<?php
/**
 * Migration phase: back up the native meta table before destructive cleanup.
 *
 * @package TMDO
 * @since 3.0.1
 */


if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Writes a mysqldump-style SQL file of the usermeta table to wp-content/uploads/wpdo-backups/.
 */
class TMDO_Phase_Backup extends TMDO_Migration_Phase_Base {

	/**
	 * Relative path under wp-content/uploads/ for backup files.
	 *
	 * @var string
	 */
	const BACKUP_DIR_REL = 'wpdo-backups';

	/**
	 * Returns the phase slug.
	 *
	 * @return string
	 */
	public function name(): string {
		return 'backup';
	}

	/**
	 * Executes the phase.
	 *
	 * @param array $job Job array (by reference).
	 * @return array{status: string}
	 * @throws \RuntimeException If backup directory or file cannot be created.
	 */
	public function execute( array &$job ): array {
		if ( empty( $job['options']['auto_backup'] ) ) {
			$this->log( $job, '↪ Backup skipped (auto_backup=false)' );
			return array( 'status' => 'ok' );
		}

		$upload_dir = wp_upload_dir();
		$backup_dir = trailingslashit( $upload_dir['basedir'] ) . self::BACKUP_DIR_REL;

		if ( ! wp_mkdir_p( $backup_dir ) ) {
			throw new \RuntimeException( "Cannot create backup directory: {$backup_dir}" );
		}

		$this->write_web_deny_files( $backup_dir );

		$filename    = sprintf( 'wp_usermeta_%s_%s.sql', gmdate( 'Ymd_His' ), $job['job_id'] );
		$backup_path = $backup_dir . '/' . $filename;

		global $wpdb;
		$rows = $wpdb->get_results(
			"SELECT umeta_id, user_id, meta_key, meta_value FROM {$wpdb->usermeta} ORDER BY umeta_id ASC", // phpcs:ignore WPDO.AntiEAV.no-direct-usermeta-select -- migration backup: must read raw usermeta to create full SQL dump before schema change
			ARRAY_A
		);

		$fp = fopen( $backup_path, 'wb' );
		if ( ! $fp ) {
			throw new \RuntimeException( "Cannot open backup file for writing: {$backup_path}" );
		}
		// Owner-only read/write — backup contains user PII (emails, billing
		// addresses, OAuth tokens, session blobs).
		@chmod( $backup_path, 0600 );

		fwrite( $fp, "-- WPDO migration backup of {$wpdb->usermeta}\n" );
		fwrite( $fp, '-- Job: ' . $job['job_id'] . "\n" );
		fwrite( $fp, '-- Generated: ' . gmdate( 'c' ) . "\n" );
		fwrite( $fp, "-- Restore: mysql ... < this_file.sql\n\n" );
		fwrite( $fp, "/*!40101 SET NAMES utf8mb4 */;\n" );
		fwrite( $fp, "/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;\n" );
		fwrite( $fp, "SET FOREIGN_KEY_CHECKS=0;\n" );
		fwrite( $fp, "LOCK TABLES `{$wpdb->usermeta}` WRITE;\n" );

		$batch = array();
		$count = 0;
		foreach ( (array) $rows as $row ) {
			// UNHEX-encode meta_value: avoids escape edge cases (binary, embedded
			// NULs, non-UTF8, sql_mode mismatches at restore time).
			$batch[] = sprintf(
				"(%d,%d,'%s',UNHEX('%s'))",
				(int) $row['umeta_id'],
				(int) $row['user_id'],
				esc_sql( (string) $row['meta_key'] ),
				bin2hex( (string) ( $row['meta_value'] ?? '' ) )
			);
			++$count;
			if ( count( $batch ) >= 500 ) {
				fwrite( $fp, "INSERT INTO `{$wpdb->usermeta}` (umeta_id,user_id,meta_key,meta_value) VALUES\n" . implode( ",\n", $batch ) . ";\n" );
				$batch = array();
			}
		}
		if ( $batch ) {
			fwrite( $fp, "INSERT INTO `{$wpdb->usermeta}` (umeta_id,user_id,meta_key,meta_value) VALUES\n" . implode( ",\n", $batch ) . ";\n" );
		}
		fwrite( $fp, "UNLOCK TABLES;\n" );
		fwrite( $fp, "SET FOREIGN_KEY_CHECKS=1;\n" );
		fwrite( $fp, "/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;\n" );
		fclose( $fp );

		$job['backup_path'] = $backup_path;
		$this->log(
			$job,
			sprintf(
				'Backup written: %s (%d rows, %s, chmod 0600)',
				$filename,
				$count,
				size_format( filesize( $backup_path ) )
			)
		);

		$server = isset( $_SERVER['SERVER_SOFTWARE'] )
			? strtolower( sanitize_text_field( wp_unslash( (string) $_SERVER['SERVER_SOFTWARE'] ) ) )
			: '';
		if ( str_contains( $server, 'nginx' ) ) {
			$this->log( $job, '⚠ nginx detected: add `location ~ /wp-content/uploads/wpdo-backups/ { deny all; }` to your nginx config — .htaccess does not apply.' );
		}

		return array( 'status' => 'ok' );
	}

	/**
	 * Writes .htaccess, web.config, and index.php deny files into the backup directory.
	 *
	 * @param string $backup_dir Absolute path to the backup directory.
	 * @return void
	 */
	private function write_web_deny_files( string $backup_dir ): void {
		$htaccess = $backup_dir . '/.htaccess';
		if ( ! file_exists( $htaccess ) ) {
			file_put_contents( $htaccess, "Require all denied\n" );
			@chmod( $htaccess, 0644 );
		}

		$webconfig = $backup_dir . '/web.config';
		if ( ! file_exists( $webconfig ) ) {
			file_put_contents(
				$webconfig,
				"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<configuration><system.webServer><authorization><deny users=\"*\"/></authorization></system.webServer></configuration>\n"
			);
			@chmod( $webconfig, 0644 );
		}

		$index = $backup_dir . '/index.php';
		if ( ! file_exists( $index ) ) {
			file_put_contents( $index, "<?php // Silence is golden.\n" );
			@chmod( $index, 0644 );
		}
	}
}