<?php
/** Account email and password transition contract harness. */

declare(strict_types=1);

namespace {
	define('ABSPATH', __DIR__ . '/');
	define('MINUTE_IN_SECONDS', 60);
	$GLOBALS['aksrt_account_settings'] = ['email_set_captch' => true];
	$GLOBALS['aksrt_account_user_id'] = 7;
	$GLOBALS['aksrt_account_user'] = null;
	$GLOBALS['aksrt_account_meta'] = [];
	$GLOBALS['aksrt_account_transients'] = [];
	$GLOBALS['aksrt_account_actions'] = [];
	$GLOBALS['aksrt_account_mail'] = [];
	$GLOBALS['aksrt_account_existing_emails'] = [];
	$GLOBALS['aksrt_account_captcha_calls'] = [];
	$GLOBALS['aksrt_account_captcha_fail'] = false;
	$GLOBALS['aksrt_account_update_fail'] = false;

	final class WP_User {
		public function __construct(
			public int $ID,
			public string $user_email,
			public string $display_name,
			public string $user_pass
		) {}
	}

	final class WP_Error {
		public function __construct(
			private string $code = '',
			private string $message = '',
			private mixed $data = null
		) {}
		public function get_error_code(): string { return $this->code; }
		public function get_error_message(): string { return $this->message; }
		public function get_error_data(): mixed { return $this->data; }
	}

	final class JsonResponseException extends \RuntimeException {
		public function __construct(public array $payload) { parent::__construct('json_response'); }
	}

	function add_action(string $hook, callable $callback): void {
		$GLOBALS['aksrt_account_actions'][$hook] = $callback;
	}
	function __(string $text, string $domain = ''): string { return $text; }
	function is_wp_error(mixed $value): bool { return $value instanceof WP_Error; }
	function is_email(string $email): bool { return (bool) filter_var($email, FILTER_VALIDATE_EMAIL); }
	function sanitize_email(string $email): string { return trim($email); }
	function sanitize_key(string $key): string { return preg_replace('/[^a-z0-9_\-]/', '', strtolower($key)) ?? ''; }
	function sanitize_text_field(string $value): string { return trim(strip_tags($value)); }
	function wp_unslash(mixed $value): mixed { return $value; }
	function wp_verify_nonce(string $nonce, string $action): bool { return $nonce === 'valid' && $action === 'aksrt_account_settings'; }
	function get_current_user_id(): int { return (int) $GLOBALS['aksrt_account_user_id']; }
	function wp_get_current_user(): mixed { return $GLOBALS['aksrt_account_user']; }
	function get_userdata(int $user_id): ?WP_User { return $user_id === 7 ? $GLOBALS['aksrt_account_user'] : null; }
	function get_bloginfo(string $show = ''): string { return 'AKSRT Test'; }
	function wp_hash_password(string $password): string { return 'hash:' . $password; }
	function wp_check_password(string $password, string $hash, int $user_id = 0): bool { return hash_equals('hash:' . $password, $hash); }
	function email_exists(string $email): int|false { return $GLOBALS['aksrt_account_existing_emails'][strtolower($email)] ?? false; }
	function set_transient(string $key, mixed $value, int $expiration = 0): bool {
		$GLOBALS['aksrt_account_transients'][$key] = [
			'value' => $value,
			'expires' => $expiration > 0 ? time() + $expiration : 0,
		];
		return true;
	}
	function get_transient(string $key): mixed {
		$row = $GLOBALS['aksrt_account_transients'][$key] ?? null;
		if (!is_array($row)) return false;
		if (!empty($row['expires']) && $row['expires'] <= time()) {
			unset($GLOBALS['aksrt_account_transients'][$key]);
			return false;
		}
		return $row['value'] ?? false;
	}
	function delete_transient(string $key): bool {
		unset($GLOBALS['aksrt_account_transients'][$key]);
		return true;
	}
	function get_user_meta(int $user_id, string $key, bool $single = false): mixed {
		return $GLOBALS['aksrt_account_meta'][$user_id][$key] ?? '';
	}
	function update_user_meta(int $user_id, string $key, mixed $value): bool {
		$GLOBALS['aksrt_account_meta'][$user_id][$key] = $value;
		return true;
	}
	function delete_user_meta(int $user_id, string $key): bool {
		unset($GLOBALS['aksrt_account_meta'][$user_id][$key]);
		return true;
	}
	function wp_update_user(array $data): int|WP_Error {
		if ($GLOBALS['aksrt_account_update_fail']) {
			return new WP_Error('update_failed', 'update failed');
		}
		$user = $GLOBALS['aksrt_account_user'];
		if (isset($data['user_email'])) $user->user_email = (string) $data['user_email'];
		if (isset($data['user_pass'])) $user->user_pass = wp_hash_password((string) $data['user_pass']);
		return (int) $user->ID;
	}
	function aksrt_require_captcha(string $scene, array $payload): true|WP_Error {
		$GLOBALS['aksrt_account_captcha_calls'][] = $scene;
		return $GLOBALS['aksrt_account_captcha_fail'] ? new WP_Error('captcha_failed', 'captcha failed') : true;
	}
	function aksrt_get_auth_agreement_view(): array { return ['enabled' => true, 'required' => true]; }
	function wp_send_json_error(array $data): never { throw new JsonResponseException(['success' => false, 'data' => $data]); }
	function wp_send_json_success(array $data): never { throw new JsonResponseException(['success' => true, 'data' => $data]); }

	function account_settings_request(string $action, array $data = []): array {
		$callback = $GLOBALS['aksrt_account_actions'][$action] ?? null;
		if (!is_callable($callback)) throw new \RuntimeException('Missing AJAX action: ' . $action);
		$_POST = array_merge(['_settings_nonce' => 'valid'], $data);
		try {
			$callback();
		} catch (JsonResponseException $response) {
			return $response->payload;
		}
		throw new \RuntimeException('AJAX action returned without a JSON response: ' . $action);
	}

	function account_settings_check(bool $condition, string $message): void {
		if (!$condition) throw new \RuntimeException($message);
	}

	function account_settings_code_key(string $scene, string $target): string {
		return 'aksrt_account_code_7_' . $scene . '_' . md5(strtolower(trim($target)));
	}

	function account_settings_send_cooldown_key(string $target): string {
		return 'aksrt_send_cd_' . md5(strtolower(trim($target)));
	}

	function account_settings_error_frequency_key(): string {
		return 'aksrt_err_freq_test';
	}

	function account_settings_code(string $scene, string $target): string {
		$stored = get_transient(account_settings_code_key($scene, $target));
		account_settings_check(is_array($stored), 'expected verification code was not stored for ' . $scene);
		return substr((string) ($stored['hash'] ?? ''), strlen('hash:'));
	}

	function account_settings_proof_key(): string {
		return 'aksrt_account_proof_email_old_7';
	}

	require dirname(__DIR__, 2) . '/inc/modules/user-parts/account-ajax.php';
}

namespace AKSRT\Settings {
	final class Settings {
		public static function get_all(): array { return $GLOBALS['aksrt_account_settings']; }
		public static function send_event_email(string $event, string $to, array $values): bool {
			$GLOBALS['aksrt_account_mail'][] = ['event' => $event, 'to' => $to, 'values' => $values];
			return true;
		}
	}
}

namespace AKSRT\Auth {
	final class Service {
		public static function validate_password(string $password, string $confirm = ''): true|string {
			if (strlen($password) < 6) return 'password too short';
			if ($confirm !== '' && $password !== $confirm) return 'password mismatch';
			return true;
		}
	}
}

namespace AKSRT\Extensions {
	final class SendLimit {
		public static function check(string $target): array {
			$sent_at = (int) get_transient('aksrt_send_cd_' . md5(strtolower(trim($target))));
			if ($sent_at > 0 && time() - $sent_at < 60) {
				return ['ok' => false, 'message' => 'cooldown', 'remaining' => 60 - (time() - $sent_at)];
			}
			return ['ok' => true, 'message' => '', 'remaining' => 0];
		}
		public static function record(string $target): int {
			set_transient('aksrt_send_cd_' . md5(strtolower(trim($target))), time(), 60);
			return 60;
		}
	}

	final class SecurityHardening {
		public static function error_frequency_wait(): int {
			$state = get_transient('aksrt_err_freq_test');
			$count = is_array($state) ? (int) ($state['count'] ?? 0) : 0;
			if ($count < 5) return 0;
			return max(0, ($count >= 10 ? 180 : 30) - (time() - (int) ($state['last'] ?? 0)));
		}
		public static function error_frequency_record(): void {
			$state = get_transient('aksrt_err_freq_test');
			$count = is_array($state) ? (int) ($state['count'] ?? 0) + 1 : 1;
			set_transient('aksrt_err_freq_test', ['count' => $count, 'last' => time()], 600);
		}
		public static function error_frequency_clear(): void {
			delete_transient('aksrt_err_freq_test');
		}
	}
}

namespace {
	$GLOBALS['aksrt_account_user'] = new WP_User(7, 'old@example.test', 'Test User', 'hash:OldPass123');
	$send_action = 'wp_ajax_aksrt_send_account_email_code';
	$verify_action = 'wp_ajax_aksrt_verify_account_email';
	$change_email_action = 'wp_ajax_aksrt_change_email';
	$change_password_action = 'wp_ajax_aksrt_change_password';
	$saved_user = $GLOBALS['aksrt_account_user'];
	$GLOBALS['aksrt_account_user'] = null;
	account_settings_check(empty(account_settings_request($send_action, ['scene' => 'verify_email'])['success']), 'email-code request did not handle a missing user object');
	account_settings_check(empty(account_settings_request($verify_action, ['code' => '123456'])['success']), 'old-email verification did not handle a missing user object');
	account_settings_check(empty(account_settings_request($change_email_action, ['new_email' => 'new@example.test'])['success']), 'email update did not handle a missing user object');
	account_settings_check(empty(account_settings_request($change_password_action, ['password' => 'NewPass123', 'password2' => 'NewPass123'])['success']), 'password update did not handle a missing user object');
	$GLOBALS['aksrt_account_user'] = $saved_user;

	$old_send = account_settings_request($send_action, ['scene' => 'verify_email']);
	account_settings_check(!empty($old_send['success']), 'old email verification code could not be sent');
	account_settings_check($old_send['data']['countdown'] === 60, 'old email code send did not surface the cooldown countdown');
	$cooldown_send = account_settings_request($send_action, ['scene' => 'verify_email']);
	account_settings_check(empty($cooldown_send['success']), 'email code resend was not blocked by the send cooldown');
	$old_code = account_settings_code('verify_email', 'old@example.test');
	$bad_old_code = account_settings_request($verify_action, ['code' => 'wrong']);
	account_settings_check(empty($bad_old_code['success']), 'email verification accepted an incorrect old-email code');
	$old_code_row = get_transient(account_settings_code_key('verify_email', 'old@example.test'));
	account_settings_check(($old_code_row['attempts'] ?? 0) === 1, 'incorrect old-email attempt was not recorded');
	$GLOBALS['aksrt_account_transients'][account_settings_code_key('verify_email', 'old@example.test')]['expires'] = time() - 1;
	$expired_old_code = account_settings_request($verify_action, ['code' => $old_code]);
	account_settings_check(empty($expired_old_code['success']), 'email verification accepted an expired old-email code');
	account_settings_check(get_transient(account_settings_code_key('verify_email', 'old@example.test')) === false, 'expired old-email code was not discarded');
	account_settings_check(!aksrt_account_consume_proof(7, 'email_old', 'old@example.test', false), 'expired old-email code issued an old-email proof');
	delete_transient(account_settings_send_cooldown_key('old@example.test'));
	$old_send = account_settings_request($send_action, ['scene' => 'verify_email']);
	account_settings_check(!empty($old_send['success']), 'old email code could not be resent after expiry');
	$old_code = account_settings_code('verify_email', 'old@example.test');
	$verified_old = account_settings_request($verify_action, ['code' => $old_code]);
	account_settings_check(!empty($verified_old['success']), 'email verification rejected the correct old-email code');
	account_settings_check(aksrt_account_consume_proof(7, 'email_old', 'old@example.test', false), 'old-email proof was not issued');
	account_settings_check(get_transient(account_settings_code_key('verify_email', 'old@example.test')) === false, 'valid old-email code was not consumed');

	$new_email = 'new@example.test';
	$new_send = account_settings_request($send_action, ['scene' => 'change_email', 'new_email' => $new_email]);
	account_settings_check(!empty($new_send['success']), 'new email verification code could not be sent');
	$new_code = account_settings_code('change_email', $new_email);
	$GLOBALS['aksrt_account_existing_emails']['taken@example.test'] = 19;
	$duplicate = account_settings_request($change_email_action, ['new_email' => 'taken@example.test', 'code' => $new_code, 'agree_terms' => '1']);
	account_settings_check(empty($duplicate['success']), 'email update accepted an address already owned by another account');
	account_settings_check(aksrt_account_consume_proof(7, 'email_old', 'old@example.test', false), 'duplicate-email validation consumed the old-email proof');
	account_settings_check(get_transient(account_settings_code_key('change_email', $new_email)) !== false, 'duplicate-email validation consumed the new-email code');
	unset($GLOBALS['aksrt_account_existing_emails']['taken@example.test']);

	$bad_new_code = account_settings_request($change_email_action, ['new_email' => $new_email, 'code' => 'wrong', 'agree_terms' => '1']);
	account_settings_check(empty($bad_new_code['success']), 'email update accepted an incorrect new-email code');
	account_settings_check(aksrt_account_consume_proof(7, 'email_old', 'old@example.test', false), 'incorrect-code validation consumed the old-email proof');
	account_settings_check(get_transient(account_settings_code_key('change_email', $new_email)) !== false, 'incorrect-code validation consumed the new-email code');
	$GLOBALS['aksrt_account_transients'][account_settings_code_key('change_email', $new_email)]['expires'] = time() - 1;
	$expired_new_code = account_settings_request($change_email_action, ['new_email' => $new_email, 'code' => $new_code, 'agree_terms' => '1']);
	account_settings_check(empty($expired_new_code['success']), 'email update accepted an expired new-email code');
	account_settings_check(aksrt_account_consume_proof(7, 'email_old', 'old@example.test', false), 'expired new-email code validation consumed the old-email proof');
	account_settings_check(get_transient(account_settings_code_key('change_email', $new_email)) === false, 'expired new-email code was not discarded');
	delete_transient(account_settings_send_cooldown_key($new_email));
	$new_send = account_settings_request($send_action, ['scene' => 'change_email', 'new_email' => $new_email]);
	account_settings_check(!empty($new_send['success']), 'new email code could not be resent after expiry');
	$new_code = account_settings_code('change_email', $new_email);

	$GLOBALS['aksrt_account_update_fail'] = true;
	$write_failure = account_settings_request($change_email_action, ['new_email' => $new_email, 'code' => $new_code, 'agree_terms' => '1']);
	account_settings_check(empty($write_failure['success']), 'email update reported success after the user write failed');
	account_settings_check(aksrt_account_consume_proof(7, 'email_old', 'old@example.test', false), 'failed database write consumed the old-email proof');
	account_settings_check(get_transient(account_settings_code_key('change_email', $new_email)) !== false, 'failed database write consumed the new-email code');
	$GLOBALS['aksrt_account_update_fail'] = false;
	$changed = account_settings_request($change_email_action, ['new_email' => $new_email, 'code' => $new_code, 'agree_terms' => '1']);
	account_settings_check(!empty($changed['success']), 'email update rejected valid old and new proofs');
	account_settings_check($GLOBALS['aksrt_account_user']->user_email === $new_email, 'email update did not persist the new address');
	account_settings_check(!aksrt_account_consume_proof(7, 'email_old', 'old@example.test', false), 'successful update retained the old-email proof');
	account_settings_check(get_transient(account_settings_code_key('change_email', $new_email)) === false, 'successful update retained the new-email code');
	account_settings_check((int) get_user_meta(7, 'aksrt_email_verified', true) === 1, 'successful update did not mark the email verified');
	account_settings_check(end($GLOBALS['aksrt_account_mail'])['event'] === 'change_notice', 'successful update did not notify the previous email');

	$GLOBALS['aksrt_account_settings']['email_set_captch'] = false;
	$direct_email = account_settings_request($change_email_action, ['new_email' => 'direct@example.test', 'agree_terms' => '1']);
	account_settings_check(!empty($direct_email['success']), 'email update without configured verification still required a code');
	account_settings_check($GLOBALS['aksrt_account_user']->user_email === 'direct@example.test', 'direct email update did not persist');

	$GLOBALS['aksrt_account_settings']['email_set_captch'] = true;
	$GLOBALS['aksrt_account_user']->user_email = '';
	$first_email = 'first@example.test';
	$first_send = account_settings_request($send_action, ['scene' => 'change_email', 'new_email' => $first_email]);
	account_settings_check(!empty($first_send['success']), 'first email binding did not send a new-address code');
	$first_code = account_settings_code('change_email', $first_email);
	$first_bind = account_settings_request($change_email_action, ['new_email' => $first_email, 'code' => $first_code, 'agree_terms' => '1']);
	account_settings_check(!empty($first_bind['success']), 'first email binding incorrectly required old-email verification');
	account_settings_check($GLOBALS['aksrt_account_user']->user_email === $first_email, 'first email binding did not persist');

	$GLOBALS['aksrt_account_captcha_fail'] = true;
	$captcha_rejected = account_settings_request($change_password_action, ['password' => 'NewPass123', 'password2' => 'NewPass123', 'passwordold' => 'OldPass123']);
	account_settings_check(empty($captcha_rejected['success']), 'password change bypassed human verification');
	account_settings_check($GLOBALS['aksrt_account_user']->user_pass === 'hash:OldPass123', 'captcha rejection changed the password');
	$GLOBALS['aksrt_account_captcha_fail'] = false;

	for ($attempt = 0; $attempt < 8; $attempt++) {
		$wrong_password = account_settings_request($change_password_action, ['password' => 'NewPass123', 'password2' => 'NewPass123', 'passwordold' => 'wrong']);
		account_settings_check(empty($wrong_password['success']), 'password change accepted an incorrect old password');
	}
	$limited_password = account_settings_request($change_password_action, ['password' => 'NewPass123', 'password2' => 'NewPass123', 'passwordold' => 'OldPass123']);
	account_settings_check(empty($limited_password['success']), 'password change did not apply its old-password attempt limit');
	delete_transient(account_settings_error_frequency_key());
	$changed_password = account_settings_request($change_password_action, ['password' => 'NewPass123', 'password2' => 'NewPass123', 'passwordold' => 'OldPass123']);
	account_settings_check(!empty($changed_password['success']), 'password change rejected the correct old password');
	account_settings_check($GLOBALS['aksrt_account_user']->user_pass === 'hash:NewPass123', 'password change did not persist the new password');
	account_settings_check(get_transient(account_settings_error_frequency_key()) === false, 'successful password change did not reset its error limit');

	update_user_meta(7, 'oauth_new', 1);
	$oauth_password = account_settings_request($change_password_action, ['password' => 'OAuthPass123', 'password2' => 'OAuthPass123']);
	account_settings_check(!empty($oauth_password['success']), 'OAuth first-time password setup incorrectly required an old password');
	account_settings_check(get_user_meta(7, 'oauth_new', true) === '', 'OAuth first-time password setup retained the new-account marker');

	echo "Account settings harness passed\n";
}