<?php
/**
 * WeChat Official Account QR and verification-code authentication.
 *
 * @package Jio
 */

namespace Jio\Auth;

use Jio\Settings\Settings;

defined('ABSPATH') || exit;

final class WeixinGzh {

	private const ACCESS_OPTION = 'jio_weixingzh_access_token';
	private const SCENE_OPTION_PREFIX = 'jio_weixingzh_scene_';
	private const CODE_OPTION_PREFIX = 'jio_weixingzh_code_';
	private const DEDUPE_OPTION_PREFIX = 'jio_weixingzh_event_';
	private const SCAN_KIND = 'weixingzh_scan';
	private const CODE_KIND = 'weixingzh_code';
	private const SCAN_TTL = 5 * MINUTE_IN_SECONDS;
	private const CODE_TTL = 5 * MINUTE_IN_SECONDS;
	private const CODE_LENGTH = 8;
	private const CODE_MAX_ATTEMPTS = 5;
	private const MAX_WEBHOOK_BODY = 131072;

	private static $instance = null;

	public static function get_instance(): self {
		if (null === self::$instance) {
			self::$instance = new self();
		}
		return self::$instance;
	}

	public function init(): void {
		add_action('rest_api_init', [$this, 'register_routes']);
		add_action('template_redirect', [$this, 'maybe_server_verify'], 1);
		add_action('template_redirect', [$this, 'maybe_server_message'], 2);
		add_action('init', [$this, 'maybe_cleanup_options'], 30);
	}

	public function register_routes(): void {
		register_rest_route('jio/v1', '/auth/qrcode-login', [
			'methods' => ['GET', 'POST'],
			'callback' => [$this, 'rest_qrcode_login'],
			'permission_callback' => '__return_true',
		]);
		register_rest_route('jio/v1', '/auth/check-qrcode-login', [
			'methods' => ['GET', 'POST'],
			'callback' => [$this, 'rest_check_qrcode_login'],
			'permission_callback' => '__return_true',
		]);
		register_rest_route('jio/v1', '/auth/weixingzh-code', [
			'methods' => 'POST',
			'callback' => [$this, 'rest_code_login'],
			'permission_callback' => '__return_true',
		]);
	}

	/**
	 * @return array<string,mixed>
	 */
	public static function settings(): array {
		return class_exists(Settings::class) ? (array) Settings::get_weixingzh_settings() : [];
	}

	public static function is_enabled(): bool {
		if (!class_exists(Settings::class) || !OAuthProviderCatalog::master_enabled()) {
			return false;
		}
		$all = Settings::get_all();
		if (empty($all['oauth_weixingzh_s'])) {
			return false;
		}
		$config = self::settings();
		$type = sanitize_key((string) ($config['gzh_type'] ?? ''));
		$token = trim((string) ($config['token'] ?? ''));
		if ($type === 'service') {
			return $token !== ''
				&& trim((string) ($config['appid'] ?? '')) !== ''
				&& trim((string) ($config['appsecret'] ?? '')) !== '';
		}
		if ($type === 'subscribe') {
			return $token !== ''
				&& trim((string) ($config['code_qrcode'] ?? '')) !== ''
				&& trim((string) ($config['code_keyword'] ?? '')) !== '';
		}
		return false;
	}

	public function access_token(): string {
		$config = self::settings();
		$appid = trim((string) ($config['appid'] ?? ''));
		$secret = trim((string) ($config['appsecret'] ?? ''));
		if ($appid === '' || $secret === '') {
			return '';
		}
		return $this->get_access_token($appid, $secret);
	}

	public function rest_qrcode_login(\WP_REST_Request $request) {
		$limited = $this->rate_limit('qr-create', 12, MINUTE_IN_SECONDS, 2);
		if ($limited) {
			return $limited;
		}
		if (!self::is_enabled()) {
			return $this->error_response(__('微信公众号登录未开启或配置不完整', 'jio'), 400);
		}
		$context = $this->request_context($request);
		if (is_wp_error($context)) {
			return $this->error_response($context->get_error_message(), 403);
		}
			$config = self::settings();
			$mode = (string) ($config['gzh_type'] ?? '');
			if ($context['action'] === 'bind') {
				$data = $this->request_data($request);
				$bind_pass = sanitize_text_field((string) ($data['bind_pass'] ?? ''));
				if (!OAuth::validate_bind_pass($bind_pass, 'weixingzh', $context['user_id'], false)) {
					return $this->error_response(__('请先完成人机验证后再绑定', 'jio'), 403);
				}
				$context['bind_pass'] = $bind_pass;
			}
			if ($mode === 'subscribe') {
				return $this->code_mode_response($config, $context);
			}

		$appid = trim((string) ($config['appid'] ?? ''));
		$secret = trim((string) ($config['appsecret'] ?? ''));
		$scene = 'jio_' . rtrim(strtr(base64_encode(random_bytes(18)), '+/', '-_'), '=');
		$transaction = '';
		try {
			$transaction = OAuthTransactionStore::issue(self::SCAN_KIND, [
				'status' => 'pending',
				'scene' => $scene,
				'openid' => '',
				'profile' => [],
				'redirect_to' => $context['redirect_to'],
					'action' => $context['action'],
					'user_id' => $context['user_id'],
					'bind_pass' => (string) ($context['bind_pass'] ?? ''),
				], self::SCAN_TTL, true);
			if (!$this->store_scene_mapping($scene, $transaction)) {
				throw new \RuntimeException('scene_mapping_failed');
			}
			$access_token = $this->get_access_token($appid, $secret);
			$created = $this->api_post(
				'https://api.weixin.qq.com/cgi-bin/qrcode/create?access_token=' . rawurlencode($access_token),
				[
					'expire_seconds' => self::SCAN_TTL,
					'action_name' => 'QR_STR_SCENE',
					'action_info' => ['scene' => ['scene_str' => $scene]],
				]
			);
			if (empty($created['ticket'])) {
				throw new \RuntimeException((string) ($created['errmsg'] ?? 'qrcode_create_failed'));
			}
			$image = 'https://mp.weixin.qq.com/cgi-bin/showqrcode?ticket=' . rawurlencode((string) $created['ticket']);
			$html = '<img class="signin-qrcode-img" src="' . esc_url($image) . '" alt="' . esc_attr__('微信公众号扫码登录二维码', 'jio') . '" style="width:160px;height:160px;" />';
			$html .= '<p class="text-center mt10 em09 muted-2-color"><i class="fa fab fa-weixin c-green"></i> ' . esc_html__('微信扫码登录', 'jio') . '</p>';
			return new \WP_REST_Response([
				'success' => true,
				'data' => [
					'mode' => 'scan',
					'qr_html' => $html,
					'check_url' => '/auth/check-qrcode-login',
					'token' => $transaction,
					'poll_interval' => 3,
				],
			], 200);
		} catch (\Throwable $e) {
			if ($transaction !== '') {
				OAuthTransactionStore::delete($transaction);
				$this->delete_scene_mapping($scene, $transaction);
			}
			return $this->error_response(__('创建微信登录二维码失败，请稍后重试', 'jio'), 502);
		}
	}

	public function rest_check_qrcode_login(\WP_REST_Request $request) {
		$limited = $this->rate_limit('qr-check', 150, 5 * MINUTE_IN_SECONDS, 1);
		if ($limited) {
			return $limited;
		}
		if (!self::is_enabled()) {
			return $this->error_response(__('微信公众号登录未开启或配置不完整', 'jio'), 400);
		}
		$data = $this->request_data($request);
		$token = sanitize_text_field((string) ($data['token'] ?? ''));
		if ($token === '') {
			return $this->error_response(__('缺少 token', 'jio'), 400);
		}
		$row = OAuthTransactionStore::peek($token, self::SCAN_KIND, true);
		if (!$row) {
			return new \WP_REST_Response(['success' => true, 'data' => ['logged_in' => false, 'status' => 'expired']], 200);
		}
		$payload = is_array($row['payload'] ?? null) ? $row['payload'] : [];
		$status = sanitize_key((string) ($payload['status'] ?? 'pending'));
		if ($status !== 'ok') {
			return new \WP_REST_Response([
				'success' => true,
				'data' => ['logged_in' => false, 'status' => $status !== '' ? $status : 'pending', 'poll_interval' => 3],
			], 200);
		}
		if (!$this->binding_user_matches($payload)) {
			return $this->error_response(__('绑定会话与当前用户不匹配', 'jio'), 403);
		}
		$claimed = OAuthTransactionStore::claim($token, self::SCAN_KIND, true);
		if (!$claimed) {
			return new \WP_REST_Response(['success' => true, 'data' => ['logged_in' => false, 'status' => 'expired']], 200);
		}
		$payload = is_array($claimed['payload'] ?? null) ? $claimed['payload'] : [];
		return $this->complete_browser_identity($payload);
	}

	public function rest_code_login(\WP_REST_Request $request) {
		$limited = $this->rate_limit('code', self::CODE_MAX_ATTEMPTS, self::CODE_TTL, 1);
		if ($limited) {
			return $limited;
		}
		if (!self::is_enabled()) {
			return $this->error_response(__('微信公众号登录未开启或配置不完整', 'jio'), 400);
		}
		$data = $this->request_data($request);
		$code = strtoupper(sanitize_text_field((string) ($data['code'] ?? '')));
		if (preg_match('/^[A-Z0-9]{6,12}$/', $code) !== 1) {
			return $this->error_response(__('请输入至少 6 位的有效验证码', 'jio'), 400);
		}
		$context = $this->request_context($request);
		if (is_wp_error($context)) {
			return $this->error_response($context->get_error_message(), 403);
		}
		$bind_pass = '';
		if ($context['action'] === 'bind') {
			$bind_pass = sanitize_text_field((string) ($data['bind_pass'] ?? ''));
			if (!OAuth::validate_bind_pass($bind_pass, 'weixingzh', $context['user_id'], false)) {
				return $this->error_response(__('请先完成人机验证后再绑定', 'jio'), 403);
			}
		}
		$claimed = $this->claim_code_transaction($code, $context);
		if (!$claimed) {
			return $this->error_response(__('验证码无效、已过期或尝试次数过多', 'jio'), 400);
		}
		$payload = is_array($claimed['payload'] ?? null) ? $claimed['payload'] : [];
		if ($context['action'] === 'bind') {
			$payload['bind_pass'] = $bind_pass;
		}
		return $this->complete_browser_identity($payload);
	}

	/**
	 * WeChat server URL verification.
	 */
	public function maybe_server_verify(): void {
		if (empty($_GET['jio_weixingzh']) || ($_SERVER['REQUEST_METHOD'] ?? '') !== 'GET' || !isset($_GET['echostr'])) {
			return;
		}
		if (!self::is_enabled() || !$this->verify_webhook_signature()) {
			status_header(403);
			exit;
		}
		$echo = (string) wp_unslash($_GET['echostr']);
		if (strlen($echo) > 256 || preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', $echo)) {
			status_header(400);
			exit;
		}
		header('Content-Type: text/plain; charset=utf-8');
		echo $echo; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Protocol challenge response.
		exit;
	}

	/**
	 * Receive plaintext WeChat server messages.
	 */
	public function maybe_server_message(): void {
		if (empty($_GET['jio_weixingzh']) || ($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST' || isset($_GET['echostr'])) {
			return;
		}
		if (!self::is_enabled() || !$this->verify_webhook_signature()) {
			status_header(403);
			exit;
		}
		$content_length = isset($_SERVER['CONTENT_LENGTH']) ? (int) $_SERVER['CONTENT_LENGTH'] : 0;
		if ($content_length > self::MAX_WEBHOOK_BODY) {
			status_header(413);
			exit;
		}
		$raw = file_get_contents('php://input', false, null, 0, self::MAX_WEBHOOK_BODY + 1);
		if (!is_string($raw) || $raw === '' || strlen($raw) > self::MAX_WEBHOOK_BODY) {
			status_header($raw === '' ? 400 : 413);
			exit;
		}
		$previous = libxml_use_internal_errors(true);
		try {
			$xml = simplexml_load_string($raw, 'SimpleXMLElement', LIBXML_NONET | LIBXML_NOCDATA);
		} finally {
			libxml_clear_errors();
			libxml_use_internal_errors($previous);
		}
		if (!$xml) {
			status_header(400);
			exit;
		}

		$dedupe_key = $this->claim_webhook_event($xml);
		if ($dedupe_key === false) {
			$this->echo_success();
		}
		try {
			$this->handle_webhook_message($xml);
		} catch (\Throwable $e) {
			delete_option($dedupe_key);
			status_header(500);
			exit;
		}
	}

	/**
	 * @param array<string,mixed> $config
	 * @param array{action:string,user_id:int,redirect_to:string} $context
	 */
	private function code_mode_response(array $config, array $context): \WP_REST_Response {
		$qr = trim((string) ($config['code_qrcode'] ?? ''));
		$keyword = trim((string) ($config['code_keyword'] ?? __('登录', 'jio')));
		$html = '<img class="signin-qrcode-img" src="' . esc_url($qr) . '" alt="' . esc_attr__('微信公众号验证码登录二维码', 'jio') . '" style="width:160px;height:160px;object-fit:contain;" />';
		$html .= '<form class="jio-weixingzh-code-form" data-jio-weixingzh-code>';
		$html .= '<p class="muted-2-color em09">' . esc_html(sprintf(__('关注公众号后发送「%s」获取验证码', 'jio'), $keyword)) . '</p>';
		$html .= '<input type="hidden" name="action" value="' . esc_attr($context['action']) . '" />';
			$html .= '<input type="hidden" name="user_id" value="' . esc_attr((string) $context['user_id']) . '" />';
			$html .= '<input type="hidden" name="redirect_to" value="' . esc_attr($context['redirect_to']) . '" />';
			if (!empty($context['bind_pass'])) {
				$html .= '<input type="hidden" name="bind_pass" value="' . esc_attr((string) $context['bind_pass']) . '" />';
			}
			$html .= '<input type="text" name="code" class="form-control" minlength="6" maxlength="12" autocomplete="one-time-code" placeholder="' . esc_attr__('请输入验证码', 'jio') . '" required />';
		$html .= '<button type="submit" class="but c-blue btn-block mt10">' . esc_html__('登录', 'jio') . '</button>';
		$html .= '</form>';
		return new \WP_REST_Response([
			'success' => true,
			'data' => ['mode' => 'code', 'qr_html' => $html, 'check_url' => '', 'token' => ''],
		], 200);
	}

	/**
	 * @return array{action:string,user_id:int,redirect_to:string}|\WP_Error
	 */
	private function request_context(\WP_REST_Request $request) {
		$data = $this->request_data($request);
		$action = sanitize_key((string) ($data['action'] ?? 'login')) === 'bind' ? 'bind' : 'login';
		$current_user_id = get_current_user_id();
		$requested_user_id = isset($data['user_id']) ? (int) $data['user_id'] : 0;
		if ($action === 'bind') {
			if ($current_user_id <= 0) {
				return new \WP_Error('weixingzh_bind_login_required', __('请先登录后再绑定微信公众号', 'jio'));
			}
			if ($requested_user_id > 0 && $requested_user_id !== $current_user_id) {
				return new \WP_Error('weixingzh_bind_user_mismatch', __('绑定请求与当前用户不匹配', 'jio'));
			}
		}
		$redirect = OAuthUrlPolicy::validated_redirect((string) ($data['redirect_to'] ?? ''), home_url('/'));
		return [
			'action' => $action,
			'user_id' => $current_user_id,
			'redirect_to' => $redirect,
		];
	}

	/**
	 * @return array<string,mixed>
	 */
	private function request_data(\WP_REST_Request $request): array {
		$params = $request->get_params();
		$json = $request->get_json_params();
		return array_merge(is_array($params) ? $params : [], is_array($json) ? $json : []);
	}

	/**
	 * @param array<string,mixed> $payload
	 */
	private function binding_user_matches(array $payload): bool {
		if ((string) ($payload['action'] ?? 'login') !== 'bind') {
			return true;
		}
		$user_id = (int) ($payload['user_id'] ?? 0);
		return $user_id > 0 && $user_id === get_current_user_id();
	}

	/**
	 * @param array<string,mixed> $payload
	 */
	private function complete_browser_identity(array $payload): \WP_REST_Response {
		$openid = trim((string) ($payload['openid'] ?? ''));
		if ($openid === '') {
			return $this->error_response(__('微信身份信息无效', 'jio'), 400);
		}
		$profile = is_array($payload['profile'] ?? null) ? $payload['profile'] : [];
		$identity = [
			'provider' => 'weixingzh',
			'provider_id' => $openid,
			'username' => sanitize_text_field((string) ($profile['nickname'] ?? '')),
			'name' => sanitize_text_field((string) ($profile['nickname'] ?? '')),
			'email' => '',
			'email_verified' => false,
			'avatar_url' => esc_url_raw((string) ($profile['headimgurl'] ?? '')),
		];
		if ((string) ($payload['action'] ?? 'login') === 'bind') {
			if (!$this->binding_user_matches($payload)) {
				return $this->error_response(__('绑定会话与当前用户不匹配', 'jio'), 403);
			}
			$bind_pass = sanitize_text_field((string) ($payload['bind_pass'] ?? ''));
			if (!OAuth::validate_bind_pass($bind_pass, 'weixingzh', get_current_user_id(), true)) {
				return $this->error_response(__('绑定验证已过期，请重新完成人机验证', 'jio'), 403);
			}
			$result = OAuthAccountService::bind(get_current_user_id(), 'weixingzh', $identity);
			if (is_wp_error($result)) {
				return $this->error_response($result->get_error_message(), 409);
			}
			$redirect = function_exists('jio_get_user_center_url') ? jio_get_user_center_url('settings') : home_url('/');
			$redirect = add_query_arg(['oauth_action' => 'bind', 'oauth_provider' => 'weixingzh'], $redirect);
			return new \WP_REST_Response([
				'success' => true,
				'data' => ['logged_in' => false, 'bound' => true, 'status' => 'bound', 'redirect' => $redirect],
			], 200);
		}

		$user = OAuthAccountService::resolve('weixingzh', $identity);
		if (is_wp_error($user) && $user->get_error_code() === 'oauth_no_match') {
			try {
				$redirect = OAuthUrlPolicy::validated_redirect((string) ($payload['redirect_to'] ?? ''), home_url('/'));
				$obk = OAuthTransactionStore::issue('obk', [
					'provider' => 'weixingzh',
					'provider_id' => $openid,
					'user_data' => $identity,
					'redirect_to' => $redirect,
				], 15 * MINUTE_IN_SECONDS, true);
				$bind_url = function_exists('jio_get_bind_url')
					? jio_get_bind_url($obk)
					: add_query_arg(['tab' => 'bind', 'obk' => $obk], home_url('/sign/'));
					return new \WP_REST_Response([
						'success' => true,
						'data' => [
							'logged_in' => false,
							'needs_binding' => true,
							'status' => 'needs_binding',
							'redirect' => $bind_url,
						],
					], 200);
			} catch (\Throwable $e) {
				return $this->error_response(__('无法创建账号绑定会话，请重试', 'jio'), 500);
			}
		}
		if (!$user instanceof \WP_User) {
			return $this->error_response(is_wp_error($user) ? $user->get_error_message() : __('微信账号匹配失败', 'jio'), 400);
		}
		OAuthAccountService::complete_login($user, true);
		$redirect = OAuthUrlPolicy::validated_redirect((string) ($payload['redirect_to'] ?? ''), home_url('/'));
		return new \WP_REST_Response([
			'success' => true,
			'data' => [
				'logged_in' => true,
				'status' => 'success',
				'redirect' => $redirect,
				'user' => ['id' => $user->ID, 'display_name' => $user->display_name],
			],
		], 200);
	}

	private function verify_webhook_signature(): bool {
		$config = self::settings();
		$token = trim((string) ($config['token'] ?? ''));
		$timestamp = isset($_GET['timestamp']) ? (string) wp_unslash($_GET['timestamp']) : '';
		$nonce = isset($_GET['nonce']) ? (string) wp_unslash($_GET['nonce']) : '';
		$signature = isset($_GET['signature']) ? strtolower((string) wp_unslash($_GET['signature'])) : '';
		if ($token === '' || $timestamp === '' || $nonce === '' || preg_match('/^[a-f0-9]{40}$/', $signature) !== 1) {
			return false;
		}
		$parts = [$token, $timestamp, $nonce];
		sort($parts, SORT_STRING);
		return hash_equals(sha1(implode('', $parts)), $signature);
	}

	private function handle_webhook_message(\SimpleXMLElement $xml): void {
		$from = trim((string) ($xml->FromUserName ?? ''));
		$to = trim((string) ($xml->ToUserName ?? ''));
		$msg_type = strtolower(trim((string) ($xml->MsgType ?? '')));
		$event = strtolower(trim((string) ($xml->Event ?? '')));
		$content = trim((string) ($xml->Content ?? ''));
		if ($from === '' || $to === '') {
			$this->echo_success();
		}
		$config = self::settings();
		if ($msg_type === 'event' && in_array($event, ['subscribe', 'scan'], true)) {
			$scene = trim((string) ($xml->EventKey ?? ''));
			if (str_starts_with($scene, 'qrscene_')) {
				$scene = substr($scene, strlen('qrscene_'));
			}
			if ($scene !== '') {
				$this->mark_scan_by_scene($scene, $from);
			}
			$reply = $event === 'scan'
				? trim((string) ($config['scan_msg'] ?? ''))
				: trim((string) ($config['subscribe_msg'] ?? ''));
			if ($reply !== '') {
				$this->echo_text_reply($from, $to, $reply);
			}
			$this->echo_success();
		}
		$keyword = trim((string) ($config['code_keyword'] ?? '登录'));
		if ($msg_type === 'text' && $keyword !== '' && $content !== '' && mb_strtolower($content) === mb_strtolower($keyword)) {
			$code = $this->issue_code($from);
			$template = trim((string) ($config['code_reply'] ?? ''));
			if ($template === '') {
				$template = __('您的验证码是：%s，有效期 %d 分钟。', 'jio');
			}
			$message = str_replace(['%code%', '%time%', '%s', '%d'], [$code, '5', $code, '5'], $template);
			$this->echo_text_reply($from, $to, $message);
		}
		$this->echo_success();
	}

	private function claim_webhook_event(\SimpleXMLElement $xml) {
		$msg_id = trim((string) ($xml->MsgId ?? ''));
		if ($msg_id !== '') {
			$material = 'msg:' . $msg_id;
		} else {
			$material = wp_json_encode([
				'from' => (string) ($xml->FromUserName ?? ''),
				'to' => (string) ($xml->ToUserName ?? ''),
				'time' => (string) ($xml->CreateTime ?? ''),
				'type' => (string) ($xml->MsgType ?? ''),
				'event' => (string) ($xml->Event ?? ''),
				'key' => (string) ($xml->EventKey ?? ''),
				'content' => (string) ($xml->Content ?? ''),
			]);
		}
		$key = self::DEDUPE_OPTION_PREFIX . hash('sha256', (string) $material);
		$value = ['expires_at' => time() + 10 * MINUTE_IN_SECONDS];
		if (add_option($key, $value, '', false)) {
			return $key;
		}
		$current = get_option($key, null);
		if (is_array($current) && (int) ($current['expires_at'] ?? 0) >= time()) {
			return false;
		}
		$this->compare_delete_option($key, $current);
		return add_option($key, $value, '', false) ? $key : false;
	}

	private function mark_scan_by_scene(string $scene, string $openid): void {
		if (preg_match('/^[A-Za-z0-9_-]{8,64}$/', $scene) !== 1 || $openid === '') {
			return;
		}
		$scope = 'weixingzh-scene:' . $scene;
		$lock = OAuthTransactionStore::acquire_lock($scope, 10);
		if ($lock === false) {
			return;
		}
		try {
			$key = $this->scene_option_key($scene);
			$mapping = get_option($key, null);
			if (!is_array($mapping) || (int) ($mapping['expires_at'] ?? 0) < time()) {
				delete_option($key);
				return;
			}
			$token = (string) ($mapping['token'] ?? '');
			$profile = $this->fetch_profile($openid);
			$updated = false;
			for ($attempt = 0; $attempt < 3 && !$updated; $attempt++) {
				$updated = OAuthTransactionStore::update($token, self::SCAN_KIND, static function (array $row) use ($scene, $openid, $profile) {
					$payload = is_array($row['payload'] ?? null) ? $row['payload'] : [];
					if (!hash_equals((string) ($payload['scene'] ?? ''), $scene)) {
						return false;
					}
					$payload['status'] = 'ok';
					$payload['openid'] = $openid;
					$payload['profile'] = $profile;
					$row['payload'] = $payload;
					return $row;
				}, false);
			}
			if ($updated) {
				delete_option($key);
			}
		} finally {
			OAuthTransactionStore::release_lock($scope, (string) $lock);
		}
	}

	private function store_scene_mapping(string $scene, string $token): bool {
		$scope = 'weixingzh-scene:' . $scene;
		$lock = OAuthTransactionStore::acquire_lock($scope, 10);
		if ($lock === false) {
			return false;
		}
		try {
			$key = $this->scene_option_key($scene);
			$current = get_option($key, null);
			if (is_array($current) && (int) ($current['expires_at'] ?? 0) >= time()) {
				return false;
			}
			if ($current !== null) {
				$this->compare_delete_option($key, $current);
			}
			return add_option($key, ['token' => $token, 'expires_at' => time() + self::SCAN_TTL], '', false);
		} finally {
			OAuthTransactionStore::release_lock($scope, (string) $lock);
		}
	}

	private function delete_scene_mapping(string $scene, string $token): void {
		$scope = 'weixingzh-scene:' . $scene;
		$lock = OAuthTransactionStore::acquire_lock($scope, 10);
		if ($lock === false) {
			return;
		}
		try {
			$key = $this->scene_option_key($scene);
			$current = get_option($key, null);
			if (is_array($current) && hash_equals((string) ($current['token'] ?? ''), $token)) {
				$this->compare_delete_option($key, $current);
			}
		} finally {
			OAuthTransactionStore::release_lock($scope, (string) $lock);
		}
	}

	private function scene_option_key(string $scene): string {
		return self::SCENE_OPTION_PREFIX . hash_hmac('sha256', $scene, wp_salt('auth'));
	}

	private function issue_code(string $openid): string {
		$charset = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
		for ($tries = 0; $tries < 10; $tries++) {
			$code = '';
			for ($index = 0; $index < self::CODE_LENGTH; $index++) {
				$code .= $charset[random_int(0, strlen($charset) - 1)];
			}
			$scope = 'weixingzh-code:' . $code;
			$lock = OAuthTransactionStore::acquire_lock($scope, 10);
			if ($lock === false) {
				continue;
			}
			try {
				$key = $this->code_option_key($code);
				$current = get_option($key, null);
				if (is_array($current) && (int) ($current['expires_at'] ?? 0) >= time()) {
					continue;
				}
				if ($current !== null) {
					$this->compare_delete_option($key, $current);
				}
				$transaction = OAuthTransactionStore::issue(self::CODE_KIND, [
					'status' => 'ok',
					'scene' => '',
					'openid' => $openid,
					'profile' => $this->fetch_profile($openid),
					'redirect_to' => '',
					'action' => 'login',
					'user_id' => 0,
				], self::CODE_TTL, false);
				$stored = add_option($key, [
					'token' => $transaction,
					'expires_at' => time() + self::CODE_TTL,
					'attempts' => 0,
				], '', false);
				if ($stored) {
					return $code;
				}
				OAuthTransactionStore::delete($transaction);
			} finally {
				OAuthTransactionStore::release_lock($scope, (string) $lock);
			}
		}
		throw new \RuntimeException('weixingzh_code_issue_failed');
	}

	/**
	 * @param array{action:string,user_id:int,redirect_to:string} $context
	 * @return array<string,mixed>|null
	 */
	private function claim_code_transaction(string $code, array $context): ?array {
		$scope = 'weixingzh-code:' . $code;
		$lock = OAuthTransactionStore::acquire_lock($scope, 10);
		if ($lock === false) {
			return null;
		}
		try {
			$key = $this->code_option_key($code);
			$mapping = get_option($key, null);
			if (!is_array($mapping) || (int) ($mapping['expires_at'] ?? 0) < time()) {
				delete_option($key);
				return null;
			}
			$attempts = (int) ($mapping['attempts'] ?? 0) + 1;
			if ($attempts > self::CODE_MAX_ATTEMPTS) {
				$this->compare_delete_option($key, $mapping);
				OAuthTransactionStore::delete((string) ($mapping['token'] ?? ''));
				return null;
			}
			$next = $mapping;
			$next['attempts'] = $attempts;
			if (!$this->compare_update_option($key, $mapping, $next)) {
				return null;
			}
			$token = (string) ($mapping['token'] ?? '');
			$updated = OAuthTransactionStore::update($token, self::CODE_KIND, static function (array $row) use ($context) {
				$payload = is_array($row['payload'] ?? null) ? $row['payload'] : [];
				$payload['action'] = $context['action'];
				$payload['user_id'] = $context['user_id'];
				$payload['redirect_to'] = $context['redirect_to'];
				$row['payload'] = $payload;
				return $row;
			}, false);
			if (!$updated) {
				return null;
			}
			$claimed = OAuthTransactionStore::claim($token, self::CODE_KIND, false);
			if (!$claimed) {
				return null;
			}
			delete_option($key);
			return $claimed;
		} finally {
			OAuthTransactionStore::release_lock($scope, (string) $lock);
		}
	}

	private function code_option_key(string $code): string {
		return self::CODE_OPTION_PREFIX . hash_hmac('sha256', $code, wp_salt('auth'));
	}

	/**
	 * @return array<string,mixed>
	 */
	private function fetch_profile(string $openid): array {
		$config = self::settings();
		$appid = trim((string) ($config['appid'] ?? ''));
		$secret = trim((string) ($config['appsecret'] ?? ''));
		if ($appid === '' || $secret === '') {
			return [];
		}
		try {
			$access_token = $this->get_access_token($appid, $secret);
			$url = add_query_arg([
				'access_token' => $access_token,
				'openid' => $openid,
				'lang' => 'zh_CN',
			], 'https://api.weixin.qq.com/cgi-bin/user/info');
			$response = wp_remote_get($url, ['timeout' => 10]);
			$data = $this->decode_http_json($response);
			if (!empty($data['errcode'])) {
				return [];
			}
			return [
				'nickname' => sanitize_text_field((string) ($data['nickname'] ?? '')),
				'headimgurl' => esc_url_raw((string) ($data['headimgurl'] ?? '')),
			];
		} catch (\Throwable $e) {
			return [];
		}
	}

	private function get_access_token(string $appid, string $secret): string {
		$cached = get_option(self::ACCESS_OPTION, []);
		if ($this->valid_access_cache($cached, $appid)) {
			return (string) $cached['access_token'];
		}
		$scope = 'weixingzh-access:' . $appid;
		$lock = OAuthTransactionStore::acquire_lock($scope, 20);
		if ($lock === false) {
			for ($attempt = 0; $attempt < 4; $attempt++) {
				usleep(250000);
				$cached = get_option(self::ACCESS_OPTION, []);
				if ($this->valid_access_cache($cached, $appid)) {
					return (string) $cached['access_token'];
				}
			}
			throw new \RuntimeException('access_token_busy');
		}
		try {
			$cached = get_option(self::ACCESS_OPTION, []);
			if ($this->valid_access_cache($cached, $appid)) {
				return (string) $cached['access_token'];
			}
			$data = [];
			$stable = wp_remote_post('https://api.weixin.qq.com/cgi-bin/stable_token', [
				'timeout' => 10,
				'headers' => ['Content-Type' => 'application/json'],
				'body' => wp_json_encode([
					'grant_type' => 'client_credential',
					'appid' => $appid,
					'secret' => $secret,
				]),
			]);
			try {
				$data = $this->decode_http_json($stable);
			} catch (\Throwable $e) {
				$data = [];
			}
			if (empty($data['access_token'])) {
				$url = add_query_arg([
					'grant_type' => 'client_credential',
					'appid' => $appid,
					'secret' => $secret,
				], 'https://api.weixin.qq.com/cgi-bin/token');
				$data = $this->decode_http_json(wp_remote_get($url, ['timeout' => 10]));
			}
			if (empty($data['access_token'])) {
				throw new \RuntimeException((string) ($data['errmsg'] ?? 'access_token_failed'));
			}
			$cache = [
				'appid' => $appid,
				'access_token' => (string) $data['access_token'],
				'expiration_time' => time() + max(300, (int) ($data['expires_in'] ?? 7200)),
			];
			update_option(self::ACCESS_OPTION, $cache, false);
			return $cache['access_token'];
		} finally {
			OAuthTransactionStore::release_lock($scope, (string) $lock);
		}
	}

	private function valid_access_cache($cached, string $appid): bool {
		return is_array($cached)
			&& !empty($cached['access_token'])
			&& isset($cached['appid'])
			&& hash_equals($appid, (string) $cached['appid'])
			&& (int) ($cached['expiration_time'] ?? 0) > time() + 60;
	}

	/**
	 * @param array<string,mixed> $body
	 * @return array<string,mixed>
	 */
	private function api_post(string $url, array $body): array {
		$response = wp_remote_post($url, [
			'timeout' => 10,
			'headers' => ['Content-Type' => 'application/json'],
			'body' => wp_json_encode($body, JSON_UNESCAPED_UNICODE),
		]);
		$data = $this->decode_http_json($response);
		if (!empty($data['errcode'])) {
			throw new \RuntimeException((string) ($data['errmsg'] ?? 'weixin_api_failed'));
		}
		return $data;
	}

	/**
	 * @return array<string,mixed>
	 */
	private function decode_http_json($response): array {
		if (is_wp_error($response)) {
			throw new \RuntimeException($response->get_error_message());
		}
		$status = (int) wp_remote_retrieve_response_code($response);
		if ($status < 200 || $status >= 300) {
			throw new \RuntimeException('weixin_http_' . $status);
		}
		$data = json_decode((string) wp_remote_retrieve_body($response), true);
		if (!is_array($data)) {
			throw new \RuntimeException('weixin_invalid_json');
		}
		return $data;
	}

	private function rate_limit(string $scope, int $max, int $window, int $minimum_interval): ?\WP_REST_Response {
		$ip = function_exists('jio_get_client_ip')
			? trim((string) jio_get_client_ip())
			: trim((string) ($_SERVER['REMOTE_ADDR'] ?? 'unknown'));
		$key = 'jio_weixingzh_rate_' . hash('sha256', $scope . '|' . $ip);
		$lock_scope = 'weixingzh-rate:' . $key;
		$lock = OAuthTransactionStore::acquire_lock($lock_scope, 5);
		if ($lock === false) {
			return $this->error_response(__('请求过于频繁，请稍后重试', 'jio'), 429);
		}
		try {
			$now = time();
			$row = get_transient($key);
			if (!is_array($row) || (int) ($row['reset_at'] ?? 0) <= $now) {
				$row = ['count' => 0, 'last_at' => 0, 'reset_at' => $now + $window];
			}
			$last_at = (float) ($row['last_at'] ?? 0);
			if ((int) ($row['count'] ?? 0) >= $max || microtime(true) - $last_at < $minimum_interval) {
				return $this->error_response(__('请求过于频繁，请稍后重试', 'jio'), 429);
			}
			$row['count'] = (int) $row['count'] + 1;
			$row['last_at'] = microtime(true);
			set_transient($key, $row, max(1, (int) $row['reset_at'] - $now));
			return null;
		} finally {
			OAuthTransactionStore::release_lock($lock_scope, (string) $lock);
		}
	}

	public function maybe_cleanup_options(): void {
		if (wp_rand(1, 100) !== 1) {
			return;
		}
		global $wpdb;
		$patterns = [self::SCENE_OPTION_PREFIX, self::CODE_OPTION_PREFIX, self::DEDUPE_OPTION_PREFIX];
		foreach ($patterns as $prefix) {
			$rows = $wpdb->get_results($wpdb->prepare(
				"SELECT option_name, option_value FROM {$wpdb->options} WHERE option_name LIKE %s LIMIT 100",
				$wpdb->esc_like($prefix) . '%'
			), ARRAY_A);
			foreach (is_array($rows) ? $rows : [] as $row) {
				$value = maybe_unserialize($row['option_value'] ?? '');
				if (is_array($value) && (int) ($value['expires_at'] ?? 0) < time()) {
					delete_option((string) $row['option_name']);
				}
			}
		}
	}

	private function compare_update_option(string $key, $current, $next): bool {
		global $wpdb;
		$updated = $wpdb->query($wpdb->prepare(
			"UPDATE {$wpdb->options} SET option_value = %s WHERE option_name = %s AND option_value = %s",
			maybe_serialize($next),
			$key,
			maybe_serialize($current)
		));
		if ($updated === 1) {
			wp_cache_delete($key, 'options');
			return true;
		}
		return false;
	}

	private function compare_delete_option(string $key, $current): bool {
		global $wpdb;
		$deleted = $wpdb->query($wpdb->prepare(
			"DELETE FROM {$wpdb->options} WHERE option_name = %s AND option_value = %s",
			$key,
			maybe_serialize($current)
		));
		if ($deleted === 1) {
			wp_cache_delete($key, 'options');
			return true;
		}
		return false;
	}

	private function error_response(string $message, int $status): \WP_REST_Response {
		return new \WP_REST_Response(['success' => false, 'message' => $message], $status);
	}

	private function echo_text_reply(string $to_user, string $from_user, string $content): void {
		$to_user = htmlspecialchars($to_user, ENT_XML1 | ENT_QUOTES, 'UTF-8');
		$from_user = htmlspecialchars($from_user, ENT_XML1 | ENT_QUOTES, 'UTF-8');
		$content = str_replace(']]>', ']]]]><![CDATA[>', $content);
		header('Content-Type: application/xml; charset=utf-8');
		echo '<xml><ToUserName><![CDATA[' . $to_user . ']]></ToUserName><FromUserName><![CDATA[' . $from_user . ']]></FromUserName><CreateTime>' . time() . '</CreateTime><MsgType><![CDATA[text]]></MsgType><Content><![CDATA[' . $content . ']]></Content></xml>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- WeChat XML protocol response.
		exit;
	}

	private function echo_success(): void {
		header('Content-Type: text/plain; charset=utf-8');
		echo 'success';
		exit;
	}
}