<?php
/**
 * TwoFactorAuthTable — standalone class file.
 *
 * @package UltraguardPro\modules\loginlimiter\db
 */

namespace UltraguardPro\modules\loginlimiter\db;

use UltraguardPro\db\BaseTable;
use UltraguardPro\core\DatabaseCrud;

if ( ! defined( 'ABSPATH' ) ) { exit; }

namespace UltraguardPro\modules\loginlimiter\db;

use UltraguardPro\db\BaseTable;
use UltraguardPro\core\DatabaseCrud;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class TwoFactorAuthTable extends BaseTable {

    protected $table_name  = 'ultraguard_two_factor_auth';
    protected $cache_group = 'ultraguard_two_factor_auth';

    public function get_defaults(): array {
        return [
            'id'           => 0,
            'user_id'      => 0,
            'method'       => 'totp',
            'secret_key'   => '',
            'backup_codes' => null,
            'is_enabled'   => 0,
            'last_used_at' => null,
            'created_at'   => '',
            'updated_at'   => '',
        ];
    }

    protected function validate_data( $data ) {
        if ( empty( $data['user_id'] ) ) { return false; }

        $valid_methods = [ 'totp', 'email', 'sms', 'backup' ];
        if ( isset( $data['method'] ) && ! in_array( $data['method'], $valid_methods, true ) ) {
            return false;
        }

        return $data;
    }

    protected function sanitize_data( $data ): array {
        $out = [];
        foreach ( $data as $k => $v ) {
            $out[ $k ] = match ( $k ) {
                'user_id'      => absint( $v ),
                'is_enabled'   => (int) (bool) $v,
                'backup_codes' => is_null( $v ) ? null : ( is_array( $v ) ? wp_json_encode( $v ) : sanitize_textarea_field( (string) $v ) ),
                'secret_key'   => sanitize_text_field( (string) $v ),
                default        => is_string( $v ) ? sanitize_text_field( $v ) : $v,
            };
        }
        return $out;
    }

    protected function get_searchable_fields(): array {
        return [ 'user_id', 'method' ];
    }

    // ── Domain methods ─────────────────────────────────────────────────────────

    /**
     * Get 2FA config for a user, or null if not set up.
     *
     * @param  int $user_id
     * @return array|null
     */
    public function get_for_user( int $user_id ): ?array {
        $r = $this->get_row( [ 'user_id' => $user_id ] );
        return ( $r && ! empty( $r['id'] ) ) ? $r : null;
    }

    /**
     * Check whether 2FA is enabled for a user.
     *
     * @param  int $user_id
     * @return bool
     */
    public function is_2fa_enabled( int $user_id ): bool {
        $r = $this->get_for_user( $user_id );
        return $r && ! empty( $r['is_enabled'] );
    }

    /**
     * Stamp last_used_at for a user.
     *
     * @param  int $user_id
     * @return bool
     */
    public function mark_used( int $user_id ): bool {
        return (bool) $this->update_where(
            [ 'last_used_at' => current_time( 'mysql', true ) ],
            [ 'user_id' => $user_id ]
        );
    }
}


/**
 * LlBlockedIpsTable — Module-owned IP block list.
 *
 * Fully self-contained — does not reference the Firewall module's ip_blacklist table.
 * Provides block/unblock and fast is_blocked() check for login-page enforcement.
 *
 * @package UltraguardPro\modules\loginlimiter\db
 * @since   6.5.0
 */
