<?php
/**
 * Email Verification System
 */

// Generate OTP
function generate_otp($length = 6) {
    $characters = '0123456789';
    $otp = '';

    for ($i = 0; $i < $length; $i++) {
        $otp .= $characters[rand(0, strlen($characters) - 1)];
    }

    return $otp;
}

// Send verification email with OTP
function send_verification_email($user_id, $email) {
    // Generate OTP
    $otp = generate_otp();

    // Store OTP and expiration time in user meta
    $expiration = time() + (2 * 60 * 60); // 2 hours from now
    update_user_meta($user_id, 'email_verification_otp', $otp);
    update_user_meta($user_id, 'email_verification_expiry', $expiration);

    // Get user data
    $user = get_userdata($user_id);
    $first_name = $user->first_name;

    // Prepare email content
    $subject = 'Verify Your Email for TTC Membership';

    $message = "Dear {$first_name},\n\n";
    $message .= "Thank you for registering with TTC. To complete your registration, please verify your email address by entering the following One-Time Password (OTP):\n\n";
    $message .= "OTP: {$otp}\n\n";
    $message .= "This OTP is valid for 2 hours.\n\n";
    $message .= "Please click the following link to verify your email:\n";
    $message .= home_url('/verify-email/?user_id=' . $user_id) . "\n\n";
    $message .= "If you did not request this verification, please ignore this email.\n\n";
    $message .= "Best Regards,\nTTC Team";

    // Send email
    $mail_sent = wp_mail($email, $subject, $message);

    return $mail_sent;
}

// Verify OTP
function verify_email_otp($user_id, $otp) {
    // Get stored OTP and expiration time
    $stored_otp = get_user_meta($user_id, 'email_verification_otp', true);
    $expiry = get_user_meta($user_id, 'email_verification_expiry', true);

    // Check if OTP is valid and not expired
    if ($stored_otp === $otp && time() < $expiry) {
        // Mark email as verified
        $member_post_id = get_user_meta($user_id, 'member_post_id', true);

        if ($member_post_id) {
            update_field('email_verified', 1, $member_post_id);
        }

        update_user_meta($user_id, 'email_verified', 1);

        // Remove OTP data
        delete_user_meta($user_id, 'email_verification_otp');
        delete_user_meta($user_id, 'email_verification_expiry');

        return true;
    }

    return false;
}

// Resend verification email
function resend_verification_email($user_id) {
    $user = get_userdata($user_id);

    if (!$user) {
        return false;
    }

    return send_verification_email($user_id, $user->user_email);
}

// Create email verification page template
function create_email_verification_page() {
    // Check if the page already exists
    $page_exists = get_page_by_path('verify-email');

    if (!$page_exists) {
        // Create the page
        $page_data = array(
            'post_title'    => 'Verify Email',
            'post_content'  => '[email_verification_form]',
            'post_status'   => 'publish',
            'post_type'     => 'page',
            'post_name'     => 'verify-email',
        );

        wp_insert_post($page_data);
    }
}
register_activation_hook(__FILE__, 'create_email_verification_page');

// Email verification form shortcode
function email_verification_form_shortcode() {
    ob_start();

    // Check if user ID is provided
    $user_id = isset($_GET['user_id']) ? intval($_GET['user_id']) : 0;

    // If no user_id in GET, check POST (for form submissions)
    if (!$user_id && isset($_POST['user_id'])) {
        $user_id = intval($_POST['user_id']);
    }

    if (!$user_id) {
        echo '<div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded relative mb-4" role="alert">';
        echo '<p>Invalid verification link. Please contact support.</p>';
        echo '</div>';
        return ob_get_clean();
    }

    $user = get_userdata($user_id);

    if (!$user) {
        echo '<div class="bg-red-100 border border-red-400 text-red-700 px-4 py-3 rounded relative mb-4" role="alert">';
        echo '<p>User not found. Please contact support.</p>';
        echo '</div>';
        return ob_get_clean();
    }

    // Check if email is already verified
    $email_verified = get_user_meta($user_id, 'email_verified', true);

    if ($email_verified) {
        echo '<div class="mx-auto mt-16 lg:w-3/5 w-full bg-white px-8 lg:px-16 py-8 rounded-xl bx-shdw">
            <h3 class="text-2xl text-black font-bold uppercase">VERIFY YOUR EMAIL</h3>';
        echo '<div class="bg-green-100 border border-green-400 text-green-700 px-4 py-3 rounded relative mb-4 mt-5" role="alert">';
        echo '<p class="mb-0">Your email has already been verified. You can now <a href="' . get_permalink(365) . '" style="text-decoration:underline;">log in</a> to your account.</p>';
        echo '</div>';
        echo '</h3>';
        echo '</div>';
        return ob_get_clean();
    }

    // Handle form submission
    $message = '';
    $message_type = '';
    $verified = false;

    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        if (isset($_POST['verify_otp'])) {
            if (
                !isset($_POST['verify_otp_nonce']) ||
                !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['verify_otp_nonce'])), 'verify_otp_action')
            ) {
                $message = 'Security check failed. Please refresh the page and try again.';
                $message_type = 'error';
            } else {
            // Verify OTP
            $otp = sanitize_text_field(wp_unslash($_POST['otp']));

            if (empty($otp)) {
                $message = 'Please enter the OTP.';
                $message_type = 'error';
            } else {
                $verified = verify_email_otp($user_id, $otp);

                if ($verified) {
                    $message = 'Email verified successfully! You can now <a href="' . get_permalink(365) . '">log in</a> to your account.';
                    $message_type = 'success';
                } else {
                    $message = 'Invalid or expired OTP. Please try again or request a new OTP.';
                    $message_type = 'error';
                }
            }
            }
        } elseif (isset($_POST['resend_otp'])) {
            if (
                !isset($_POST['resend_otp_nonce']) ||
                !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['resend_otp_nonce'])), 'resend_otp_action')
            ) {
                $message = 'Security check failed. Please refresh the page and try again.';
                $message_type = 'error';
            } else {
                // Resend OTP
                $resent = resend_verification_email($user_id);

                if ($resent) {
                    $message = 'A new OTP has been sent to your email address. Please check your inbox.';
                    $message_type = 'success';
                } else {
                    $message = 'Failed to resend OTP. Please try again later.';
                    $message_type = 'error';
                }
            }
        }
    }

    // Get user email to display
    $user_email = $user->user_email;
    // Mask part of the email for privacy
    $masked_email = substr($user_email, 0, 3) . '***' . substr($user_email, strpos($user_email, '@'));
    ?>
    <div class="mx-auto mt-16 lg:w-3/5 w-full bg-white px-8 lg:px-16 py-8 rounded-xl bx-shdw">
        <h3 class="text-2xl text-black font-bold uppercase">VERIFY YOUR EMAIL</h3>
        <p class="my-3">Please enter the One-Time Password (OTP) sent to <strong><?php echo esc_html($masked_email); ?></strong></p>

        <?php if ($message): ?>
            <div class="<?php echo $message_type === 'error' ? 'bg-red-100 border border-red-400 text-red-700' : 'bg-green-100 border border-green-400 text-green-700'; ?> px-4 py-3 rounded relative mb-4" role="alert">
                <p class="mb-0"><?php echo $message; ?></p>
            </div>
        <?php endif; ?>
        <?php if(!$verified): ?>
          <!-- Verify OTP Form -->
          <form class="w-full mt-3" method="post" action="" id="verify-otp-form">
              <!-- Add hidden input field to maintain user_id during form submission -->
              <input type="hidden" name="user_id" value="<?php echo esc_attr($user_id); ?>">
              <?php wp_nonce_field('verify_otp_action', 'verify_otp_nonce'); ?>

              <div class="mb-4">
                  <label for="otp" class="block text-sm font-medium text-gray-700 mb-2">Enter OTP</label>
                  <input type="text"
                         name="otp"
                         id="otp"
                         class="bg-white border border-gray-700 text-gray-900 text-sm rounded-lg focus:ring-blue-500 focus:border-blue-500 block w-full p-4"
                         placeholder="Enter your OTP"
                         required>
              </div>

              <div class="flex justify-between items-center">
                  <button type="submit"
                          name="verify_otp"
                          class="text-white green-bg rounded-xl flex justify-center radious-sm px-8 py-4 uppercase hover:bg-white hover:text-black hover:border-gray-700 hover:border">
                      Verify OTP
                  </button>

                  <!-- Separate form for resend button -->
              </div>
          </form>


          <div class="mt-6 text-center">
              <p class="text-sm text-gray-600">Didn't receive the email? Check your spam folder or click the "Resend OTP" button below.</p>
              <form method="post" action="" id="resend-otp-form" style="display: inline;">
                  <input type="hidden" name="user_id" value="<?php echo esc_attr($user_id); ?>">
                  <input type="hidden" name="resend_otp" value="1">
                  <?php wp_nonce_field('resend_otp_action', 'resend_otp_nonce'); ?>
                  <button type="submit"
                          class="text-gray-700 bg-gray-200 rounded-xl flex justify-center radious-sm px-4 py-2 uppercase hover:bg-gray-300">
                      Resend OTP
                  </button>
              </form>
          </div>
        <?php endif; ?>
    </div>
    <?php
    return ob_get_clean();
}
add_shortcode('email_verification_form', 'email_verification_form_shortcode');


/**
 * Prevent login for users with unverified emails, but only for ttc-website-member role
 *
 */
function prevent_login_if_email_not_verified($user, $username, $password) {
    // Check if login is already failed
    if (is_wp_error($user)) {
        return $user;
    }

    // Check if user has the ttc-website-member role
    if ($user && in_array('ttc-website-member', $user->roles)) {
        // Check if email is verified
        $email_verified = get_user_meta($user->ID, 'email_verified', true);

        if (!$email_verified) {
            // If email is not verified, prevent login and show error
            $error = new WP_Error();
            $error->add('email_not_verified', 'Email address not verified. Please check your email for verification instructions or <a href="' . home_url('/verify-email/?user_id=' . $user->ID) . '">click here to verify now</a>.');
            return $error;
        }
    }

    return $user;
}
add_filter('authenticate', 'prevent_login_if_email_not_verified', 30, 3);

/**
 * Add a verification link to user profile page
 *
 */
function add_verification_status_to_user_profile($user) {
    $email_verified = get_user_meta($user->ID, 'email_verified', true);
    ?>
    <h3>Email Verification Status</h3>
    <table class="form-table">
        <tr>
            <th><label for="email_verified">Email Verified</label></th>
            <td>
                <?php if ($email_verified): ?>
                    <span style="color: green; font-weight: bold;">Verified</span>
                <?php else: ?>
                    <span style="color: red; font-weight: bold;">Not Verified</span>
                    <p>
                    <button type="button" data-user_id="<?php echo $user->ID; ?>" id="verify-email-now" href="<?php echo esc_url(home_url('/verify-email/?user_id=' . $user->ID)); ?>" class="button">
                            Verify Email Now
                        </button>
                        <a href="#" onclick="resendVerificationEmail(<?php echo $user->ID; ?>); return false;" class="button">
                            Resend Verification Email
                        </a>
                    </p>
                    <script>
                        function resendVerificationEmail(userId) {
                            // You can implement an AJAX call here to resend verification email
                            alert('Verification email will be resent. Please check your inbox.');
                            // Example AJAX call (you need to implement the server-side handler)
                            /*
                            jQuery.post(
                                ajaxurl,
                                {
                                    'action': 'resend_verification_email',
                                    'user_id': userId
                                },
                                function(response) {
                                    alert(response);
                                }
                            );
                            */
                        }
                    </script>
                <?php endif; ?>
            </td>
        </tr>
    </table>
    <?php
}
add_action('show_user_profile', 'add_verification_status_to_user_profile');
add_action('edit_user_profile', 'add_verification_status_to_user_profile');

/**
 * Add AJAX handler for resending verification email
 *
 */
function ajax_resend_verification_email() {
    if (
        !isset($_POST['nonce']) ||
        !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'email_verification_ajax_nonce')
    ) {
        wp_send_json_error('Security check failed.');
        return;
    }

    // Check if user is logged in and has permissions
    if (!is_user_logged_in()) {
        wp_send_json_error('You must be logged in to perform this action.');
        return;
    }

    $user_id = isset($_POST['user_id']) ? intval($_POST['user_id']) : 0;

    // Check if the current user can edit the target user
    if (!current_user_can('edit_user', $user_id)) {
        wp_send_json_error('You do not have permission to perform this action.');
        return;
    }

    // Include email verification functions

    // Resend verification email
    $result = resend_verification_email($user_id);

    if ($result) {
        wp_send_json_success('Verification email sent successfully. Please check your inbox.');
    } else {
        wp_send_json_error('Failed to send verification email. Please try again later.');
    }
}
add_action('wp_ajax_resend_verification_email', 'ajax_resend_verification_email');
add_action('wp_ajax_nopriv_resend_verification_email', 'ajax_resend_verification_email');

/**
 * Modify the login process to handle verification failures
 *
 */
function login_message_for_unverified_email($message) {
    // Check if we have a verification error
    if (isset($_GET['login']) && $_GET['login'] === 'unverified') {
        $message = '<div class="message error"><p class="message">' .
                   'Your email address has not been verified. Please check your email for verification instructions or ' .
                   '<a href="' . home_url('/verify-email/?user_id=' . $_GET['user_id']) . '">click here to verify now</a>.' .
                   '</p></div>';
    }

    return $message;
}
add_filter('login_message', 'login_message_for_unverified_email');

function ajax_verify_email() {
    if (
        !isset($_POST['nonce']) ||
        !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'email_verification_ajax_nonce')
    ) {
        wp_send_json_error('Security check failed.');
        return;
    }

    // Check if user is logged in and has permissions
    if (!is_user_logged_in()) {
        wp_send_json_error(['error'=>'you must be logged in to perform this action.']);
        return;
    }

    $user_id = isset($_POST['user_id']) ? intval($_POST['user_id']) : 0;

    // Check if the current user can edit the target user
    if (!current_user_can('edit_user', $user_id)) {
        wp_send_json_error('You do not have permission to perform this action.');
        return;
    }

    // Include email verification functions

    // Resend verification email
    $result = resend_verification_email($user_id);

    if ($result) {
        wp_send_json_success('Verification email sent successfully. Please check your inbox.');
    } else {
        wp_send_json_error('Failed to send verification email. Please try again later.');
    }
}