/**
 * B2BKing Subaccount Importer v16 (Multisite-ready)
 *
 * Custom admin menu page in WordPress. Select parent account via searchable dropdown
 * (shows name, email, company and B2BKing group), paste in email addresses
 * — new accounts are created and linked as subaccounts.
 *
 * Multisite:
 *  - Already on this site → ERROR
 *  - Exists in network but not here → WARNING (no auto-add)
 *  - Does not exist → Created
 *
 * Subaccounts inherit the parent account's WP role and B2BKing group.
 * Permission: selectable via checkboxes (default: "buy" only).
 * Welcome email: optional (default: off).
 * B2BKing hook b2bking_after_subaccount_created is NOT fired
 * (causes unwanted conversation emails and billing data copying).
 *
 * Requires: WordPress 5.0+, WooCommerce 5.0+, B2BKing, PHP 7.2+
 * Snippet Type: Functions (PHP)
 * Run on: Admin only
 */

// ============================================================
// 1. REGISTER ADMIN MENU
// ============================================================
add_action( 'admin_menu', 'b2b_importer_register_menu' );

function b2b_importer_register_menu() {
    add_menu_page(
        'Subaccount Import',
        'Subaccount Import',
        'manage_woocommerce',
        'b2b-subaccount-import',
        'b2b_importer_render_page',
        'dashicons-groups',
        58
    );
}

// ============================================================
// 2. HELPER – GET B2BKING GROUP NAME
// ============================================================
function b2b_importer_get_group_name( $user_id ) {
    // Respect B2BKing's b2bking_group_key_name filter (may prefix key per site)
    $group_key = apply_filters( 'b2bking_group_key_name', 'b2bking_customergroup' );
    $group_id  = get_user_meta( $user_id, $group_key, true );
    if ( ! empty( $group_id ) ) {
        $name = get_the_title( intval( $group_id ) );
        // Multisite: group post may live on another site — fall back to ID
        return $name ?: 'Group #' . intval( $group_id );
    }
    return '';
}

// ============================================================
// 3. HELPER – GET PARENT ACCOUNT PRIMARY ROLE
// ============================================================
function b2b_importer_get_parent_role( $parent_id ) {
    $parent_user = get_userdata( $parent_id );
    if ( $parent_user && ! empty( $parent_user->roles ) ) {
        return $parent_user->roles[0];
    }
    return 'customer';
}

// ============================================================
// 4. HELPER – VALIDATE USER IS NOT A SUBACCOUNT
// ============================================================
function b2b_importer_is_valid_parent( $user_id ) {
    $account_type = get_user_meta( $user_id, 'b2bking_account_type', true );
    return ( $account_type !== 'subaccount' );
}

// ============================================================
// 5. HELPER – GENERATE UNIQUE USERNAME (with safety limit)
// ============================================================
function b2b_importer_generate_username( $email ) {
    // Note: usernames are checked but not reserved. In preview mode, the suggested
    // username may differ from the actual one at import time if another user is
    // created between preview and import. This is expected and harmless.
    $base = sanitize_user( strstr( $email, '@', true ), true );
    if ( empty( $base ) ) {
        $base = 'user';
    }
    // Multisite: username must be lowercase and without dots in some configs
    $base = strtolower( $base );

    $username = $base;
    $suffix   = 1;
    $max      = 999; // Safety limit

    while ( username_exists( $username ) && $suffix <= $max ) {
        $username = $base . $suffix;
        $suffix++;
    }

    if ( $suffix > $max ) {
        return new WP_Error( 'username_exhausted', 'Could not generate unique username for ' . $email );
    }

    return $username;
}

// ============================================================
// 6. HELPER – CONNECT SUBACCOUNT TO PARENT
// ============================================================
function b2b_importer_connect_subaccount( $user_id, $parent_id, $permissions = array() ) {
    // Subaccount type and parent
    update_user_meta( $user_id, 'b2bking_account_type', 'subaccount' );
    update_user_meta( $user_id, 'b2bking_account_parent', $parent_id );

    // Inherit B2BKing group from parent
    // Respect B2BKing's b2bking_group_key_name filter (may prefix key per site)
    $group_key    = apply_filters( 'b2bking_group_key_name', 'b2bking_customergroup' );
    $parent_group = get_user_meta( $parent_id, $group_key, true );
    $parent_b2b   = get_user_meta( $parent_id, 'b2bking_b2buser', true );

    if ( ! empty( $parent_group ) ) {
        update_user_meta( $user_id, $group_key, $parent_group );
    }
    if ( ! empty( $parent_b2b ) ) {
        update_user_meta( $user_id, 'b2bking_b2buser', $parent_b2b );
    }

    // Permissions — defaults with override from parameter
    $defaults = array(
        'b2bking_account_permission_buy'                => 1,
        'b2bking_account_permission_buy_approval'       => 0,
        'b2bking_account_permission_view_orders'        => 0,
        'b2bking_account_permission_view_offers'        => 0,
        'b2bking_account_permission_view_conversations' => 0,
        'b2bking_account_permission_view_lists'         => 0,
        'b2bking_account_permission_view_subscriptions' => 0,
    );
    $merged = array_merge( $defaults, array_intersect_key( $permissions, $defaults ) );
    foreach ( $merged as $key => $value ) {
        update_user_meta( $user_id, $key, intval( $value ) ? 1 : 0 );
    }

    // Update parent's subaccounts list (duplicate protection)
    $current_list = get_user_meta( $parent_id, 'b2bking_subaccounts_list', true );
    $ids_array    = ! empty( $current_list )
        ? array_filter( array_map( 'trim', explode( ',', $current_list ) ) )
        : array();

    if ( ! in_array( (string) $user_id, $ids_array, true ) ) {
        $ids_array[] = $user_id;
        update_user_meta( $parent_id, 'b2bking_subaccounts_list', implode( ',', $ids_array ) );
    }

    // NOTE: We do NOT fire do_action('b2bking_after_subaccount_created') here.
    // B2BKing's own hook listener causes unwanted side effects:
    //  1. Copies parent account billing/shipping to the subaccount
    //  2. Creates an "Account activated" conversation + sends email
    // All required metadata is already set above — the hook is not needed.
}

// ============================================================
// 7. HELPER – CLEAR BILLING/SHIPPING FROM SUBACCOUNT
// ============================================================
function b2b_importer_clear_billing_shipping( $user_id ) {
    $fields = array(
        // Billing
        'billing_first_name', 'billing_last_name', 'billing_company',
        'billing_address_1', 'billing_address_2', 'billing_city',
        'billing_postcode', 'billing_country', 'billing_state',
        'billing_phone', 'billing_email',
        // Shipping
        'shipping_first_name', 'shipping_last_name', 'shipping_company',
        'shipping_address_1', 'shipping_address_2', 'shipping_city',
        'shipping_postcode', 'shipping_country', 'shipping_state',
        'shipping_phone',
    );
    foreach ( $fields as $key ) {
        delete_user_meta( $user_id, $key );
    }
}

// ============================================================
// 8. HELPER – LOG MAIL FAILURES DURING IMPORT
// ============================================================
function b2b_importer_log_mail_error( $wp_error ) {
    if ( is_wp_error( $wp_error ) ) {
        error_log( 'B2B Importer: wp_mail failed — ' . $wp_error->get_error_message() );
    }
}

define( 'B2B_IMPORTER_MAX_EMAILS', 200 );

// ============================================================
// 9. HELPER – PARSE EMAIL LIST FROM RAW INPUT
// ============================================================
function b2b_importer_parse_emails( $raw ) {
    $raw   = wp_unslash( $raw ); // WordPress magic quotes
    $raw   = sanitize_textarea_field( $raw );
    // Support line breaks, commas and semicolons as separators
    $lines = preg_split( '/[\r\n,;]+/', $raw );
    $lines = array_filter( array_map( 'trim', $lines ) );
    // Limit emails per run (abuse/timeout protection)
    return array_slice( $lines, 0, B2B_IMPORTER_MAX_EMAILS );
}

// ============================================================
// 10. HELPER – PARSE PERMISSIONS FROM POST DATA
// ============================================================
function b2b_importer_parse_permissions( $raw_perms ) {
    // Allowed keys (whitelist) — ignore everything else
    $allowed = array(
        'b2bking_account_permission_buy',
        'b2bking_account_permission_buy_approval',
        'b2bking_account_permission_view_orders',
        'b2bking_account_permission_view_offers',
        'b2bking_account_permission_view_conversations',
        'b2bking_account_permission_view_lists',
        'b2bking_account_permission_view_subscriptions',
    );

    $parsed = array();
    if ( is_array( $raw_perms ) ) {
        foreach ( $allowed as $key ) {
            $parsed[ $key ] = ! empty( $raw_perms[ $key ] ) ? 1 : 0;
        }
    }
    return $parsed;
}

// ============================================================
// 11. AJAX – SEARCH PARENT ACCOUNTS (Select2)
// ============================================================
add_action( 'wp_ajax_b2b_search_parents', 'b2b_importer_search_parents' );

function b2b_importer_search_parents() {
    check_ajax_referer( 'b2b_importer_nonce', 'nonce' );

    if ( ! current_user_can( 'manage_woocommerce' ) ) {
        wp_send_json_error( 'Permission denied' );
    }

    $term = sanitize_text_field( wp_unslash( $_GET['term'] ?? '' ) );
    $term = mb_substr( $term, 0, 100 ); // Limit search term length

    if ( empty( $term ) ) {
        wp_send_json( array( 'results' => array() ) ); // Select2 format, wp_die() internally
        return; // Explicit — wp_send_json calls wp_die(), but return makes the flow clear
    }

    $args = array(
        'search'         => "*{$term}*",
        'search_columns' => array( 'user_login', 'user_email', 'display_name' ),
        'number'         => 20,
        'orderby'        => 'display_name',
        'blog_id'        => get_current_blog_id(),
        'meta_query'     => array(
            'relation' => 'OR',
            array(
                'key'     => 'b2bking_account_type',
                'value'   => 'subaccount',
                'compare' => '!=',
            ),
            array(
                'key'     => 'b2bking_account_type',
                'compare' => 'NOT EXISTS',
            ),
        ),
    );

    $users   = get_users( $args );
    $results = array();

    foreach ( $users as $user ) {
        $company    = get_user_meta( $user->ID, 'billing_company', true );
        $group_name = b2b_importer_get_group_name( $user->ID );

        // Plain text — Select2 escapes via its built-in escapeMarkup
        $parts = array(
            $user->display_name,
            '(' . $user->user_email . ')',
        );
        if ( $company ) {
            $parts[] = '— ' . $company;
        }
        if ( $group_name ) {
            $parts[] = '[' . $group_name . ']';
        }

        $results[] = array(
            'id'   => $user->ID,
            'text' => implode( ' ', $parts ),
        );
    }

    // Select2 requires { results: [...] } format — wp_send_json_success() wraps in { success, data }
    // wp_send_json() calls wp_die() internally (WP 5.0+)
    wp_send_json( array( 'results' => $results ) );
}

// ============================================================
// 12. AJAX – PREVIEW (Dry Run)
// ============================================================
add_action( 'wp_ajax_b2b_preview_import', 'b2b_importer_preview' );

function b2b_importer_preview() {
    check_ajax_referer( 'b2b_importer_nonce', 'nonce' );

    if ( ! current_user_can( 'manage_woocommerce' ) ) {
        wp_send_json_error( 'Permission denied' );
    }

    $parent_id   = absint( wp_unslash( $_POST['parent_id'] ?? 0 ) );
    $emails      = b2b_importer_parse_emails( $_POST['emails'] ?? '' );
    $permissions   = b2b_importer_parse_permissions( $_POST['permissions'] ?? array() );
    $send_welcome  = ( absint( $_POST['send_welcome'] ?? 0 ) === 1 );
    $clear_billing = ( absint( $_POST['clear_billing'] ?? 0 ) === 1 );
    $hide_prices   = ( absint( $_POST['hide_prices'] ?? 0 ) === 1 );

    if ( ! $parent_id || ! get_userdata( $parent_id ) ) {
        wp_send_json_error( 'Invalid parent account.' );
    }

    // Security check: parent must not be a subaccount
    if ( ! b2b_importer_is_valid_parent( $parent_id ) ) {
        wp_send_json_error( 'Selected account is a subaccount and cannot be a parent.' );
    }

    $is_multisite = is_multisite();
    $current_blog = get_current_blog_id();
    $parent_role  = b2b_importer_get_parent_role( $parent_id );
    $group_name   = b2b_importer_get_group_name( $parent_id );
    $items        = array();

    foreach ( $emails as $email ) {
        $email = sanitize_email( $email );

        if ( empty( $email ) || ! is_email( $email ) ) {
            $items[] = array(
                'email'  => $email ?: '(empty line)',
                'status' => 'invalid',
                'note'   => 'Invalid email address.',
            );
            continue;
        }

        $existing = get_user_by( 'email', $email );

        if ( $existing ) {
            if ( $is_multisite && ! is_user_member_of_blog( $existing->ID, $current_blog ) ) {
                $items[] = array(
                    'email'  => $email,
                    'status' => 'network_exists',
                    'note'   => sprintf(
                        'Exists in the network (ID %d, %s) but not on this site. Requires manual action.',
                        $existing->ID,
                        $existing->user_login
                    ),
                );
            } else {
                $items[] = array(
                    'email'  => $email,
                    'status' => 'exists',
                    'note'   => sprintf( 'Already registered on this site (ID %d). Skipping.', $existing->ID ),
                );
            }
        } else {
            $username = b2b_importer_generate_username( $email );
            if ( is_wp_error( $username ) ) {
                $items[] = array(
                    'email'  => $email,
                    'status' => 'invalid',
                    'note'   => $username->get_error_message(),
                );
                continue;
            }

            $items[] = array(
                'email'    => $email,
                'status'   => 'will_create',
                'note'     => sprintf(
                    'New account. Username: %s, Role: %s',
                    $username,
                    $parent_role
                ),
                'username' => $username,
            );
        }
    }

    $count_status = function( $status ) use ( $items ) {
        return count( array_filter( $items, function( $i ) use ( $status ) {
            return $i['status'] === $status;
        } ) );
    };

    // Build permissions summary for display
    $perm_labels = array(
        'b2bking_account_permission_buy'                => 'Place orders',
        'b2bking_account_permission_buy_approval'       => 'Orders require approval',
        'b2bking_account_permission_view_orders'        => 'View orders',
        'b2bking_account_permission_view_offers'        => 'View offers',
        'b2bking_account_permission_view_conversations' => 'View conversations',
        'b2bking_account_permission_view_lists'         => 'View purchase lists',
        'b2bking_account_permission_view_subscriptions' => 'View subscriptions',
    );
    $active_perms = array();
    foreach ( $permissions as $key => $val ) {
        if ( $val && isset( $perm_labels[ $key ] ) ) {
            $active_perms[] = $perm_labels[ $key ];
        }
    }
    $perms_summary = ! empty( $active_perms )
        ? implode( ', ', $active_perms )
        : '(no permissions)';

    wp_send_json_success( array(
        'items'               => $items,
        'parent_role'         => $parent_role,
        'group_name'          => $group_name ?: '(no B2BKing group)',
        'permissions_summary' => $perms_summary,
        'send_welcome'        => $send_welcome,
        'clear_billing'       => $clear_billing,
        'hide_prices'         => $hide_prices,
        'counts'              => array(
            'will_create'    => $count_status( 'will_create' ),
            'exists'         => $count_status( 'exists' ),
            'network_exists' => $count_status( 'network_exists' ),
            'invalid'        => $count_status( 'invalid' ),
        ),
    ) );
}

// ============================================================
// 13. AJAX – IMPORT SUBACCOUNTS
// ============================================================
add_action( 'wp_ajax_b2b_import_subaccounts', 'b2b_importer_import' );

function b2b_importer_import() {
    check_ajax_referer( 'b2b_importer_nonce', 'nonce' );

    if ( ! current_user_can( 'manage_woocommerce' ) ) {
        wp_send_json_error( 'Permission denied' );
    }

    // Rate limit: max 5 import runs per minute per user
    $rate_key   = 'b2b_import_rate_' . get_current_user_id();
    $rate_count = (int) get_transient( $rate_key );
    if ( $rate_count >= 5 ) {
        wp_send_json_error( 'Too many import attempts. Wait one minute.' );
    }
    set_transient( $rate_key, $rate_count + 1, 60 );

    $parent_id      = absint( wp_unslash( $_POST['parent_id'] ?? 0 ) );
    $emails         = b2b_importer_parse_emails( $_POST['emails'] ?? '' );
    $permissions    = b2b_importer_parse_permissions( $_POST['permissions'] ?? array() );
    $send_welcome   = ( absint( $_POST['send_welcome'] ?? 0 ) === 1 );
    $clear_billing  = ( absint( $_POST['clear_billing'] ?? 0 ) === 1 );
    $hide_prices    = ( absint( $_POST['hide_prices'] ?? 0 ) === 1 );

    if ( ! $parent_id || ! get_userdata( $parent_id ) ) {
        wp_send_json_error( 'Invalid parent account.' );
    }

    // Security check: parent must not be a subaccount
    if ( ! b2b_importer_is_valid_parent( $parent_id ) ) {
        wp_send_json_error( 'Selected account is a subaccount and cannot be a parent.' );
    }

    if ( empty( $emails ) ) {
        wp_send_json_error( 'No valid email addresses provided.' );
    }

    $is_multisite = is_multisite();
    $current_blog = get_current_blog_id();
    $parent_role  = b2b_importer_get_parent_role( $parent_id );
    $created      = array();
    $warnings     = array();
    $errors       = array();

    // Suppress new-user emails during import (unless welcome mail is selected)
    // Note: wp_new_user_notification() is called directly in the loop and
    // checks the wp_send_new_user_notification_to_user filter internally — that filter
    // is only set when $send_welcome=false. The removed actions (register_new_user,
    // edit_user_created_user) do NOT affect wp_new_user_notification() since
    // it is called directly, not via those hooks.
    if ( ! $send_welcome ) {
        add_filter( 'wp_send_new_user_notification_to_user', '__return_false' );
    } else {
        // Log mail failures during import (wp_mail returns false, never throws)
        add_action( 'wp_mail_failed', 'b2b_importer_log_mail_error' );
    }
    add_filter( 'wp_send_new_user_notification_to_admin', '__return_false' );
    remove_action( 'register_new_user', 'wp_send_new_user_notifications' );
    remove_action( 'edit_user_created_user', 'wp_send_new_user_notifications', 10 );

    // Multisite: suppress "New User Registration" email to network admin
    if ( is_multisite() ) {
        remove_action( 'wpmu_new_user', 'newuser_notify_siteadmin', 10 );
    }

    foreach ( $emails as $email ) {
        $email = sanitize_email( $email );

        if ( empty( $email ) || ! is_email( $email ) ) {
            $errors[] = array(
                'email'   => $email ?: '(empty line)',
                'message' => 'Invalid email address.',
            );
            continue;
        }

        $existing_user = get_user_by( 'email', $email );

        // -------------------------------------------------------
        // User already exists
        // -------------------------------------------------------
        if ( $existing_user ) {
            if ( $is_multisite && ! is_user_member_of_blog( $existing_user->ID, $current_blog ) ) {
                $warnings[] = array(
                    'email'   => $email,
                    'message' => sprintf(
                        'Exists in the network (ID %d, %s) but not on this site. Add manually via Users → Add Existing, then run the import again.',
                        $existing_user->ID,
                        $existing_user->user_login
                    ),
                );
            } else {
                $errors[] = array(
                    'email'   => $email,
                    'message' => sprintf(
                        'Already registered on this site (ID %d). Skipping.',
                        $existing_user->ID
                    ),
                );
            }
            continue;
        }

        // -------------------------------------------------------
        // Brand new user
        // -------------------------------------------------------
        $username = b2b_importer_generate_username( $email );
        if ( is_wp_error( $username ) ) {
            $errors[] = array(
                'email'   => $email,
                'message' => $username->get_error_message(),
            );
            continue;
        }

        $password = wp_generate_password( 16, true, false );

        if ( $is_multisite ) {
            $user_id = wpmu_create_user( $username, $password, $email );

            if ( is_wp_error( $user_id ) || ! $user_id ) {
                $msg = is_wp_error( $user_id ) ? $user_id->get_error_message() : 'Unknown error during creation.';
                $errors[] = array(
                    'email'   => $email,
                    'message' => $msg,
                );
                continue;
            }

            $added = add_user_to_blog( $current_blog, $user_id, $parent_role );

            if ( is_wp_error( $added ) ) {
                $errors[] = array(
                    'email'   => $email,
                    'message' => sprintf(
                        'User was created in the network (ID %d) but could not be added to this site: %s. You can add them manually via Users → Add Existing.',
                        $user_id,
                        $added->get_error_message()
                    ),
                );
                continue;
            }
        } else {
            $user_id = wp_insert_user( array(
                'user_login' => $username,
                'user_email' => $email,
                'user_pass'  => $password,
                'role'       => $parent_role,
            ) );

            if ( is_wp_error( $user_id ) ) {
                $errors[] = array(
                    'email'   => $email,
                    'message' => $user_id->get_error_message(),
                );
                continue;
            }
        }

        // Connect as subaccount (inherits group, permissions etc.)
        b2b_importer_connect_subaccount( $user_id, $parent_id, $permissions );

        // Precautionary fallback — b2bking_after_subaccount_created hook is not fired,
        // so no data is normally copied. Enable only if other plugins copy address data.
        if ( $clear_billing ) {
            b2b_importer_clear_billing_shipping( $user_id );
        }

        // Set hide_prices_and_shipping meta if selected
        // Value '1' = prices hidden, '0' = prices visible (matches existing snippet convention)
        update_user_meta( $user_id, 'hide_prices_and_shipping', $hide_prices ? '1' : '0' );

        // Send welcome email if selected (WP standard "Set your password" email)
        if ( $send_welcome ) {
            wp_new_user_notification( $user_id, null, 'user' );
        }

        $created[] = array(
            'email'    => $email,
            'username' => $username,
            'user_id'  => intval( $user_id ),
        );
    }

    // Restore mail hooks
    if ( ! $send_welcome ) {
        remove_filter( 'wp_send_new_user_notification_to_user', '__return_false' );
    } else {
        remove_action( 'wp_mail_failed', 'b2b_importer_log_mail_error' );
    }
    remove_filter( 'wp_send_new_user_notification_to_admin', '__return_false' );
    add_action( 'register_new_user', 'wp_send_new_user_notifications' );
    add_action( 'edit_user_created_user', 'wp_send_new_user_notifications', 10, 2 );

    // Multisite: restore network admin notification
    if ( is_multisite() ) {
        add_action( 'wpmu_new_user', 'newuser_notify_siteadmin', 10 );
    }
    if ( function_exists( 'b2bking' ) && method_exists( b2bking(), 'clear_caches_for_user' ) ) {
        b2bking()->clear_caches_for_user( $parent_id );
    }
    delete_transient( 'b2bking_customers_list_cache' );
    delete_transient( 'b2bking_subaccounts_cache_' . $parent_id );

    wp_send_json_success( array(
        'created'  => $created,
        'warnings' => $warnings,
        'errors'   => $errors,
        'summary'  => sprintf(
            '%d subaccounts created, %d warnings, %d errors (of %d emails total).%s',
            count( $created ),
            count( $warnings ),
            count( $errors ),
            count( $emails ),
            $send_welcome && count( $created ) > 0
                ? sprintf( ' Welcome email sent to %d accounts.', count( $created ) )
                : ''
        ),
    ) );
}

// ============================================================
// 14. ADMIN PAGE – HTML + CSS + JS
// ============================================================
function b2b_importer_render_page() {
    // Check that WooCommerce is active
    if ( ! function_exists( 'WC' ) || ! WC() ) {
        echo '<div class="wrap"><div class="notice notice-error"><p><strong>B2BKing Subaccount Importer:</strong> WooCommerce must be active.</p></div></div>';
        return;
    }

    wp_enqueue_style( 'select2', WC()->plugin_url() . '/assets/css/select2.css' );
    wp_enqueue_script( 'select2', WC()->plugin_url() . '/assets/js/select2/select2.full.min.js', array( 'jquery' ), null, true );

    $nonce        = wp_create_nonce( 'b2b_importer_nonce' );
    $is_multisite = is_multisite();
    $site_name    = get_bloginfo( 'name' );
    ?>
    <style>
        .b2b-importer-wrap {
            max-width: 760px;
            margin: 20px 0;
        }
        .b2b-importer-wrap h1 {
            font-size: 1.6em;
            margin-bottom: 6px;
        }
        .b2b-importer-wrap .description {
            color: #646970;
            margin-bottom: 24px;
            line-height: 1.5;
        }
        .b2b-importer-card {
            background: #fff;
            border: 1px solid #c3c4c7;
            border-radius: 4px;
            padding: 24px 28px;
            margin-bottom: 20px;
        }
        .b2b-importer-card label {
            display: block;
            font-weight: 600;
            margin-bottom: 6px;
            font-size: 14px;
        }
        .b2b-importer-card .field-hint {
            color: #646970;
            font-size: 12px;
            margin-top: 4px;
            line-height: 1.4;
        }
        .b2b-field-group {
            margin-bottom: 20px;
        }
        .b2b-field-group:last-child {
            margin-bottom: 0;
        }
        #b2b_parent_select {
            width: 100%;
        }
        #b2b_emails {
            width: 100%;
            min-height: 150px;
            font-family: monospace;
            font-size: 13px;
            line-height: 1.5;
        }
        #b2b_email_count {
            text-align: right;
            color: #646970;
            font-size: 12px;
            margin-top: 4px;
        }
        .b2b-btn-group {
            display: flex;
            gap: 10px;
            margin-top: 4px;
        }
        .b2b-btn-group .spinner {
            float: none;
            margin: 0 4px;
            visibility: hidden;
        }
        .b2b-btn-group .loading .spinner {
            visibility: visible;
        }
        .b2b-results {
            margin-top: 20px;
        }
        .b2b-results h3 {
            margin: 16px 0 8px 0;
        }
        .b2b-results h3:first-child {
            margin-top: 0;
        }
        .b2b-result-success {
            background: #f0f6e8;
            border-left: 4px solid #00a32a;
            padding: 10px 14px;
            margin-bottom: 6px;
            font-size: 13px;
        }
        .b2b-result-warning {
            background: #fef8ee;
            border-left: 4px solid #dba617;
            padding: 10px 14px;
            margin-bottom: 6px;
            font-size: 13px;
        }
        .b2b-result-error {
            background: #fcf0f1;
            border-left: 4px solid #d63638;
            padding: 10px 14px;
            margin-bottom: 6px;
            font-size: 13px;
        }
        .b2b-result-info {
            background: #f0f6fc;
            border-left: 4px solid #72aee6;
            padding: 10px 14px;
            margin-bottom: 6px;
            font-size: 13px;
        }
        .b2b-result-summary {
            padding: 12px 16px;
            background: #f0f0f1;
            border-radius: 4px;
            font-weight: 600;
            font-size: 14px;
            margin-bottom: 12px;
        }
        .b2b-info-box {
            border-left: 4px solid;
            padding: 10px 14px;
            font-size: 13px;
            margin-top: 16px;
            line-height: 1.5;
        }
        .b2b-info-box.blue  { background: #f0f6fc; border-color: #72aee6; }
        .b2b-info-box.amber { background: #fef8ee; border-color: #dba617; }
        .b2b-badge {
            display: inline-block;
            background: #dcdcde;
            color: #1d2327;
            font-size: 11px;
            padding: 2px 8px;
            border-radius: 10px;
            font-weight: 600;
            margin-left: 6px;
            vertical-align: middle;
        }
        .b2b-preview-table {
            width: 100%;
            border-collapse: collapse;
            font-size: 13px;
            margin: 12px 0;
        }
        .b2b-preview-table th {
            text-align: left;
            background: #f0f0f1;
            padding: 8px 10px;
            font-weight: 600;
            border-bottom: 2px solid #c3c4c7;
        }
        .b2b-preview-table td {
            padding: 7px 10px;
            border-bottom: 1px solid #e0e0e0;
        }
        .b2b-preview-table tr:last-child td {
            border-bottom: none;
        }
        .b2b-status-dot {
            display: inline-block;
            width: 10px;
            height: 10px;
            border-radius: 50%;
            margin-right: 6px;
            vertical-align: middle;
        }
        .b2b-status-dot.green  { background: #00a32a; }
        .b2b-status-dot.red    { background: #d63638; }
        .b2b-status-dot.amber  { background: #dba617; }
        .b2b-status-dot.gray   { background: #999; }
        .b2b-preview-meta {
            display: flex;
            gap: 24px;
            padding: 10px 14px;
            background: #f6f7f7;
            border-radius: 4px;
            font-size: 13px;
            margin-bottom: 12px;
        }
        .b2b-preview-meta strong {
            margin-right: 4px;
        }
        .b2b-permissions-grid {
            display: grid;
            grid-template-columns: 1fr 1fr;
            gap: 6px 20px;
            margin: 8px 0;
        }
        .b2b-checkbox {
            display: flex;
            align-items: center;
            gap: 8px;
            font-size: 13px;
            font-weight: 400;
            cursor: pointer;
            padding: 4px 0;
        }
        .b2b-checkbox input[type="checkbox"] {
            width: 16px;
            height: 16px;
            margin: 0;
            cursor: pointer;
            flex-shrink: 0;
        }
        .b2b-checkbox-standalone {
            font-weight: 600;
            font-size: 14px;
        }
    </style>

    <div class="wrap b2b-importer-wrap">
        <h1>&#x1F3E2; B2BKing Subaccount Import <?php if ( $is_multisite ) : ?><span class="b2b-badge">Multisite</span><?php endif; ?></h1>
        <p class="description">
            Import new subaccounts by selecting a parent account and entering email addresses.
            New accounts are created and linked automatically in B2BKing &mdash; role and group are inherited from parent.
            <?php if ( $is_multisite ) : ?>
                <br>Network accounts not found on <strong><?php echo esc_html( $site_name ); ?></strong> must be added manually first.
            <?php endif; ?>
        </p>

        <div class="b2b-importer-card">
            <div class="b2b-field-group">
                <label for="b2b_parent_select">Parent Account</label>
                <select id="b2b_parent_select" name="parent_id">
                    <option value="">Search by name, email or company&hellip;</option>
                </select>
                <p class="field-hint">Shows name, email, company and B2BKing group. Subaccounts are filtered out.</p>
            </div>

            <div class="b2b-field-group">
                <label for="b2b_emails">Email addresses (one per line, comma or semicolon)</label>
                <textarea id="b2b_emails" placeholder="anna@company.com&#10;erik@company.com&#10;maria@company.com"></textarea>
                <div id="b2b_email_count">0 email addresses</div>
                <p class="field-hint">Max <?php echo intval( B2B_IMPORTER_MAX_EMAILS ); ?> emails per run. Separate with line breaks, commas or semicolons.</p>
            </div>

            <div class="b2b-field-group">
                <label>Permissions for new subaccounts</label>
                <div class="b2b-permissions-grid">
                    <label class="b2b-checkbox">
                        <input type="checkbox" name="perm_buy" id="b2b_perm_buy" checked>
                        <span>Place orders</span>
                    </label>
                    <label class="b2b-checkbox">
                        <input type="checkbox" name="perm_buy_approval" id="b2b_perm_buy_approval">
                        <span>Orders require approval</span>
                    </label>
                    <label class="b2b-checkbox">
                        <input type="checkbox" name="perm_view_orders" id="b2b_perm_view_orders">
                        <span>View account orders</span>
                    </label>
                    <label class="b2b-checkbox">
                        <input type="checkbox" name="perm_view_offers" id="b2b_perm_view_offers">
                        <span>View offers</span>
                    </label>
                    <label class="b2b-checkbox">
                        <input type="checkbox" name="perm_view_conversations" id="b2b_perm_view_conversations">
                        <span>View conversations</span>
                    </label>
                    <label class="b2b-checkbox">
                        <input type="checkbox" name="perm_view_lists" id="b2b_perm_view_lists">
                        <span>View purchase lists</span>
                    </label>
                    <label class="b2b-checkbox">
                        <input type="checkbox" name="perm_view_subscriptions" id="b2b_perm_view_subscriptions">
                        <span>View subscriptions</span>
                    </label>
                </div>
                <p class="field-hint">These permissions are applied to all new subaccounts in this import.</p>
            </div>

            <div class="b2b-field-group">
                <label class="b2b-checkbox b2b-checkbox-standalone">
                    <input type="checkbox" id="b2b_send_welcome">
                    <span>Send welcome email (WordPress &quot;Set your password&quot; email)</span>
                </label>
                <p class="field-hint">If unchecked, users must log in via &quot;Lost your password?&quot;.</p>
            </div>

            <div class="b2b-field-group">
                <label class="b2b-checkbox b2b-checkbox-standalone">
                    <input type="checkbox" id="b2b_clear_billing">
                    <span>Clear copied billing and shipping data</span>
                </label>
                <p class="field-hint">Precautionary fallback. Since the b2bking_after_subaccount_created hook is not fired during import, no billing data is normally copied. Enable this only if you suspect other plugins or hooks copy address data.</p>
            </div>

            <div class="b2b-field-group">
                <label class="b2b-checkbox b2b-checkbox-standalone">
                    <input type="checkbox" id="b2b_hide_prices">
                    <span>Hide prices and shipping for imported subaccounts</span>
                </label>
                <p class="field-hint">Sets the <code>hide_prices_and_shipping</code> user meta to <code>1</code>. Requires the &quot;Hide Prices&quot; code snippet to be active for this to have any effect.</p>
            </div>

            <div class="b2b-field-group">
                <div class="b2b-btn-group">
                    <button id="b2b_preview_btn" type="button" class="button button-secondary button-hero">
                        Preview
                        <span class="spinner"></span>
                    </button>
                    <button id="b2b_import_btn" type="button" class="button button-primary button-hero" disabled>
                        Import subaccounts
                        <span class="spinner"></span>
                    </button>
                </div>
            </div>

            <?php if ( $is_multisite ) : ?>
            <div class="b2b-info-box amber">
                <strong>Multisite:</strong> Email addresses found in the network but not on this site
                are marked with a warning. Add them manually via <em>Users &rarr; Add Existing</em>
                before running the import again.
            </div>
            <?php endif; ?>
        </div>

        <div id="b2b_preview_results" class="b2b-results" style="display:none;"></div>
        <div id="b2b_import_results" class="b2b-results" style="display:none;"></div>
    </div>

    <script>
    jQuery(function($) {
        var nonce = <?php echo wp_json_encode( $nonce ); ?>;
        var previewDone = false;

        /**
         * HTML escape for XSS protection during DOM rendering.
         * All data from the server is sent as plain text (no esc_html in PHP).
         * This function is the ONLY escaping layer — all data
         * inserted via .html() MUST pass through esc() first.
         */
        function esc(str) {
            if (typeof str !== 'string') return String(str);
            var div = document.createElement('div');
            div.appendChild(document.createTextNode(str));
            return div.innerHTML;
        }

        // ---- Select2 ----
        $('#b2b_parent_select').select2({
            ajax: {
                url: ajaxurl,
                dataType: 'json',
                delay: 300,
                data: function(params) {
                    return { action: 'b2b_search_parents', nonce: nonce, term: params.term || '' };
                },
                processResults: function(data) { return data; },
                cache: true
            },
            minimumInputLength: 1,
            placeholder: 'Search by name, email or company…',
            allowClear: true,
            language: {
                inputTooShort: function() { return 'Type at least 1 character…'; },
                noResults: function() { return 'No results'; },
                searching: function() { return 'Searching…'; }
            }
        });

        // Invalidate preview on changes
        $('#b2b_parent_select').on('change', function() { invalidatePreview(); });
        $('#b2b_emails').on('input', function() {
            invalidatePreview();
            var lines = $(this).val().split(/[\r\n,;]+/).filter(function(l) { return l.trim().length > 0; });
            $('#b2b_email_count').text(lines.length + (lines.length !== 1 ? ' email addresses' : ' email address'));
        });
        // Permission changes also invalidate preview
        $('.b2b-permissions-grid input, #b2b_send_welcome, #b2b_clear_billing, #b2b_hide_prices').on('change', function() { invalidatePreview(); });

        function invalidatePreview() {
            previewDone = false;
            $('#b2b_import_btn').prop('disabled', true);
            $('#b2b_preview_results').hide().empty();
            $('#b2b_import_results').hide().empty();
        }

        // Collect permissions from checkboxes
        function getPermissions() {
            return {
                'b2bking_account_permission_buy':                $('input[name="perm_buy"]').is(':checked') ? 1 : 0,
                'b2bking_account_permission_buy_approval':       $('input[name="perm_buy_approval"]').is(':checked') ? 1 : 0,
                'b2bking_account_permission_view_orders':        $('input[name="perm_view_orders"]').is(':checked') ? 1 : 0,
                'b2bking_account_permission_view_offers':        $('input[name="perm_view_offers"]').is(':checked') ? 1 : 0,
                'b2bking_account_permission_view_conversations': $('input[name="perm_view_conversations"]').is(':checked') ? 1 : 0,
                'b2bking_account_permission_view_lists':         $('input[name="perm_view_lists"]').is(':checked') ? 1 : 0,
                'b2bking_account_permission_view_subscriptions': $('input[name="perm_view_subscriptions"]').is(':checked') ? 1 : 0,
            };
        }

        // ---- PREVIEW ----
        $('#b2b_preview_btn').on('click', function() {
            var btn = $(this);
            var parentId = $('#b2b_parent_select').val();
            var emails = $('#b2b_emails').val().trim();

            if (!parentId) { alert('Select a parent account first.'); return; }
            if (!emails) { alert('Enter at least one email address.'); return; }

            btn.prop('disabled', true).addClass('loading');
            $('#b2b_preview_results').hide().empty();
            $('#b2b_import_results').hide().empty();
            $('#b2b_import_btn').prop('disabled', true);

            $.post(ajaxurl, {
                action: 'b2b_preview_import',
                nonce: nonce,
                parent_id: parentId,
                emails: emails,
                permissions: getPermissions(),
                send_welcome: $('#b2b_send_welcome').is(':checked') ? 1 : 0,
                clear_billing: $('#b2b_clear_billing').is(':checked') ? 1 : 0,
                hide_prices: $('#b2b_hide_prices').is(':checked') ? 1 : 0
            }, function(response) {
                btn.prop('disabled', false).removeClass('loading');

                if (!response.success) {
                    $('#b2b_preview_results').html(
                        '<div class="b2b-result-error">' + esc(response.data || 'Fel') + '</div>'
                    ).show();
                    return;
                }

                var d = response.data;
                var c = d.counts;
                var html = '';

                // Meta-info
                html += '<div class="b2b-preview-meta">';
                html += '<span><strong>Role:</strong> ' + esc(d.parent_role) + '</span>';
                html += '<span><strong>B2BKing group:</strong> ' + esc(d.group_name) + '</span>';
                html += '<span><strong>Email:</strong> ' + (d.send_welcome ? 'Yes' : 'No') + '</span>';
                html += '<span><strong>Clear address:</strong> ' + (d.clear_billing ? 'Yes' : 'No') + '</span>';
                html += '<span><strong>Hide prices:</strong> ' + (d.hide_prices ? 'Yes' : 'No') + '</span>';
                html += '</div>';

                // Permissions summary
                if (d.permissions_summary) {
                    html += '<div class="b2b-preview-meta" style="flex-wrap:wrap;gap:8px 16px">';
                    html += '<strong>Permissions:</strong> ';
                    html += esc(d.permissions_summary);
                    html += '</div>';
                }

                // Summary
                html += '<div class="b2b-result-summary">';
                html += 'Result: ';
                html += '<span style="color:#00a32a">' + esc(c.will_create) + ' to create</span>';
                if (c.exists > 0) html += ' &middot; <span style="color:#d63638">' + esc(c.exists) + ' already exist</span>';
                if (c.network_exists > 0) html += ' &middot; <span style="color:#dba617">' + esc(c.network_exists) + ' network warning</span>';
                if (c.invalid > 0) html += ' &middot; <span style="color:#999">' + esc(c.invalid) + ' invalid</span>';
                html += '</div>';

                // Table
                html += '<table class="b2b-preview-table">';
                html += '<thead><tr><th>Email</th><th>Status</th><th>Detail</th></tr></thead><tbody>';

                d.items.forEach(function(item) {
                    var dot = 'gray', label = 'Invalid';
                    if (item.status === 'will_create') { dot = 'green'; label = 'Will create'; }
                    else if (item.status === 'exists') { dot = 'red'; label = 'Already exists'; }
                    else if (item.status === 'network_exists') { dot = 'amber'; label = 'Network account'; }

                    html += '<tr>';
                    html += '<td><code>' + esc(item.email) + '</code></td>';
                    html += '<td><span class="b2b-status-dot ' + esc(dot) + '"></span>' + esc(label) + '</td>';
                    html += '<td>' + esc(item.note) + '</td>';
                    html += '</tr>';
                });

                html += '</tbody></table>';

                if (c.will_create > 0) {
                    html += '<p style="font-size:13px;color:#646970;">Click <strong>Import subaccounts</strong> to create the green rows.</p>';
                } else {
                    html += '<div class="b2b-result-info">No new accounts to create. Fix warnings/errors and preview again.</div>';
                }

                $('#b2b_preview_results').html(html).show();
                $('html, body').animate({ scrollTop: $('#b2b_preview_results').offset().top - 40 }, 300);

                if (c.will_create > 0) {
                    previewDone = true;
                    $('#b2b_import_btn').prop('disabled', false);
                }
            }).fail(function() {
                btn.prop('disabled', false).removeClass('loading');
                alert('Network error.');
            });
        });

        // ---- IMPORT ----
        $('#b2b_import_btn').on('click', function() {
            if (!previewDone) { alert('Run preview first.'); return; }

            var btn = $(this);
            var parentId = $('#b2b_parent_select').val();
            var emails = $('#b2b_emails').val().trim();

            if (!confirm('Import subaccounts now? This action cannot be undone.')) return;

            btn.prop('disabled', true).addClass('loading');
            $('#b2b_import_results').hide().empty();

            $.post(ajaxurl, {
                action: 'b2b_import_subaccounts',
                nonce: nonce,
                parent_id: parentId,
                emails: emails,
                permissions: getPermissions(),
                send_welcome: $('#b2b_send_welcome').is(':checked') ? 1 : 0,
                clear_billing: $('#b2b_clear_billing').is(':checked') ? 1 : 0,
                hide_prices: $('#b2b_hide_prices').is(':checked') ? 1 : 0
            }, function(response) {
                btn.prop('disabled', false).removeClass('loading');
                previewDone = false;
                btn.prop('disabled', true);

                var html = '';

                if (response.success) {
                    var data = response.data;
                    html += '<div class="b2b-result-summary">' + esc(data.summary) + '</div>';

                    if (data.created.length) {
                        html += '<h3>&#x2705; Created subaccounts</h3>';
                        data.created.forEach(function(item) {
                            html += '<div class="b2b-result-success">';
                            html += '<strong>' + esc(item.email) + '</strong> &rarr; Username: <code>' + esc(item.username) + '</code> (ID: ' + esc(item.user_id) + ')';
                            html += '</div>';
                        });
                    }

                    if (data.warnings && data.warnings.length) {
                        html += '<h3>&#x26A0;&#xFE0F; Network warnings</h3>';
                        data.warnings.forEach(function(item) {
                            html += '<div class="b2b-result-warning">';
                            html += '<strong>' + esc(item.email) + '</strong> &mdash; ' + esc(item.message);
                            html += '</div>';
                        });
                    }

                    if (data.errors.length) {
                        html += '<h3>&#x274C; Errors</h3>';
                        data.errors.forEach(function(item) {
                            html += '<div class="b2b-result-error">';
                            html += '<strong>' + esc(item.email) + '</strong> &mdash; ' + esc(item.message);
                            html += '</div>';
                        });
                    }

                    if (data.errors.length === 0 && (!data.warnings || data.warnings.length === 0)) {
                        $('#b2b_emails').val('');
                        $('#b2b_email_count').text('0 email addresses');
                        $('#b2b_preview_results').hide();
                    }
                } else {
                    html += '<div class="b2b-result-error">' + esc(response.data || 'Unknown error') + '</div>';
                }

                $('#b2b_import_results').html(html).show();
                $('html, body').animate({ scrollTop: $('#b2b_import_results').offset().top - 40 }, 300);
            }).fail(function() {
                btn.prop('disabled', false).removeClass('loading');
                alert('Network error.');
            });
        });
    });
    </script>
    <?php
}