prompts, issuer name, and backup code policy.', 'ultraguard-security-suite' ),
                'actions'  => [
                    $this->create_url_button( __( 'Back to Dashboard', 'ultraguard-security-suite' ), $this->get_page_url( 'two-factor' ), 'secondary', 'dashicons-arrow-left-alt' ),
                ],
            ],
            'data'      => array_values( array_filter( [
                // Free users: explain the single-admin limitation and what Pro unlocks
                $is_pro ? [] : $this->pro_upsell_card( 'all_users_2fa' ),
                [
                    'type'  => 'card',
                    'title' => __( 'Module Controls', 'ultraguard-security-suite' ),
                    'icon'  => 'dashicons-shield-alt',
                    'data'  => [
                        [ 'type' => 'toggle', 'name' => 'two_factor_enabled', 'label' => __( 'Enable Two-Factor Authentication module', 'ultraguard-security-suite' ), 'value' => ! empty( $settings['two_factor_enabled'] ) ],
                        [ 'type' => 'toggle', 'name' => 'two_factor_allow_self_enroll', 'label' => __( 'Allow users to self-enroll', 'ultraguard-security-suite' ), 'value' => ! empty( $settings['two_factor_allow_self_enroll'] ) ],
                        [ 'type' => 'toggle', 'name' => 'two_factor_show_setup_prompt', 'label' => __( 'Show setup prompt in wp-admin', 'ultraguard-security-suite' ), 'value' => ! empty( $settings['two_factor_show_setup_prompt'] ) ],
                        [ 'type' => 'toggle', 'name' => 'two_factor_email_notifications', 'label' => __( 'Send email on enable/disable/lockout events', 'ultraguard-security-suite' ), 'value' => ! empty( $settings['two_factor_email_notifications'] ) ],
                    ],
                ],
                [
                    'type'  => 'card',
                    'title' => __( 'Enforcement', 'ultraguard-security-suite' ),
                    'icon'  => 'dashicons-admin-users',
                    'data'  => [
                        [ 'type' => 'select', 'multiple' => true, 'size' => 6, 'name' => 'two_factor_required_roles', 'label' => __( 'Required roles', 'ultraguard-security-suite' ), 'options' => $role_options, 'value' => $required_roles ],
                        [ 'type' => 'number', 'name' => 'two_factor_grace_period_days', 'label' => __( 'Grace period (days)', 'ultraguard-security-suite' ), 'value' => (int) ( $settings['two_factor_grace_period_days'] ?? 7 ), 'min' => 0, 'max' => 90 ],
                    ],
                ],
                [
                    'type'  => 'card',
                    'title' => __( 'Authenticator Experience', 'ultraguard-security-suite' ),
                    'icon'  => 'dashicons-smartphone',
                    'data'  => [
                        [
                            'type'    => 'select',
                            'name'    => 'two_factor_backup_code_count',
                            'label'   => __( 'Number of backup codes', 'ultraguard-security-suite' ),
                            'value'   => (string) ( $settings['two_factor_backup_code_count'] ?? '8' ),
                            'options' => [
                                [ 'value' => '6', 'label' => '6' ],
                                [ 'value' => '8', 'label' => '8' ],
                                [ 'value' => '10', 'label' => '10' ],
                            ],
                        ],
                        [ 'type' => 'text', 'name' => 'two_factor_issuer_name', 'label' => __( 'Issuer name', 'ultraguard-security-suite' ), 'value' => (string) ( $settings['two_factor_issuer_name'] ?? get_bloginfo( 'name' ) ) ],
                    ],
                ],
            ] ) ),
            'form'      => [
                'enable' => true,
                'id'     => 'two-factor-settings-form',
                'ajax'   => true,
                'action' => 'ultraguard_save_two_factor_settings',
                'nonce'  => $this->create_nonce( 'ultraguard_admin_nonce' ),
                'submit' => [
                    'text'         => __( 'Save Settings', 'ultraguard-security-suite' ),
                    'button_style' => 'primary',
                    'icon'         => 'dashicons-saved',
                ],
            ],
        ];
    }
}
