# Outils de nettoyage Maintenance WP
WPCLI="php $HOME/wp-cli.phar"
Q="$HOME/quarantaine"
mkdir -p "$Q"

# WP-CLI sur un dossier, sans charger plugins ni thème (les mu-plugins restent chargés)
wpx() { local d="$1"; shift; $WPCLI --path="$HOME/$d" --skip-plugins --skip-themes "$@"; }

# 0. Sauvegarde fichiers + base
mwp_backup() {
  local d="$1" ts=$(date +%Y%m%d-%H%M)
  wpx "$d" db export "$Q/${d}_db_$ts.sql" && \
  tar czf "$Q/${d}_files_$ts.tar.gz" -C "$HOME" "$d" && \
  echo "Sauvegarde OK : $Q/${d}_*_$ts"
}

# 1. Core : réinstallation à version identique + quarantaine des fichiers en trop
mwp_core() {
  local d="$1" ts=$(date +%Y%m%d-%H%M) v list
  v=$(wpx "$d" core version) || return 1
  wpx "$d" core download --version="$v" --force --skip-content || return 1
  list="$Q/${d}_core_extra_$ts.txt"
  wpx "$d" core verify-checksums 2>&1 | sed -n 's/.*File should not exist: //p' > "$list"
  if [ -s "$list" ]; then
    (cd "$HOME/$d" && tar czf "$Q/${d}_core_extra_$ts.tar.gz" -T "$list" && xargs -d '\n' rm -f < "$list")
    echo "$(wc -l < "$list") fichier(s) en trop mis en quarantaine"
  fi
  wpx "$d" core verify-checksums
}

# 2. Extensions wordpress.org : quarantaine + réinstallation à version identique
mwp_plugins() {
  local d="$1" ts=$(date +%Y%m%d-%H%M) p v dir
  local manual="$Q/${d}_plugins_manuels_$ts.txt"
  for p in $(wpx "$d" plugin list --field=name); do
    dir="$HOME/$d/wp-content/plugins/$p"
    [ -d "$dir" ] || continue
    v=$(wpx "$d" plugin get "$p" --field=version)
    if [ -n "$v" ] && curl -sfIL "https://downloads.wordpress.org/plugin/$p.$v.zip" >/dev/null; then
      mv "$dir" "$Q/${d}_plugin_${p}_$ts"
      if ! wpx "$d" plugin install "$p" --version="$v"; then
        echo "ECHEC $p, restauration"; mv "$Q/${d}_plugin_${p}_$ts" "$dir"
      fi
    else
      echo "$p $v" | tee -a "$manual"
    fi
  done
  [ -s "$manual" ] && echo ">> A réinstaller depuis l'éditeur ou à auditer : $manual"
  wpx "$d" plugin verify-checksums --all
}

# 3. Thèmes wordpress.org : même logique
mwp_themes() {
  local d="$1" ts=$(date +%Y%m%d-%H%M) t v dir
  for t in $(wpx "$d" theme list --field=name); do
    dir="$HOME/$d/wp-content/themes/$t"
    v=$(wpx "$d" theme get "$t" --field=version)
    if [ -n "$v" ] && curl -sfIL "https://downloads.wordpress.org/theme/$t.$v.zip" >/dev/null; then
      mv "$dir" "$Q/${d}_theme_${t}_$ts"
      wpx "$d" theme install "$t" --version="$v" || mv "$Q/${d}_theme_${t}_$ts" "$dir"
    else
      echo "Thème hors wordpress.org (enfant/premium) à auditer : $t $v"
    fi
  done
}

# 4. Scan des points d'entrée habituels
mwp_scan() {
  local d="$1" r="$HOME/$1"
  echo "== mu-plugins";        ls -la "$r/wp-content/mu-plugins" 2>/dev/null
  echo "== PHP dans uploads";  find "$r/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \)
  echo "== PHP modifiés < 30 j"; find "$r" -type f -name "*.php" -mtime -30 -not -path "*/cache/*" | sort
  echo "== .htaccess";         find "$r" -name ".htaccess" -mtime -30
  echo "== Patterns suspects (mu-plugins, thèmes, extensions hors wp.org)"
  grep -rnlE "eval\(|base64_decode\(|gzinflate\(|str_rot13\(|assert\(\\\$|create_function|\\\$_(POST|REQUEST|COOKIE)\[.*\]\(|wp_create_user|add_role\(" \
    "$r/wp-content/mu-plugins" "$r/wp-content/themes" 2>/dev/null
  echo "== wp-config.php (début/fin)"; head -3 "$r/wp-config.php"; tail -5 "$r/wp-config.php"
  echo "== Admins"; wpx "$d" user list --role=administrator --fields=ID,user_login,user_email,user_registered
  echo "== Cron";   wpx "$d" cron event list --fields=hook,next_run_relative,recurrence
}

# 5. Spam en attente
mwp_spam() {
  local ids; ids=$(wpx "$1" comment list --status=hold --format=ids)
  [ -n "$ids" ] && wpx "$1" comment spam $ids
}

# Tout enchaîner
mwp_clean() {
  [ -d "$HOME/$1" ] || { echo "Dossier ~/$1 introuvable"; return 1; }
  mwp_backup "$1" && mwp_core "$1" && mwp_plugins "$1" && mwp_themes "$1" && mwp_scan "$1"
}