<?php
/**
 * Settings Class
 *
 * Centralized settings management with default values
 *
 * @package Vigilante
 */

// Prevent direct access
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

/**
 * Class Vigilante_Settings
 *
 * Handles all plugin settings with defaults, getters and setters
 */
class Vigilante_Settings {

    /**
     * Option name in database
     */
    const OPTION_NAME = 'vigilante_options';

    /**
     * Cached options
     *
     * @var array|null
     */
    private $options = null;

    /**
     * Default options structure
     *
     * @var array
     */
    private $defaults;

    /**
     * Constructor
     */
    public function __construct() {
        $this->defaults = $this->get_default_options();
    }

    /**
     * Get all default options
     *
     * @return array Complete default options array
     */
    public function get_default_options() {
        return array(
            // Module toggles - 8 modules that match tabs
            'modules' => array(
                'firewall'         => true,
                'security_headers' => true,
                'login_security'   => true,
                'rest_api_security'=> true,
                'user_security'    => true,
                'wp_hardening'     => true,
                'file_integrity'   => true,
                'activity_log'     => true,
            ),

            // Firewall settings (includes htaccess, rate limiting, file protection)
            'firewall' => array(
                // Request filtering (PHP-based)
                'block_bad_query_strings'   => true,
                'block_sql_injection'       => true,
                'block_xss_attacks'         => true,
                'block_file_inclusion'      => true,
                'block_directory_traversal' => true,
                
                // Bot protection
                'block_bad_bots'            => true,
                'block_empty_user_agent'    => false,

                // Rate limiting
                'rate_limiting'             => array(
                    'enabled'             => true,
                    'requests_per_minute' => 120,
                    'block_duration'      => 300,
                    'progressive'         => false,
                    'max_block_duration'  => 86400,
                ),
                
                // IP management
                'ip_whitelist'              => array(),
                'ip_blacklist'              => array(),

                // Proxy / CDN: forwarded header to trust for the visitor IP.
                // Empty = trust only REMOTE_ADDR (the real connection, unspoofable).
                'trusted_proxy_header'      => '',

                // User-Agent management
                'ua_whitelist'              => array(),
                'ua_blacklist'              => array(),
                'country_blocking'          => array(
                    'enabled'   => false,
                    'mode'      => 'blacklist',
                    'countries' => array(),
                ),
                
                // File protection (htaccess-based)
                'disable_directory_browsing' => true,
                'protect_wp_config'          => true,
                'protect_wp_includes'        => true,
                'protect_uploads_php'        => true,
                'protect_sensitive_files'    => true,
                // Off by default — only safe when host has a real server-side cron job
                // calling wp-cron.php; otherwise scheduled tasks stop running silently.
                'protect_wp_cron'            => false,
                'block_php_in_plugins'       => false,
                'block_php_in_themes'        => false,
                'limit_http_methods'         => true,
                // All methods needed for WordPress core, Gutenberg, REST API, and page builders
                'allowed_http_methods'       => array( 'GET', 'POST', 'HEAD', 'OPTIONS', 'PUT', 'PATCH', 'DELETE' ),
                'protected_file_extensions'  => array(
                    'htaccess', 'htpasswd', 'ini', 'log', 'sql', 
                    'bak', 'old', 'tmp', 'swp', 'save', 'backup'
                ),
            ),

            // Security Headers settings (includes HTTPS enforcer)
            'security_headers' => array(
                'enabled'                 => true,
                
                // Basic headers
                'x_frame_options'         => 'SAMEORIGIN',
                'x_content_type_options'  => true,
                'referrer_policy'         => 'strict-origin-when-cross-origin',
                
                // HSTS
                'hsts'                    => array(
                    'enabled'            => false,
                    'max_age'            => 31536000,
                    'include_subdomains' => false,
                    'preload'            => false,
                ),
                
                // Permissions Policy
                'permissions_policy'      => array(
                    'enabled'      => true,
                    'geolocation'  => '()',
                    'microphone'   => '()',
                    'camera'       => '()',
                    'payment'      => '(self)',
                    'usb'          => '()',
                ),
                
                // CSP - WordPress/Gutenberg compatible defaults
                // Note: blob: is required in frame-src and worker-src for the block editor,
                // and in connect-src for the client-side media processing WordPress 7.1
                // introduced: @wordpress/vips puts its WebAssembly binary in a blob: URL and
                // fetches it, and fetch() is governed by connect-src, where 'self' does not
                // cover blob:. Without it the editor cannot process images before upload.
                'csp'                     => array(
                    'enabled'     => true,
                    'report_only' => false,
                    'report_uri'  => '',
                    'directives'  => array(
                        'default-src'              => "'self'",
                        'script-src'               => "'self' 'unsafe-inline' 'unsafe-eval' https:",
                        'style-src'                => "'self' 'unsafe-inline' https:",
                        'img-src'                  => "'self' data: https: blob:",
                        'font-src'                 => "'self' data: https:",
                        'connect-src'              => "'self' https: wss: blob:",
                        'media-src'                => "'self' https: blob:",
                        'frame-src'                => "'self' https: blob:",
                        'frame-ancestors'          => "'self'",
                        'base-uri'                 => "'self'",
                        'form-action'              => "'self' https:",
                        'object-src'               => "'none'",
                        'worker-src'               => "'self' blob:",
                        'upgrade-insecure-requests'=> true,
                    ),
                ),
                
                // Cross-origin policies
                'cross_origin_policies'   => array(
                    'embedder_policy'  => 'unsafe-none',
                    'opener_policy'    => 'same-origin-allow-popups',
                    'resource_policy'  => 'cross-origin',
                ),
                
                // HTTPS Enforcer (moved from separate module)
                //
                // force_https rewrites siteurl/home to https on activation, so it
                // ships off: a site without working HTTPS would end up pointing at
                // an address that does not answer. It is an opt-in decision per
                // site, made from the Security Headers tab. Sites whose URLs a
                // previous version already rewrote keep them; nothing reverts them.
                'force_https'               => false,
                // Off by default for the same reason as force_https above: the
                // plugin does not decide that a site is on HTTPS. It only
                // redirects when the site's own home URL already says https, so
                // shipping it on was harmless in practice, but it is still a
                // decision that belongs to the site owner, not to us. Sites that
                // already have it on keep it.
                'redirect_http_to_https'    => false,
                // Rewrites http:// URLs of this same site to https://, and only
                // on a site already served over HTTPS, so it cannot reach a third
                // party and cannot make a resource fail. It still ships off: a
                // setting whose own description says it rewrites http to https
                // does not belong in the factory configuration of a plugin that
                // deliberately does not decide whether a site is on HTTPS. Every
                // https-related setting here is the owner's call, and this one is
                // one click away for anyone who has just migrated and wants their
                // old content rewritten.
                'fix_mixed_content'         => false,
                // The Content-Security-Policy directive that tells the browser to
                // upgrade every http:// request, including the ones pointing at
                // other people's servers. If any of those has no HTTPS the
                // resource simply stops loading, so this is the one piece of
                // mixed content handling that can break a page, and it is off by
                // default like everything else here that forces HTTPS. It used to
                // ride along with fix_mixed_content with no way to separate them.
                'upgrade_insecure_requests' => false,

                // Server Protection (moved from firewall in v2.0.0)
                'hide_server_signature'         => true,
                'remove_fingerprinting_headers' => true,
            ),

            // Login Security settings
            'login_security' => array(
                'enabled'                     => true,
                'max_attempts'                => 5,
                'lockout_duration'            => 1800,
                'lockout_increment'           => true,
                'max_lockout_duration'        => 86400,
                'hide_login_errors'           => true,
                // XML-RPC se movio a wp_hardening en la 2.9.7; lo resuelve
                // Vigilante_Comment_Security::resolve_xmlrpc_mode(), que
                // sustituye a las dos casillas anteriores (disable_xmlrpc y
                // disable_xmlrpc_pingback), que podian estar activas a la vez y
                // contradecirse. A proposito NO se declara aqui ningun default: si se
                // declarara, el merge con los defaults lo rellenaria siempre y taparia el
                // respaldo que lee el ajuste antiguo de los sitios que aun no han vuelto a
                // guardar la pestana. Sin nada guardado, el resolutor devuelve 'full', que
                // es lo que hacia el default anterior.
                'disable_application_passwords' => false,
                'notify_on_lockout'           => false,
                'notify_on_admin_login'       => false,
                'ip_whitelist'                => array(),
                'custom_login_url'            => '',
                'notify_on_login_url_change'  => true,
                // Two-Factor Authentication
                'two_factor'                  => array(
                    'enabled'              => false,
                    'method'               => 'email',
                    'enforced_roles'       => array( 'administrator', 'editor' ),
                    'excluded_users'       => array(),
                    'remember_device_days' => 30,
                    'allow_remember_device' => false,
                    'code_expiry_minutes'  => 10,
                    'max_attempts'         => 3,
                    'email_from_name'      => '',
                    'notify_on_enable'     => true,
                    'grace_period_days'    => 3,
                ),
            ),

            // REST API Security settings
            'rest_api_security' => array(
                'enabled'                => true,
                'mode'                   => 'selective',
                'block_user_enumeration' => true,
                'disable_jsonp'          => true,
                // Empty by default: /wp/v2/users used to live here, but that
                // duplicated the dedicated "Block user enumeration" toggle.
                // Now there is one knob = one behaviour. If you want to
                // protect additional endpoints in selective mode, add them
                // explicitly via this setting (or via a filter).
                'protected_endpoints'    => array(),
                'allowed_public_endpoints' => array(
                    '/wp/v2/posts',
                    '/wp/v2/pages',
                    '/wp/v2/categories',
                    '/wp/v2/tags',
                    '/oembed/',
                ),
                'plugin_compatibility'   => array(
                    'woocommerce'         => true,
                    'contact_form_7'      => true,
                    'elementor'           => true,
                ),
            ),

            // User Security settings
            'user_security' => array(
                'enabled'                 => true,
                'block_insecure_usernames'=> true,
                'insecure_usernames'      => array(
                    'admin', 'administrator', 'user', 'test', 'guest',
                    'info', 'root', 'adm', 'sysadmin', 'support',
                    'webmaster', 'master', 'owner', 'manager', 'demo',
                ),
                'block_author_scanning'   => true,
                'force_strong_passwords'  => true,
                'min_password_length'     => 12,

                // Granular password policy. Applies only while
                // force_strong_passwords is on. The defaults follow current
                // guidance (NIST SP 800-63B): what makes a password weak is being
                // guessable, not lacking a symbol, and composition rules push
                // people towards predictable substitutions and towards writing
                // the password down. So out of the box only the two rules that
                // block genuinely guessable passwords are on, and the four
                // character-class requirements ship off for anyone to turn on.
                // Existing sites keep whatever they have stored.
                // affected_roles empty = all roles.
                'password_policy'         => array(
                    'require_uppercase' => false,
                    'require_lowercase' => false,
                    'require_number'    => false,
                    'require_special'   => false,
                    'block_common'      => true,
                    'block_username'    => true,
                    'affected_roles'    => array(),
                ),

                'prevent_display_name_login_match' => true,
                
                // Admin monitoring
                // The two alerts that report someone gaining power ship on: a
                // new administrator and a role being raised are the signature of
                // an account takeover, and they are rare enough not to be noise.
                // The other two are ordinary admin housekeeping and stay opt-in.
                'admin_monitoring'        => array(
                    'alert_new_admin'              => true,
                    'alert_admin_email_change'     => false,
                    'alert_permission_elevation'   => true,
                    'alert_admin_password_change'  => false,
                ),
                
                // Force password reset (no options, uses native WordPress flow)

                // Registration approval
                'registration_approval'   => array(
                    'enabled'           => false,
                    'notify_admin'      => false,
                    'auto_reject_days'  => 0,
                    'affected_roles'    => array( 'subscriber' ),
                ),

                // Session management
                'session_management'      => array(
                    'enabled'           => true,
                    'show_in_profile'   => true,
                ),

                // Session limits
                'session_limits'          => array(
                    'enabled'           => true,
                    'max_sessions'      => 3,
                    'behavior'          => 'close_oldest',
                    'exclude_admins'    => false,
                ),

                // Password expiration ships OFF. Forced rotation is no longer
                // recommended (NIST SP 800-63B advises against it) and it is by
                // far the biggest source of support here: people locked out mid
                // task, cron reminders that never arrive, roles nobody meant to
                // include. The feature stays for anyone who has to comply with a
                // policy that still demands it, and the Configuration Score keeps
                // pointing at it, which is what that score is for.
                'password_expiration'     => array(
                    'enabled'           => false,
                    'expire_days'       => 90,
                    'warning_days'      => 14,
                    'affected_roles'    => array( 'administrator', 'editor' ),
                    'excluded_users'    => array(),
                    'password_history'  => 3,
                    'send_reminder'     => false,
                ),

                // Email verification
                'email_verification'      => array(
                    'enabled'               => false,
                    'token_expiry_hours'    => 24,
                    'allow_resend'          => true,
                    'auto_delete_days'      => 7,
                ),
            ),

            // WordPress Hardening (combines wp-config, comments, feeds, head cleaner)
            'wp_hardening' => array(
                'enabled'               => true,
                
                // wp-config security
                'disallow_file_edit'    => true,
                'disallow_file_mods'    => false,
                // Off by default. This one writes FORCE_SSL_ADMIN into
                // wp-config.php, and it used to do so on activation with no
                // check that the site answers over HTTPS at all, which locks the
                // owner out of their own admin. Forcing HTTPS is an opt-in
                // decision per site, consistent with force_https and with HSTS,
                // both of which already ship off.
                'force_ssl_admin'       => false,
                'wp_debug'              => true,
                // Off by default — only safe when host has a real server-side cron job;
                // pairs with firewall.protect_wp_cron to block both internal triggering
                // (this constant) and external HTTP abuse (the .htaccess rule).
                'disable_wp_cron'       => false,
                
                // Comment security
                'disable_pingbacks'       => true,
                'disable_trackbacks'      => true,
                'require_comment_moderation' => true,
                'close_old_comments'      => false,
                'close_comments_after_days' => 30,
                'honeypot_comments'       => true,
                
                // Head cleaner
                'remove_wp_generator'      => true,
                'remove_wp_version_assets' => false,
                'remove_rsd_link'          => true,
                'remove_wlw_manifest'      => true,
                'remove_shortlink'         => true,
                'remove_rest_api_link'     => false,
                
                // Feed manager
                'disable_feeds'          => false,
                'disable_if_no_content'  => true,
                'remove_feed_version'    => true,
            ),

            // File Integrity settings
            'file_integrity' => array(
                'enabled'                 => true,
                'scan_core'               => true,
                'scan_plugins'            => true,
                'scan_themes'             => true,
                'scan_uploads'            => true,
                'scan_critical_config'    => true,
                'check_closed_plugins'    => true,
                'auto_scan'               => true,
                'scan_frequency'          => 'daily',
                'notify_level'            => 'suspicious_only',
                'instant_alert'           => false,
                'excluded_paths'          => array(
                    'wp-content/cache',
                ),
                'excluded_extensions'     => array(
                    // Translations (regenerated per-locale, never in checksums).
                    '.po', '.mo', '.pot',
                    // Binary images (cosmetic, not executable; often rewritten by image-optimizer plugins).
                    '.jpg', '.jpeg', '.png', '.gif', '.ico', '.webp', '.avif',
                    // Stylesheets: frequently rewritten by themes and optimizer
                    // plugins, a common source of post-update false positives.
                    // Strict-mode users can remove it (CSS injection is still a
                    // vector, defended primarily by CSP in the headers module).
                    '.css',
                ),
                'suspicious_patterns'     => array(
                    'eval(',
                    'base64_decode(',
                    'gzinflate(',
                    'str_rot13(',
                    'exec(',
                    'shell_exec(',
                    'system(',
                    'passthru(',
                    'assert(',
                ),
            ),

            // Activity Log settings
            'activity_log' => array(
                'retention_days'       => 30,
                'max_entries'          => 10000,
                'log_logins'           => true,
                'log_failed_logins'    => true,
                'log_user_changes'     => true,
                'log_post_changes'     => true,
                'log_plugin_changes'   => true,
                'log_theme_changes'    => true,
                'log_option_changes'   => false,
                'log_file_changes'     => true,
                'log_comments'         => true,
                'log_media'            => true,
                'excluded_users'       => array(),
                'excluded_ips'         => array(),
                'tracked_options'      => array(),
            ),

            // Backup settings
            'backup' => array(
                'auto_backup'            => true,
                'backup_before_update'   => true,
                'keep_backups'           => 5,
            ),

            // Notification settings (centralized recipients for all admin emails)
            'email' => array(
                'send_to_admin_email'      => true,
                'additional_recipients'    => array(),
                'send_deactivation_email'  => true,
            ),

            // Advanced settings
            'advanced' => array(
                'remove_readme'          => true,
                'remove_license'         => true,
                'block_author_archives'  => false,
                'disable_embeds'         => false,
                'uninstall_cleanup'      => true,
                'debug_mode'             => false,
            ),

            // Security Analyzer (v2.1.0) — on-demand + weekly Security Check
            'security_analyzer' => array(
                'weekly_scan_enabled' => true,
                'email_on_regression' => false,
            ),

            // Audit Alerts (v2.8.0) — alerting layer on top of Security Audit.
            // The engine subscribes to logged events and only runs when the
            // Security Audit (activity_log) module is enabled. Opt-in: both
            // legs start OFF so it never duplicates the per-module emails that
            // already exist (User Security admin monitoring, Plugin Status...).
            'audit_alerts' => array(
                // Shared anti-repeat cooldown (minutes). After an alert, do not
                // send another about the same thing (same event type for
                // immediate, same category for threshold) until this passes.
                // Prevents a flood during a sustained attack.
                'cooldown_minutes' => 60,
                // #38 Immediate alerts: selected event types email right away.
                'immediate' => array(
                    'enabled'      => false,
                    // Alert on any logged event at or above this severity. A new
                    // admin, a closed plugin or a privilege escalation are all
                    // logged as "critical", so "critical" already covers them.
                    'min_severity' => 'critical', // 'critical' | 'warning'
                ),
                // #10 Threshold alerts: N events of a category within a window.
                'threshold' => array(
                    'enabled'    => false,
                    'window'     => '1h', // 30m | 1h | 6h | 24h
                    // Per-category trigger counts (warning/critical events only);
                    // 0 disables that category. Covers every event type that can
                    // log a warning or critical. Keep in sync with
                    // Vigilante_Audit_Alerts::category_labels().
                    'categories' => array(
                        'firewall' => 50,
                        'login'    => 20,
                        'user'     => 5,
                        'plugin'   => 0,
                        'file'     => 0,
                        'security' => 0,
                        'system'   => 0,
                        'settings' => 0,
                        'theme'    => 0,
                        'content'  => 0,
                        'comment'  => 0,
                        'media'    => 0,
                    ),
                ),
            ),
        );
    }

    /**
     * Get all options (merged with defaults)
     *
     * @return array All options
     */
    public function get_all_options() {
        if ( null === $this->options ) {
            $saved = get_option( self::OPTION_NAME, array() );
            $this->options = $this->array_merge_deep( $this->get_default_options(), $saved );
        }
        return $this->options;
    }

    /**
     * Deep merge arrays
     *
     * @param array $defaults Default values.
     * @param array $saved    Saved values.
     * @return array Merged array.
     */
    private function array_merge_deep( $defaults, $saved ) {
        $result = $defaults;
        
        foreach ( $saved as $key => $value ) {
            if ( is_array( $value ) && isset( $result[ $key ] ) && is_array( $result[ $key ] ) ) {
                $result[ $key ] = $this->array_merge_deep( $result[ $key ], $value );
            } else {
                $result[ $key ] = $value;
            }
        }
        
        return $result;
    }

    /**
     * Get a specific section
     *
     * @param string $section Section name.
     * @return array Section options.
     */
    public function get_section( $section ) {
        $options = $this->get_all_options();
        return isset( $options[ $section ] ) ? $options[ $section ] : array();
    }

    /**
     * Get a specific option
     *
     * @param string $section Section name.
     * @param string $key     Option key.
     * @param mixed  $default Default value.
     * @return mixed Option value.
     */
    public function get_option( $section, $key, $default = null ) {
        $options = $this->get_all_options();
        
        if ( isset( $options[ $section ][ $key ] ) ) {
            return $options[ $section ][ $key ];
        }
        
        return $default;
    }

    /**
     * Check if a module is enabled
     *
     * @param string $module Module name.
     * @return bool Whether module is enabled.
     */
    public function is_module_enabled( $module ) {
        $options = $this->get_all_options();
        return ! empty( $options['modules'][ $module ] );
    }

    /**
     * Save options
     *
     * @param array $options Options to save.
     * @return bool Success status.
     */
    public function save_options( $options ) {
        $this->options = null;
        return update_option( self::OPTION_NAME, $options );
    }

    /**
     * Update a section
     *
     * @param string $section Section name.
     * @param array  $data    Section data.
     * @return bool Success status.
     */
    public function update_section( $section, $data ) {
        $options = get_option( self::OPTION_NAME, array() );
        $options[ $section ] = $data;
        $this->options = null;
        return update_option( self::OPTION_NAME, $options );
    }

    /**
     * Update multiple sections at once
     *
     * @param array $sections Associative array of section => data.
     * @return bool Success status.
     */
    public function update_options( $sections ) {
        $options = get_option( self::OPTION_NAME, array() );
        
        foreach ( $sections as $section => $data ) {
            $options[ $section ] = $data;
        }
        
        $this->options = null;
        return update_option( self::OPTION_NAME, $options );
    }

    /**
     * Clear the options cache
     */
    public function clear_cache() {
        $this->options = null;
        wp_cache_delete( self::OPTION_NAME, 'options' );
    }

    /**
     * Whether this context is allowed to write the files a network shares
     *
     * wp-config.php and the root .htaccess are single files for the whole
     * network, while Vigilant's settings are per site. Without a gate, every
     * save, activation and deactivation from any site rewrites those files from
     * that site's own options, so the last one to save wins and silently undoes
     * the rest. Measured on a real network: the main site enables "disable file
     * editing", a subsite admin presses Save on their own screen without
     * touching it, and the constant disappears from wp-config.php while the main
     * site's screen keeps showing the box ticked.
     *
     * So on a network only the main site decides, and only a network
     * administrator. WP-CLI on the main site counts too: there is no user to ask
     * there, but the site is the right one, and a network admin running
     * `wp plugin activate --network` expects the files to be written.
     *
     * On a single site this is always true and nothing changes.
     *
     * @since 2.9.8
     *
     * @return bool
     */
    public static function can_write_shared_files() {
        if ( ! is_multisite() ) {
            return true;
        }

        if ( ! is_main_site() ) {
            return false;
        }

        // WP-CLI with nobody logged in: there is no user to ask, and the site is
        // the right one, so a network admin running `wp plugin activate --network`
        // gets the files written. With a user set (wp --user=...) the capability
        // is checked like anywhere else, so the gate cannot be side-stepped by
        // running as a subsite administrator.
        if ( defined( 'WP_CLI' ) && WP_CLI && ! get_current_user_id() ) {
            return true;
        }

        return current_user_can( 'manage_network_options' );
    }

    /**
     * The one message shown wherever a shared-file setting is out of reach
     *
     * Deliberately a single string reused by every section, instead of one per
     * section: it says the same thing everywhere and there is no reason to make
     * translators write it four times.
     *
     * @since 2.9.8
     *
     * @return string
     */
    public static function get_shared_files_notice() {
        return __( 'These settings are written to wp-config.php and .htaccess, files the whole network shares. So that one site cannot overwrite another, they are managed from the main site of the network by a network administrator.', 'vigilante' );
    }

    /**
     * Apply the tweaks a brand new installation gets on top of the raw defaults
     *
     * A few keys are deliberately missing from get_default_options() because
     * declaring them would break something else. XML-RPC is the one case today:
     * declaring wp_hardening.xmlrpc_mode would make the defaults merge fill it in
     * always and hide the fallback that reads the old pair of settings on sites
     * that have not re-saved the tab. With nothing stored the resolver answers
     * 'full', which blocks XML-RPC completely, and that is not what we want a new
     * site to get.
     *
     * Everything that seeds a clean configuration has to run this: the activation
     * hook, the per-section reset and the global reset to defaults. Otherwise the
     * defaults you get by pressing a button are not the defaults you get by
     * installing the plugin, which is exactly what happened until 2.9.8.
     *
     * @since 2.9.8
     *
     * @param array $options Options array to adjust.
     * @return array
     */
    public static function apply_install_tweaks( $options ) {
        if ( ! isset( $options['wp_hardening'] ) || ! is_array( $options['wp_hardening'] ) ) {
            $options['wp_hardening'] = array();
        }

        $options['wp_hardening']['xmlrpc_mode'] = 'pingback';

        return $options;
    }

    /**
     * Keys that hold what the site owner typed in, never wiped by a restore
     *
     * Putting the security posture back to its defaults is one thing; deleting
     * an IP whitelist, the secret login address, the two factor setup or the
     * addresses that receive the alerts is another, and nobody presses a button
     * called "restore defaults" expecting that. Both the Standard preset and the
     * two reset buttons leave these alone.
     *
     * @since 2.9.8
     *
     * @return array<string,string[]>
     */
    public static function get_user_data_keys() {
        return array(
            'firewall'       => array( 'ip_whitelist', 'ip_blacklist', 'ua_whitelist', 'ua_blacklist', 'trusted_proxy_header', 'country_blocking' ),
            'login_security' => array( 'ip_whitelist', 'custom_login_url', 'two_factor' ),
            'user_security'  => array( 'insecure_usernames' ),
            'file_integrity' => array( 'excluded_paths', 'excluded_extensions', 'suspicious_patterns' ),
            'email'          => array( 'additional_recipients' ),
        );
    }

    /**
     * Settings whose only effect is written to a file the network shares
     *
     * true for a whole section, or the list of keys inside it. Used to keep a
     * subsite from resetting settings it does not control: the file is written
     * from the main site, so resetting the local copy would only make the two
     * disagree.
     *
     * Note this is not every setting that reaches .htaccess. Blocking bad bots
     * or empty user agents also runs in PHP, per site, so those stay editable on
     * a subsite: the PHP half protects that site and the .htaccess half is
     * refused, leaving the main site's rules standing.
     *
     * @since 2.9.8
     *
     * @return array<string,true|string[]>
     */
    public static function get_shared_file_settings() {
        return array(
            'security_headers' => true,
            'wp_hardening'     => array( 'disallow_file_edit', 'disallow_file_mods', 'force_ssl_admin', 'force_ssl_login', 'wp_debug', 'disable_wp_cron' ),
            'firewall'         => array( 'disable_directory_browsing', 'protect_wp_config', 'protect_wp_includes', 'protect_uploads_php', 'protect_sensitive_files', 'protect_wp_cron', 'limit_http_methods' ),
        );
    }

    /**
     * Put a configuration back to the defaults without deleting what the owner typed
     *
     * @since 2.9.8
     *
     * @param array $current Configuration being replaced.
     * @return array
     */
    public static function get_defaults_preserving_user_data( $current ) {
        $instance = new self();
        $defaults = self::apply_install_tweaks( $instance->get_default_options() );

        foreach ( self::get_user_data_keys() as $section => $keys ) {
            foreach ( $keys as $key ) {
                if ( isset( $current[ $section ] ) && array_key_exists( $key, (array) $current[ $section ] ) ) {
                    $defaults[ $section ][ $key ] = $current[ $section ][ $key ];
                }
            }
        }

        return $defaults;
    }

    /**
     * The values the Standard preset applies
     *
     * Standard is the configuration a new installation gets, with every module
     * on. It is built from the defaults rather than written out by hand, because
     * a hand-written copy drifts: until 2.9.8 Standard named a dozen fields and
     * left everything else alone, so applying it after Maximum kept Maximum's
     * password rules, its administrator alerts, its session limits and its
     * password expiry, and the preset that says it applies sensible defaults
     * applied almost none of them.
     *
     * The only thing it does not touch is what the site owner typed in: IP and
     * user agent lists, the custom login address, two factor configuration, the
     * integrity scan exclusions and the extra notification recipients. Putting
     * the security posture back to the defaults is one thing, throwing away
     * someone's whitelist is another, and "Reset to Defaults" is right there for
     * that.
     *
     * @since 2.9.8
     *
     * @return array
     */
    private function get_standard_preset_values() {
        $values = self::apply_install_tweaks( $this->get_default_options() );

        foreach ( array_keys( $values['modules'] ) as $module ) {
            $values['modules'][ $module ] = true;
        }

        foreach ( self::get_user_data_keys() as $section => $keys ) {
            foreach ( $keys as $key ) {
                unset( $values[ $section ][ $key ] );
            }
        }

        unset( $values['user_security']['password_expiration']['excluded_users'] );

        return $values;
    }

    /**
     * Merge a preset over a configuration
     *
     * Not array_replace_recursive(), which is wrong for this in two ways. A list
     * of roles in the preset is merged position by position instead of replacing
     * the stored one, so applying Standard over Maximum turned the two roles
     * Standard expires passwords for into Maximum's five with the first two
     * overwritten. And an empty list in the preset clears nothing at all,
     * because there is no element to replace with.
     *
     * So: associative arrays are merged key by key, and lists and scalars are
     * replaced outright.
     *
     * @since 2.9.8
     *
     * @param array $base    Current configuration.
     * @param array $overlay Preset values.
     * @return array
     */
    public static function merge_preset( $base, $overlay ) {
        foreach ( $overlay as $key => $value ) {
            if ( is_array( $value ) && isset( $base[ $key ] ) && is_array( $base[ $key ] ) && ! self::is_list( $value ) ) {
                $base[ $key ] = self::merge_preset( $base[ $key ], $value );
                continue;
            }

            $base[ $key ] = $value;
        }

        return $base;
    }

    /**
     * Whether an array is a plain list (0..n-1 keys)
     *
     * array_is_list() is PHP 8.1 and this plugin supports 7.4.
     *
     * @since 2.9.8
     *
     * @param array $value Array to inspect.
     * @return bool
     */
    private static function is_list( $value ) {
        if ( array() === $value ) {
            return true;
        }

        return array_keys( $value ) === range( 0, count( $value ) - 1 );
    }

    /**
     * Get presets with descriptions
     *
     * @return array Presets configuration.
     */
    public function get_presets() {
        return array(
            'standard' => array_merge(
                array(
                    'name'        => __( 'Standard', 'vigilante' ),
                    'description' => __( 'Balanced security suitable for most websites. Enables every module and puts every setting back to the value a new installation gets.', 'vigilante' ),
                ),
                $this->get_standard_preset_values()
            ),

            'maximum' => array(
                'name'        => __( 'Maximum Security', 'vigilante' ),
                'description' => __( 'Strictest settings for high-security sites. CSP is set to report-only mode to prevent breaking the admin interface.', 'vigilante' ),
                'modules' => array(
                    'firewall'         => true,
                    'security_headers' => true,
                    'login_security'   => true,
                    'rest_api_security'=> true,
                    'user_security'    => true,
                    'wp_hardening'     => true,
                    'file_integrity'   => true,
                    'activity_log'     => true,
                ),
                'firewall' => array(
                    'block_bad_query_strings'   => true,
                    'block_sql_injection'       => true,
                    'block_xss_attacks'         => true,
                    'block_file_inclusion'      => true,
                    'block_directory_traversal' => true,
                    'block_bad_bots'            => true,
                    'block_empty_user_agent'    => true,
                    'rate_limiting' => array(
                        'enabled'             => true,
                        'requests_per_minute' => 60,
                        'block_duration'      => 600,
                        'progressive'         => true,
                        'max_block_duration'  => 86400,
                    ),
                ),
                'security_headers' => array(
                    'x_frame_options' => 'DENY',
                    // HSTS is intentionally NOT enabled by Maximum: forcing HSTS on a site
                    // that doesn't have a healthy HTTPS setup (or temporarily falls back to
                    // HTTP) locks visitors out for the full max_age. Leaving HSTS off keeps
                    // it as an explicit opt-in decision per site.
                    'csp' => array(
                        'enabled'     => true,
                        'report_only' => false,
                        'directives'  => array(
                            'default-src'     => "'self'",
                            'script-src'      => "'self' 'unsafe-inline' 'unsafe-eval'",
                            'style-src'       => "'self' 'unsafe-inline'",
                            'img-src'         => "'self' data: https: blob:",
                            'font-src'        => "'self' data:",
                            'connect-src'     => "'self' https: blob:",
                            'frame-src'       => "'self' blob:",
                            'frame-ancestors' => "'none'",
                            'worker-src'      => "'self' blob:",
                            'object-src'      => "'none'",
                            'base-uri'        => "'self'",
                        ),
                    ),
                ),
                'rest_api_security' => array(
                    'mode' => 'authenticated_only',
                ),
                'login_security' => array(
                    'max_attempts'        => 3,
                    'lockout_duration'    => 3600,
                    'lockout_increment'   => true,
                    'notify_on_lockout'   => true,
                    'notify_on_admin_login' => true,
                ),
                'wp_hardening' => array(
                    'xmlrpc_mode'        => 'full',
                    'disallow_file_edit' => true,
                    'disallow_file_mods' => true,
                    // close_old_comments is intentionally NOT touched by Maximum:
                    // it would unilaterally close discussion on every old post,
                    // which is a content decision, not a security one.
                ),
                'user_security' => array(
                    'prevent_display_name_login_match' => true,
                    'min_password_length'              => 16,
                    'password_policy' => array(
                        'require_uppercase' => true,
                        'require_lowercase' => true,
                        'require_number'    => true,
                        'require_special'   => true,
                        'block_common'      => true,
                        'block_username'    => true,
                        'affected_roles'    => array(),
                    ),
                    'admin_monitoring' => array(
                        'alert_new_admin'              => true,
                        'alert_admin_email_change'     => true,
                        'alert_permission_elevation'   => true,
                        'alert_admin_password_change'  => true,
                    ),
                    'registration_approval' => array(
                        'enabled'           => true,
                        'notify_admin'      => true,
                        'auto_reject_days'  => 7,
                        'affected_roles'    => array( 'subscriber', 'contributor', 'author', 'editor' ),
                    ),
                    'session_limits' => array(
                        'enabled'           => true,
                        'max_sessions'      => 1,
                        'behavior'          => 'close_oldest',
                        'exclude_admins'    => false,
                    ),
                    'password_expiration' => array(
                        'enabled'           => true,
                        'expire_days'       => 30,
                        'warning_days'      => 7,
                        'affected_roles'    => array( 'administrator', 'editor', 'author', 'contributor', 'subscriber' ),
                        'password_history'  => 5,
                        'send_reminder'     => true,
                    ),
                    'email_verification' => array(
                        'enabled'               => true,
                        'token_expiry_hours'    => 24,
                        'allow_resend'          => true,
                        'auto_delete_days'      => 3,
                    ),
                ),
                'file_integrity' => array(
                    'scan_core'            => true,
                    'scan_plugins'         => true,
                    'scan_themes'          => true,
                    'scan_uploads'         => true,
                    'scan_critical_config' => true,
                    'auto_scan'            => true,
                    'scan_frequency'       => 'daily',
                    'notify_level'         => 'all',
                    'instant_alert'        => true,
                ),
                // A configuration called Maximum Security that never tells you
                // anything happened is half a product, so the audit alerts ship
                // on with it. The shared cooldown keeps a sustained attack from
                // turning into a flood. Under Attack mode builds on this preset,
                // so it inherits them for as long as it is on and gives them back
                // when it is switched off.
                'audit_alerts' => array(
                    'immediate' => array(
                        'enabled'      => true,
                        'min_severity' => 'critical',
                    ),
                    'threshold' => array(
                        'enabled' => true,
                    ),
                ),
                'activity_log' => array(
                    'log_logins'         => true,
                    'log_failed_logins'  => true,
                    'log_user_changes'   => true,
                    'log_post_changes'   => true,
                    'log_plugin_changes' => true,
                    'log_theme_changes'  => true,
                    'log_option_changes' => true,
                    'log_file_changes'   => true,
                    'log_comments'       => true,
                    'log_media'          => true,
                ),
            ),
        );
    }

    /**
     * Get module labels for display
     *
     * @return array Module labels.
     */
    public function get_module_labels() {
        return array(
            'firewall'         => __( 'Firewall', 'vigilante' ),
            'security_headers' => __( 'Security Headers', 'vigilante' ),
            'login_security'   => __( 'Login Security', 'vigilante' ),
            'rest_api_security'=> __( 'REST API Security', 'vigilante' ),
            'user_security'    => __( 'User Security', 'vigilante' ),
            'wp_hardening'     => __( 'WordPress Hardening', 'vigilante' ),
            'file_integrity'   => __( 'File Integrity', 'vigilante' ),
            'activity_log'     => __( 'Security Audit', 'vigilante' ),
        );
    }

    /**
     * Get module descriptions for display
     *
     * @return array Module descriptions.
     */
    public function get_module_descriptions() {
        return array(
            'firewall'         => __( 'Blocks malicious requests, SQL injection, XSS attacks, and bad bots. Includes rate limiting and file protection.', 'vigilante' ),
            'security_headers' => __( 'Adds HTTP security headers like CSP, HSTS, X-Frame-Options. Forces HTTPS and fixes mixed content.', 'vigilante' ),
            'login_security'   => __( 'Brute force protection, 2FA, login attempt limits, XML-RPC control, and notifications.', 'vigilante' ),
            'rest_api_security'=> __( 'Controls REST API access, blocks user enumeration, and protects sensitive endpoints.', 'vigilante' ),
            'user_security'    => __( 'Blocks insecure usernames, enforces strong passwords, and prevents author scanning.', 'vigilante' ),
            'wp_hardening'     => __( 'Hardens wp-config.php, manages comments, cleans header output, and controls feeds.', 'vigilante' ),
            'file_integrity'   => __( 'Scans WordPress core, plugins, and themes for unauthorized changes and suspicious code.', 'vigilante' ),
            'activity_log'     => __( 'Records user actions, logins, content changes, and security events for security auditing.', 'vigilante' ),
        );
    }

    /**
     * Validate options before saving
     *
     * @param array $input Raw input to validate.
     * @return array Validated options.
     */
    public function validate_options( $input ) {
        $validated = array();
        $defaults  = $this->get_default_options();

        // Validate each section that exists in input
        foreach ( $input as $section => $data ) {
            if ( ! is_array( $data ) ) {
                continue;
            }
            
            if ( 'modules' === $section ) {
                // Validate modules (booleans)
                foreach ( $defaults['modules'] as $module => $default_value ) {
                    $validated['modules'][ $module ] = isset( $data[ $module ] ) 
                        ? (bool) $data[ $module ] 
                        : false;
                }
            } elseif ( isset( $defaults[ $section ] ) ) {
                // Validate other sections using generic validator
                $validated[ $section ] = $this->validate_section( $data, $defaults[ $section ] );
            }
        }

        return apply_filters( 'vigilante_validate_options', $validated, $input );
    }

    /**
     * Validate a section based on defaults
     *
     * @param array $input    Input values.
     * @param array $defaults Default values.
     * @return array Validated values.
     */
    private function validate_section( $input, $defaults ) {
        $validated = array();

        foreach ( $defaults as $key => $default_value ) {
            if ( ! isset( $input[ $key ] ) ) {
                $validated[ $key ] = $default_value;
                continue;
            }

            $value = $input[ $key ];

            if ( is_bool( $default_value ) ) {
                $validated[ $key ] = (bool) $value;
            } elseif ( is_int( $default_value ) ) {
                $validated[ $key ] = intval( $value );
            } elseif ( is_array( $default_value ) ) {
                if ( is_array( $value ) ) {
                    $validated[ $key ] = $this->validate_section( $value, $default_value );
                } else {
                    $validated[ $key ] = $default_value;
                }
            } else {
                $validated[ $key ] = sanitize_text_field( $value );
            }
        }

        // Include any extra keys from input
        foreach ( $input as $key => $value ) {
            if ( ! isset( $validated[ $key ] ) ) {
                if ( is_array( $value ) ) {
                    $validated[ $key ] = array_map( 'sanitize_text_field', $value );
                } else {
                    $validated[ $key ] = sanitize_text_field( $value );
                }
            }
        }

        return $validated;
    }
}