<?php
/**
 * Quick admin login: one-time token-based auto-login.
 */

if ( ! defined( 'ABSPATH' ) ) exit;

class Flavor_Login {

    const TOKEN_TTL = 300; // 5 minutes

    public function __construct() {
        add_action( 'init', [ $this, 'handle_auto_login' ], 1 );
    }

    /**
     * Generate a one-time login URL for the first administrator.
     */
    public function generate_login_url() {
        $token = wp_generate_password( 32, false );
        $data  = [
            'token'      => $token,
            'expires_at' => time() + self::TOKEN_TTL,
            'used'       => false,
        ];
        update_option( 'flavor_login_token', $data );

        return site_url( '?flavor_auto_login=' . $token );
    }

    /**
     * Handle auto-login request.
     */
    public function handle_auto_login() {
        if ( empty( $_GET['flavor_auto_login'] ) ) {
            return;
        }

        $token = sanitize_text_field( $_GET['flavor_auto_login'] );
        $data  = get_option( 'flavor_login_token' );

        if ( ! $data || ! is_array( $data ) ) {
            wp_die( 'Invalid login token.', 'Login Error', [ 'response' => 403 ] );
        }

        if ( $data['used'] ) {
            delete_option( 'flavor_login_token' );
            wp_die( 'Token already used.', 'Login Error', [ 'response' => 403 ] );
        }

        if ( ! hash_equals( $data['token'], $token ) ) {
            wp_die( 'Invalid token.', 'Login Error', [ 'response' => 403 ] );
        }

        if ( time() > $data['expires_at'] ) {
            delete_option( 'flavor_login_token' );
            wp_die( 'Token expired.', 'Login Error', [ 'response' => 403 ] );
        }

        $data['used'] = true;
        update_option( 'flavor_login_token', $data );

        $admins = get_users( [ 'role' => 'administrator', 'number' => 1 ] );
        if ( empty( $admins ) ) {
            wp_die( 'No administrator found.', 'Login Error', [ 'response' => 500 ] );
        }

        $admin = $admins[0];

        wp_clear_auth_cookie();
        wp_set_current_user( $admin->ID );
        wp_set_auth_cookie( $admin->ID, true );
        do_action( 'wp_login', $admin->user_login, $admin );

        delete_option( 'flavor_login_token' );

        wp_safe_redirect( admin_url() );
        exit;
    }
}