<?php
/**
 * Plugin Name: Elevate Secure Login
 * Description: Creates a dedicated premium Elevate login page and routes logged-out users to it with role-based destinations after sign-in.
 * Version: 0.1.1
 * Author: Elevate
 */
if ( ! defined( 'ABSPATH' ) ) exit;

final class Elevate_Secure_Login {
    const VERSION = '0.1.1';
    const SLUG = 'elevate-login';
    const OPTION = 'elevate_secure_login_page_id';
    private static $instance;

    public static function instance() {
        return self::$instance ?: self::$instance = new self();
    }

    private function __construct() {
        register_activation_hook( __FILE__, array( $this, 'activate' ) );
        add_shortcode( 'elevate_secure_login', array( $this, 'shortcode' ) );
        add_action( 'template_redirect', array( $this, 'handle_frontend' ), 0 );
        add_action( 'login_init', array( $this, 'route_wp_login' ), 1 );
        add_filter( 'login_url', array( $this, 'login_url' ), 20, 3 );
        add_filter( 'logout_redirect', array( $this, 'logout_redirect' ), 20, 3 );
        add_action( 'wp_enqueue_scripts', array( $this, 'assets' ) );
    }

    public function activate() {
        $page = get_page_by_path( self::SLUG );
        if ( ! $page ) {
            $page_id = wp_insert_post( array(
                'post_title'   => 'Elevate Sign In',
                'post_name'    => self::SLUG,
                'post_status'  => 'publish',
                'post_type'    => 'page',
                'post_content' => '[elevate_secure_login]',
            ) );
        } else {
            $page_id = $page->ID;
            if ( false === strpos( $page->post_content, '[elevate_secure_login]' ) ) {
                wp_update_post( array( 'ID' => $page_id, 'post_content' => '[elevate_secure_login]' ) );
            }
        }
        if ( ! is_wp_error( $page_id ) ) update_option( self::OPTION, (int) $page_id, false );
        flush_rewrite_rules();
    }

    private function page_url() {
        $id = (int) get_option( self::OPTION );
        $url = $id ? get_permalink( $id ) : home_url( '/' . self::SLUG . '/' );
        return $url ?: home_url( '/' . self::SLUG . '/' );
    }

    private function is_login_page() {
        return is_page( self::SLUG ) || is_page( (int) get_option( self::OPTION ) );
    }

    private function destination( $user ) {
        if ( ! $user instanceof WP_User ) return home_url( '/user-account/' );
        $roles = (array) $user->roles;

        if ( in_array( 'administrator', $roles, true ) || in_array( 'super_admin', $roles, true ) ) {
            return admin_url();
        }
        if ( in_array( 'elevate_lms_administrator', $roles, true ) || user_can( $user, 'elevate_manage_lms_operations' ) ) {
            return admin_url( 'admin.php?page=elevate-lms-operations' );
        }
        return home_url( '/user-account/' );
    }

    public function handle_frontend() {
        if ( is_admin() || wp_doing_ajax() ) return;

        if ( $this->is_login_page() ) {
            if ( is_user_logged_in() ) {
                wp_safe_redirect( $this->destination( wp_get_current_user() ) );
                exit;
            }

            if ( 'POST' === $_SERVER['REQUEST_METHOD'] && isset( $_POST['elevate_login_action'] ) ) {
                $nonce = isset( $_POST['elevate_login_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['elevate_login_nonce'] ) ) : '';
                if ( ! wp_verify_nonce( $nonce, 'elevate_secure_login' ) ) {
                    $this->redirect_error( 'request' );
                }

                $credentials = array(
                    'user_login'    => isset( $_POST['elevate_user'] ) ? sanitize_text_field( wp_unslash( $_POST['elevate_user'] ) ) : '',
                    'user_password' => isset( $_POST['elevate_password'] ) ? (string) wp_unslash( $_POST['elevate_password'] ) : '',
                    'remember'      => ! empty( $_POST['elevate_remember'] ),
                );

                $user = wp_signon( $credentials, is_ssl() );
                if ( is_wp_error( $user ) ) $this->redirect_error( 'credentials' );

                wp_set_current_user( $user->ID );
                wp_safe_redirect( $this->destination( $user ) );
                exit;
            }
            return;
        }

        if ( ! is_user_logged_in() && is_page( 'user-account' ) ) {
            wp_safe_redirect( $this->page_url() );
            exit;
        }
    }

    private function redirect_error( $code ) {
        wp_safe_redirect( add_query_arg( 'login_error', sanitize_key( $code ), $this->page_url() ) );
        exit;
    }

    public function route_wp_login() {
        if ( is_user_logged_in() ) return;
        $action = isset( $_REQUEST['action'] ) ? sanitize_key( wp_unslash( $_REQUEST['action'] ) ) : 'login';
        $recovery = isset( $_GET['elevate_admin'] ) && '1' === $_GET['elevate_admin'];
        if ( $recovery ) return;
        if ( in_array( $action, array( 'login', 'confirm_admin_email' ), true ) ) {
            wp_safe_redirect( $this->page_url() );
            exit;
        }
    }

    public function login_url( $login_url, $redirect, $force_reauth ) {
        $url = $this->page_url();
        if ( $redirect ) $url = add_query_arg( 'redirect_to', rawurlencode( $redirect ), $url );
        return $url;
    }

    public function logout_redirect( $redirect_to, $requested_redirect_to, $user ) {
        return $this->page_url();
    }

    public function assets() {
        if ( ! $this->is_login_page() ) return;
        wp_enqueue_style( 'elevate-secure-login', plugins_url( 'assets/login.css', __FILE__ ), array(), self::VERSION );
    }

    public function shortcode() {
        if ( is_user_logged_in() ) return '';
        $error = isset( $_GET['login_error'] ) ? sanitize_key( wp_unslash( $_GET['login_error'] ) ) : '';
        ob_start();
        ?>
        <section class="esl-page">
          <div class="esl-shell">
            <header class="esl-brand"><span class="esl-logo">↗</span><span><strong>Elevate</strong><small>Learning for a brighter tomorrow</small></span></header>
            <main class="esl-layout">
              <article class="esl-story">
                <span class="esl-kicker">Welcome to Elevate</span>
                <h1>Your learning<br>journey <em>starts here.</em></h1>
                <p>Access assigned programmes, complete assessments, track progress and earn certificates, all in one secure learning space.</p>
                <div class="esl-benefits">
                  <div><b>▶</b><span><strong>Assigned Programmes</strong><small>Access the learning selected for your account.</small></span></div>
                  <div><b>✓</b><span><strong>Assessments and Results</strong><small>Test your knowledge and see your progress.</small></span></div>
                  <div><b>★</b><span><strong>Earned Certificates</strong><small>Celebrate your learning achievements.</small></span></div>
                </div>
                <footer><i></i> Learn <span>•</span> Grow <span>•</span> Achieve More</footer>
              </article>
              <article class="esl-card">
                <div class="esl-card-head"><div><span>My Learning Workspace</span><h2>Welcome back<br>to <em>Elevate</em></h2></div><b>↗</b></div>
                <p>Sign in to continue your learning journey and unlock new opportunities.</p>
                <?php if ( $error ) : ?>
                  <div class="esl-error">The email, username or password was not recognised. Please try again.</div>
                <?php endif; ?>
                <form method="post" autocomplete="on">
                  <?php wp_nonce_field( 'elevate_secure_login', 'elevate_login_nonce' ); ?>
                  <input type="hidden" name="elevate_login_action" value="1">
                  <label for="elevate_user">Email or username</label>
                  <input id="elevate_user" name="elevate_user" type="text" autocomplete="username" placeholder="Enter email or username" required>
                  <label for="elevate_password">Password</label>
                  <input id="elevate_password" name="elevate_password" type="password" autocomplete="current-password" placeholder="Enter password" required>
                  <label class="esl-remember"><input type="checkbox" name="elevate_remember" value="1"> <span>Remember me</span></label>
                  <button type="submit">Sign In <span>→</span></button>
                </form>
                <div class="esl-secure">✓ <span>Secure access to the Elevate learning workspace</span></div>
              </article>
            </main>
          </div>
        </section>
        <?php
        return ob_get_clean();
    }
}
Elevate_Secure_Login::instance();

/* v0.1.1 alignment correction */
body:has(.esl-page) article.esl-story{
  width:auto!important;
  max-width:620px!important;
  min-height:0!important;
  margin:0!important;
  padding:0!important;
  background:transparent!important;
}
body:has(.esl-page) article.esl-card{
  width:100%!important;
  max-width:none!important;
  min-height:0!important;
  margin:0!important;
  padding:38px 40px 32px!important;
  background:linear-gradient(150deg,rgba(255,255,255,.98),rgba(249,252,255,.94))!important;
}
.esl-layout{
  grid-template-columns:minmax(0,.94fr) minmax(500px,1.06fr)!important;
  gap:72px!important;
  align-items:center!important;
  padding:24px 46px 24px!important;
}
.esl-story h1{font-size:clamp(46px,5.2vw,75px)!important}
.esl-story>p{max-width:600px!important}
.esl-benefits{gap:13px!important;margin-top:25px!important}
.esl-benefits>div{padding:12px 15px!important}
.esl-card-head{align-items:flex-start!important}
.esl-card-head>div{min-width:0!important;padding-right:12px!important}
.esl-card>p{margin:16px 0 21px!important}
.esl-card input[type=text],.esl-card input[type=password]{min-height:52px!important;margin-bottom:14px!important}
.esl-remember{margin-bottom:17px!important}
.esl-card button{min-height:54px!important}
.esl-secure{margin-top:18px!important;padding-top:15px!important}
@media(max-width:1180px) and (min-width:1041px){
  .esl-layout{grid-template-columns:minmax(0,.9fr) minmax(470px,1.1fr)!important;gap:48px!important;padding-left:22px!important;padding-right:22px!important}
  .esl-story h1{font-size:58px!important}
}
@media(max-width:1040px){
  .esl-layout{grid-template-columns:1fr!important;gap:38px!important;padding:30px 0!important}
  body:has(.esl-page) article.esl-story{max-width:none!important}
  body:has(.esl-page) article.esl-card{max-width:760px!important;margin:auto!important;padding:36px 34px 30px!important}
}
@media(max-width:650px){
  body:has(.esl-page) article.esl-card{padding:29px 21px 25px!important}
}