<?php

/**
 * Vulnerability alert email template.
 *
 * $data keys:
 * - site_name, site_url, label
 * - count (int)              Number of new vulnerabilities.
 * - severity (string)        Highest severity across the batch.
 * - vulnerabilities (array)  Items with plugin_name, cve_id, severity.
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

$securwp_severity = $data['severity'] ?? 'medium';
$securwp_alert_class = in_array( $securwp_severity, [ 'high', 'critical' ], true ) ? 'alert' : 'alert-warn';
$securwp_vulns = isset( $data['vulnerabilities'] ) && is_array( $data['vulnerabilities'] ) ? $data['vulnerabilities'] : [];
$securwp_count = isset( $data['count'] ) ? (int) $data['count'] : count( $securwp_vulns );
?>
<h1><?php echo $securwp_count > 1 ? esc_html( sprintf( '%d Vulnerabilities Found', $securwp_count ) ) : 'Vulnerability Found'; ?></h1>

<div class="<?php echo esc_attr( $securwp_alert_class ); ?>">
    <?php if ( $securwp_count > 1 ) : ?>
        <strong><?php echo esc_html( $securwp_count ); ?> known vulnerabilities</strong>
        affect components on <?php echo esc_html( $data['site_name'] ?? '' ); ?>.
        Highest severity: <?php echo esc_html( ucfirst( $securwp_severity ) ); ?>.
    <?php else : ?>
        <strong>A known vulnerability</strong> affects a component on <?php echo esc_html( $data['site_name'] ?? '' ); ?>.
    <?php endif; ?>
</div>

<div class="detail-box">
    <strong>Site:</strong> <?php echo esc_html( $data['site_url'] ?? '' ); ?>
</div>

<?php if ( ! empty( $securwp_vulns ) ) : ?>
<table cellpadding="6" cellspacing="0" style="border-collapse:collapse;width:100%;margin-top:12px;">
    <thead>
        <tr style="background:#f3f4f6;text-align:left;">
            <th>Component</th>
            <th>CVE</th>
            <th>Severity</th>
        </tr>
    </thead>
    <tbody>
        <?php foreach ( $securwp_vulns as $securwp_vuln ) : ?>
        <tr style="border-top:1px solid #e5e7eb;">
            <td><?php echo esc_html( (string) ( $securwp_vuln['plugin_name'] ?? 'Unknown' ) ); ?></td>
            <td><?php echo esc_html( (string) ( $securwp_vuln['cve_id'] ?? '' ) ); ?></td>
            <td><?php echo esc_html( ucfirst( (string) ( $securwp_vuln['severity'] ?? 'medium' ) ) ); ?></td>
        </tr>
        <?php endforeach; ?>
    </tbody>
</table>
<?php endif; ?>

<p>
    Check if updates are available for the affected components. If no patch exists yet,
    consider deactivating them until a fix is released.
</p>
