class-backupflow-admin.php

<?php
/**
 * Admin UI and actions.
 *
 * @package BackupFlow
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class BackupFlow_Admin {
	private $backup_manager;
	private $restore_manager;
	private $jobs;
	private $storage;
	private $migrator;
	private $preflight;

	public function __construct( BackupFlow_Backup_Manager $backup_manager, BackupFlow_Restore_Manager $restore_manager, BackupFlow_Job_Store $jobs, BackupFlow_Storage $storage, BackupFlow_Migrator $migrator, BackupFlow_Preflight $preflight ) {
		$this->backup_manager  = $backup_manager;
		$this->restore_manager = $restore_manager;
		$this->jobs            = $jobs;
		$this->storage         = $storage;
		$this->migrator        = $migrator;
		$this->preflight       = $preflight;

		add_action( 'admin_menu', array( $this, 'admin_menu' ) );
		add_action( 'admin_enqueue_scripts', array( $this, 'enqueue' ) );
		add_action( 'admin_init', array( $this, 'activation_redirect' ) );
		add_action( 'admin_init', array( $this, 'maybe_handle_google_return' ) );
		add_filter( 'plugin_action_links_' . BACKUPFLOW_BASENAME, array( $this, 'plugin_action_links' ) );

		add_action( 'wp_ajax_backupflow_start_backup', array( $this, 'ajax_start_backup' ) );
		add_action( 'wp_ajax_backupflow_preflight', array( $this, 'ajax_preflight' ) );
		add_action( 'wp_ajax_backupflow_process_job', array( $this, 'ajax_process_job' ) );
		add_action( 'wp_ajax_backupflow_get_job', array( $this, 'ajax_get_job' ) );
		add_action( 'wp_ajax_backupflow_resume_job', array( $this, 'ajax_resume_job' ) );
		add_action( 'wp_ajax_backupflow_start_restore', array( $this, 'ajax_start_restore' ) );
		add_action( 'wp_ajax_backupflow_start_import', array( $this, 'ajax_start_import' ) );
		add_action( 'wp_ajax_backupflow_upload_chunk', array( $this, 'ajax_upload_chunk' ) );
		add_action( 'wp_ajax_backupflow_complete_import', array( $this, 'ajax_complete_import' ) );
		add_action( 'wp_ajax_backupflow_cancel_import', array( $this, 'ajax_cancel_import' ) );
		add_action( 'wp_ajax_backupflow_cancel_job', array( $this, 'ajax_cancel_job' ) );
		add_action( 'wp_ajax_backupflow_delete_backup', array( $this, 'ajax_delete_backup' ) );

		add_action( 'admin_post_backupflow_download_backup', array( $this, 'download_backup' ) );
		add_action( 'admin_post_backupflow_save_settings', array( $this, 'save_settings' ) );
	}

	public function admin_menu() {
		add_menu_page(
			__( 'BackupFlow', 'backupflow' ),
			__( 'BackupFlow', 'backupflow' ),
			'manage_options',
			'backupflow',
			array( $this, 'render_dashboard' ),
			'dashicons-cloud-upload',
			58
		);

		add_submenu_page( 'backupflow', __( 'Dashboard', 'backupflow' ), __( 'Dashboard', 'backupflow' ), 'manage_options', 'backupflow', array( $this, 'render_dashboard' ) );
		add_submenu_page( 'backupflow', __( 'Create Backup', 'backupflow' ), __( 'Create Backup', 'backupflow' ), 'manage_options', 'backupflow-create', array( $this, 'render_create' ) );
		add_submenu_page( 'backupflow', __( 'Backups', 'backupflow' ), __( 'Backups', 'backupflow' ), 'manage_options', 'backupflow-backups', array( $this, 'render_backups' ) );
		add_submenu_page( 'backupflow', __( 'Restore & Migrate', 'backupflow' ), __( 'Restore & Migrate', 'backupflow' ), 'manage_options', 'backupflow-restore', array( $this, 'render_restore' ) );
		add_submenu_page( 'backupflow', __( 'Storage', 'backupflow' ), __( 'Storage', 'backupflow' ), 'manage_options', 'backupflow-storage', array( $this, 'render_storage' ) );
		add_submenu_page( 'backupflow', __( 'Settings', 'backupflow' ), __( 'Settings', 'backupflow' ), 'manage_options', 'backupflow-settings', array( $this, 'render_settings' ) );
		add_submenu_page( 'backupflow', __( 'Add-ons', 'backupflow' ), __( 'Add-ons', 'backupflow' ), 'manage_options', 'backupflow-addons', array( $this, 'render_addons' ) );
		add_submenu_page( null, __( 'BackupFlow Wizard', 'backupflow' ), __( 'BackupFlow Wizard', 'backupflow' ), 'manage_options', 'backupflow-wizard', array( $this, 'render_wizard' ) );
	}

	public function enqueue( $hook ) {
		$page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( 0 !== strpos( $page, 'backupflow' ) ) {
			return;
		}

		wp_enqueue_style( 'backupflow-admin', BACKUPFLOW_URL . 'assets/css/admin.css', array(), BACKUPFLOW_VERSION );
		wp_enqueue_script( 'backupflow-admin', BACKUPFLOW_URL . 'assets/js/admin.js', array( 'jquery' ), BACKUPFLOW_VERSION, true );
		wp_localize_script(
			'backupflow-admin',
			'BackupFlowAdmin',
			array(
				'ajaxUrl' => admin_url( 'admin-ajax.php' ),
				'nonce'   => wp_create_nonce( 'backupflow_admin' ),
				'dashboardUrl' => admin_url( 'admin.php?page=backupflow' ),
				'strings' => array(
					'working'        => __( 'Working...', 'backupflow' ),
					'complete'       => __( 'Complete', 'backupflow' ),
					'failed'         => __( 'Failed', 'backupflow' ),
					'cancel'         => __( 'Cancel', 'backupflow' ),
					'close'          => __( 'Close', 'backupflow' ),
					'downloadBackup' => __( 'Download Backup', 'backupflow' ),
					'backDashboard'  => __( 'Back to Dashboard', 'backupflow' ),
					'cancelled'      => __( 'Cancelled', 'backupflow' ),
					'cancelConfirm'  => __( 'Are you sure you want to cancel the process?', 'backupflow' ),
					'chooseBackup'   => __( 'Choose a backup ZIP first.', 'backupflow' ),
					'uploading'      => __( 'Uploading backup', 'backupflow' ),
					'uploadComplete' => __( 'Backup uploaded. Starting restore...', 'backupflow' ),
					'uploadStored'   => __( 'Backup uploaded and added to Restore Points.', 'backupflow' ),
					'uploadSessionReady' => __( 'Upload session ready.', 'backupflow' ),
					'uploadFailed'   => __( 'Backup upload failed. Choose a valid BackupFlow ZIP and try again.', 'backupflow' ),
					'processFailed'  => __( 'BackupFlow could not finish this process. Please try again.', 'backupflow' ),
					'backupFailed'   => __( 'BackupFlow could not start the backup. Please try again.', 'backupflow' ),
					'restoreFailed'  => __( 'BackupFlow could not start the restore. Please try again.', 'backupflow' ),
					'preflightFailed'=> __( 'BackupFlow needs attention before this job can run.', 'backupflow' ),
					'preflightReady' => __( 'BackupFlow is ready.', 'backupflow' ),
					'importPreparing'=> __( 'Preparing secure upload', 'backupflow' ),
					'restoreConfirm' => __( 'This restore can replace site files or database data. Continue?', 'backupflow' ),
					'deleteConfirm'  => __( 'Delete this backup permanently?', 'backupflow' ),
					'selectBackupParts' => __( 'Select files, database, or both before creating a backup.', 'backupflow' ),
					'uploadRetrying' => __( 'Upload paused. Retrying this chunk...', 'backupflow' ),
					'uploadedChunk'  => __( 'Uploaded chunk %d.', 'backupflow' ),
					'backupAddedRestorePoints' => __( 'Backup added to Restore Points.', 'backupflow' ),
					'checkingUploadReadiness' => __( 'Checking server readiness for upload.', 'backupflow' ),
					'uploadingChunkSize' => __( 'Uploading in chunks up to %s.', 'backupflow' ),
					'searchBackups' => __( 'Search backups', 'backupflow' ),
					'tablePage'     => __( 'Page %1$d of %2$d', 'backupflow' ),
					'backupInProgress' => __( 'Backup in progress', 'backupflow' ),
					'restoreInProgress' => __( 'Restore in progress', 'backupflow' ),
					'uploadSpeed' => __( 'Uploaded %1$s of %2$s at %3$s/s.', 'backupflow' ),
					'tableItem' => __( '%d item', 'backupflow' ),
					'tableItems' => __( '%d items', 'backupflow' ),
					'checkingRestoreReadiness' => __( 'Checking restore readiness', 'backupflow' ),
				),
			)
		);
	}

	public function activation_redirect() {
		if ( ! get_transient( 'backupflow_activation_redirect' ) || wp_doing_ajax() ) {
			return;
		}

		delete_transient( 'backupflow_activation_redirect' );

		if ( ! backupflow_user_can_manage() || isset( $_GET['activate-multi'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			return;
		}

		wp_safe_redirect( admin_url( 'admin.php?page=backupflow-wizard' ) );
		exit;
	}

	public function maybe_handle_google_return() {
		if ( ! backupflow_user_can_manage() ) {
			return;
		}

		$page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$code = isset( $_GET['code'] ) ? sanitize_text_field( wp_unslash( $_GET['code'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( 'backupflow-storage' !== $page || ! $code ) {
			return;
		}

		$state = isset( $_GET['state'] ) ? sanitize_text_field( wp_unslash( $_GET['state'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( ! wp_verify_nonce( $state, 'backupflow_google_oauth' ) ) {
			wp_safe_redirect( add_query_arg( array( 'page' => 'backupflow-storage', 'backupflow_notice' => 'google_state_failed' ), admin_url( 'admin.php' ) ) );
			exit;
		}

		try {
			$settings = backupflow_get_settings();
			$adapter  = new BackupFlow_Storage_Google_Drive( $settings['google_drive'] );
			$token    = $adapter->exchange_code( $code, admin_url( 'admin.php?page=backupflow-storage' ) );
			$settings['google_drive']['refresh_token'] = backupflow_encrypt_secret( $token );
			backupflow_update_settings( $settings );
			wp_safe_redirect( add_query_arg( array( 'page' => 'backupflow-storage', 'backupflow_notice' => 'google_connected' ), admin_url( 'admin.php' ) ) );
		} catch ( Throwable $e ) {
			wp_safe_redirect( add_query_arg( array( 'page' => 'backupflow-storage', 'backupflow_notice' => 'google_failed' ), admin_url( 'admin.php' ) ) );
		}
		exit;
	}

	public function plugin_action_links( $links ) {
		$links[] = '<a href="' . esc_url( admin_url( 'admin.php?page=backupflow-wizard' ) ) . '">' . esc_html__( 'Create Backup', 'backupflow' ) . '</a>';
		$links[] = '<a href="' . esc_url( admin_url( 'admin.php?page=backupflow-settings' ) ) . '">' . esc_html__( 'Settings', 'backupflow' ) . '</a>';
		return $links;
	}

	public function ajax_preflight() {
		backupflow_verify_ajax();

		$context = backupflow_post_key( 'context', 'backup' );
		$result  = $this->preflight->check(
			$context,
			array(
				'destination' => backupflow_post_key( 'destination', 'local' ),
				'expected_size' => backupflow_post_int( 'file_size', 0 ),
				'backup_type' => backupflow_post_key( 'backup_type', 'full' ),
			)
		);

		backupflow_json_success( array( 'preflight' => $result ) );
	}

	public function ajax_start_backup() {
		backupflow_verify_ajax();
		$destination = backupflow_post_key( 'destination', 'local' );
		$backup_type = backupflow_post_key( 'backup_type', 'full' );
		$preflight   = $this->preflight->check(
			'backup',
			array(
				'destination' => $destination,
				'backup_type' => $backup_type,
			)
		);
		if ( empty( $preflight['ready'] ) ) {
			backupflow_json_error( $preflight['message'], array( 'preflight' => $preflight ), 409 );
		}

		$job = $this->backup_manager->start(
			array(
				'backup_type' => $backup_type,
				'destination' => $destination,
			)
		);

		backupflow_json_success( array( 'job' => $job ) );
	}

	public function ajax_process_job() {
		backupflow_verify_ajax();
		$job_id = backupflow_post_key( 'job_id' );
		$job    = $this->jobs->get( $job_id );
		if ( ! $job ) {
			backupflow_json_error( __( 'Job not found.', 'backupflow' ), array(), 404 );
		}

		$job = 'restore' === $job['type'] ? $this->restore_manager->process( $job_id ) : $this->backup_manager->process( $job_id );
		$job = $this->prepare_job_response( $job );
		backupflow_json_success( array( 'job' => $job ) );
	}

	public function ajax_get_job() {
		backupflow_verify_ajax();
		$job_id = backupflow_post_key( 'job_id' );
		$job    = $this->jobs->get( $job_id );
		if ( ! $job ) {
			backupflow_json_error( __( 'Job not found.', 'backupflow' ), array(), 404 );
		}

		backupflow_json_success( array( 'job' => $job ) );
	}

	public function ajax_resume_job() {
		backupflow_verify_ajax();
		$job_id = backupflow_post_key( 'job_id' );
		$job    = $this->jobs->get( $job_id );
		if ( ! $job ) {
			backupflow_json_error( __( 'Job not found.', 'backupflow' ), array(), 404 );
		}

		if ( in_array( $job['status'], array( 'complete', 'failed', 'cancelled' ), true ) ) {
			backupflow_json_success( array( 'job' => $this->prepare_job_response( $job ) ) );
		}

		$job = 'restore' === $job['type'] ? $this->restore_manager->process( $job_id ) : $this->backup_manager->process( $job_id );
		backupflow_json_success( array( 'job' => $this->prepare_job_response( $job ) ) );
	}

	public function ajax_start_restore() {
		backupflow_verify_ajax();
		$backup_id     = backupflow_post_key( 'backup_id' );
		$restore_mode  = backupflow_post_key( 'restore_mode', 'full' );
		$record        = backupflow_get_backup_record( $backup_id );
		$preflight     = $this->preflight->check( 'restore', array( 'expected_size' => $record && ! empty( $record['size'] ) ? (int) $record['size'] : 0 ) );
		if ( empty( $preflight['ready'] ) ) {
			backupflow_json_error( $preflight['message'], array( 'preflight' => $preflight ), 409 );
		}

		try {
			$job = $this->restore_manager->start( $backup_id, $restore_mode );
			backupflow_json_success( array( 'job' => $job ) );
		} catch ( Throwable $e ) {
			backupflow_json_error( $e->getMessage() );
		}
	}

	public function ajax_start_import() {
		backupflow_verify_ajax();

		$name = backupflow_post_text( 'file_name', 'backupflow-import.zip' );
		$size = backupflow_post_int( 'file_size', 0 );
		$preflight = $this->preflight->check( 'import', array( 'expected_size' => $size ) );
		if ( empty( $preflight['ready'] ) ) {
			backupflow_json_error( $preflight['message'], array( 'preflight' => $preflight ), 409 );
		}
		if ( ! preg_match( '/\.zip$/i', $name ) ) {
			backupflow_json_error( __( 'Choose a BackupFlow ZIP file.', 'backupflow' ) );
		}

		backupflow_ensure_storage_dirs();
		$import_id = backupflow_generate_id( 'import' );
		$target    = trailingslashit( backupflow_imports_dir() ) . $import_id . '-' . sanitize_file_name( $name );
		$state     = array(
			'import_id'   => $import_id,
			'name'        => sanitize_file_name( $name ),
			'size'        => max( 0, (int) $size ),
			'received'    => 0,
			'chunk_index' => 0,
			'target'      => $target,
			'created_at'  => current_time( 'mysql' ),
		);

		backupflow_write_json_file( backupflow_import_state_path( $import_id ), $state );
		backupflow_json_success(
			array(
				'import_id'  => $import_id,
				'chunk_size' => backupflow_upload_chunk_size( $size ),
				'received'   => 0,
			)
		);
	}

	public function ajax_upload_chunk() {
		backupflow_verify_ajax();

		$import_id = backupflow_post_key( 'import_id' );
		$index     = backupflow_post_int( 'chunk_index', 0 );
		$state     = backupflow_read_json_file( backupflow_import_state_path( $import_id ), array() );
		if ( ! $state || empty( $state['target'] ) || ! backupflow_path_is_inside( $state['target'], backupflow_imports_dir() ) ) {
			backupflow_json_error( __( 'Upload session not found. Choose the backup file again.', 'backupflow' ), array(), 404 );
		}

		if ( $index !== (int) $state['chunk_index'] ) {
			backupflow_json_error(
				__( 'Backup upload is out of sequence. Resume the upload and try again.', 'backupflow' ),
				array(
					'received'    => (int) $state['received'],
					'chunk_index' => (int) $state['chunk_index'],
				),
				409
			);
		}

		$file = backupflow_uploaded_file( 'chunk' );
		if ( UPLOAD_ERR_OK !== (int) $file['error'] || empty( $file['tmp_name'] ) || ! is_uploaded_file( $file['tmp_name'] ) ) {
			backupflow_json_error( __( 'Could not read this upload chunk. Please retry.', 'backupflow' ) );
		}

		$in = fopen( $file['tmp_name'], 'rb' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
		$out = fopen( $state['target'], 'ab' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
		if ( ! $in || ! $out ) {
			if ( $in ) {
				fclose( $in ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
			}
			if ( $out ) {
				fclose( $out ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
			}
			backupflow_json_error( __( 'BackupFlow could not write the uploaded backup chunk.', 'backupflow' ) );
		}

		$written = stream_copy_to_stream( $in, $out );
		fclose( $in ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
		fclose( $out ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
		wp_delete_file( $file['tmp_name'] );

		$state['received'] = (int) $state['received'] + (int) $written;
		$state['chunk_index'] = (int) $state['chunk_index'] + 1;
		backupflow_write_json_file( backupflow_import_state_path( $import_id ), $state );

		backupflow_json_success(
			array(
				'import_id'    => $import_id,
				'received'     => (int) $state['received'],
				'chunk_index'  => (int) $state['chunk_index'],
				'progress'     => ! empty( $state['size'] ) ? min( 100, (int) floor( ( $state['received'] / $state['size'] ) * 100 ) ) : 0,
			)
		);
	}

	public function ajax_complete_import() {
		backupflow_verify_ajax();

		$import_id = backupflow_post_key( 'import_id' );
		$state     = backupflow_read_json_file( backupflow_import_state_path( $import_id ), array() );
		if ( ! $state || empty( $state['target'] ) || ! backupflow_path_is_inside( $state['target'], backupflow_imports_dir() ) ) {
			backupflow_json_error( __( 'Upload session not found. Choose the backup file again.', 'backupflow' ), array(), 404 );
		}

		if ( ! file_exists( $state['target'] ) || ( ! empty( $state['size'] ) && filesize( $state['target'] ) < (int) $state['size'] ) ) {
			backupflow_json_error( __( 'Backup upload is incomplete. Please retry the upload.', 'backupflow' ) );
		}

		try {
			$record = $this->migrator->import_local_backup( $state['target'], $state['name'] );
			if ( ! empty( $record['id'] ) ) {
				$record['download_url'] = $this->download_url( $record['id'] );
			}
			wp_delete_file( $state['target'] );
			wp_delete_file( backupflow_import_state_path( $import_id ) );
			backupflow_json_success( array( 'backup' => $record ) );
		} catch ( Throwable $e ) {
			backupflow_json_error( $e->getMessage() );
		}
	}

	public function ajax_cancel_import() {
		backupflow_verify_ajax();

		$import_id = backupflow_post_key( 'import_id' );
		$state     = backupflow_read_json_file( backupflow_import_state_path( $import_id ), array() );
		if ( $state && ! empty( $state['target'] ) && backupflow_path_is_inside( $state['target'], backupflow_imports_dir() ) && file_exists( $state['target'] ) ) {
			wp_delete_file( $state['target'] );
		}
		wp_delete_file( backupflow_import_state_path( $import_id ) );

		backupflow_json_success( array( 'import_id' => $import_id ) );
	}

	public function ajax_cancel_job() {
		backupflow_verify_ajax();
		$job_id = backupflow_post_key( 'job_id' );
		$job    = $this->jobs->cancel( $job_id );

		if ( ! $job ) {
			backupflow_json_error( __( 'Job not found.', 'backupflow' ), array(), 404 );
		}

		if ( isset( $job['type'] ) && 'restore' === $job['type'] && class_exists( 'BackupFlow_Restore_Manager' ) ) {
			delete_transient( BackupFlow_Restore_Manager::ACTIVE_LOCK );
		}

		backupflow_json_success( array( 'job' => $job ) );
	}

	public function ajax_delete_backup() {
		backupflow_verify_ajax();
		$backup_id = backupflow_post_key( 'backup_id' );
		$record    = backupflow_get_backup_record( $backup_id );
		if ( $record && ! empty( $record['path'] ) && file_exists( $record['path'] ) && backupflow_path_is_inside( $record['path'], backupflow_backups_dir() ) ) {
			wp_delete_file( $record['path'] );
		}
		backupflow_delete_backup_record( $backup_id );
		backupflow_json_success( array( 'backup_id' => $backup_id ) );
	}

	public function download_backup() {
		if ( ! backupflow_user_can_manage() ) {
			wp_die( esc_html__( 'Permission denied.', 'backupflow' ) );
		}

		$backup_id = isset( $_GET['backup_id'] ) ? sanitize_key( wp_unslash( $_GET['backup_id'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce action is scoped to the requested backup ID and verified on the next line.
		check_admin_referer( 'backupflow_download_backup_' . $backup_id );

		$record = backupflow_get_backup_record( $backup_id );
		if ( ! $record || empty( $record['path'] ) || ! file_exists( $record['path'] ) || ! backupflow_path_is_inside( $record['path'], backupflow_backups_dir() ) ) {
			wp_die( esc_html__( 'Backup file not found.', 'backupflow' ) );
		}

		$size  = filesize( $record['path'] );
		$start = 0;
		$end   = $size - 1;
		$code  = 200;
		if ( ! empty( $_SERVER['HTTP_RANGE'] ) && preg_match( '/bytes=(\d*)-(\d*)/', sanitize_text_field( wp_unslash( $_SERVER['HTTP_RANGE'] ) ), $matches ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
			$code  = 206;
			$start = '' !== $matches[1] ? (int) $matches[1] : 0;
			$end   = '' !== $matches[2] ? (int) $matches[2] : $end;
			$start = max( 0, min( $start, $size - 1 ) );
			$end   = max( $start, min( $end, $size - 1 ) );
		}

		nocache_headers();
		status_header( $code );
		header( 'Content-Type: application/zip' );
		header( 'Accept-Ranges: bytes' );
		header( 'Content-Disposition: attachment; filename="' . basename( $record['path'] ) . '"' );
		if ( 206 === $code ) {
			header( 'Content-Range: bytes ' . $start . '-' . $end . '/' . $size );
		}
		header( 'Content-Length: ' . ( $end - $start + 1 ) );

		$handle = fopen( $record['path'], 'rb' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen
		if ( $handle ) {
			fseek( $handle, $start );
			$remaining = $end - $start + 1;
			while ( $remaining > 0 && ! feof( $handle ) ) {
				$chunk = fread( $handle, min( 1024 * 1024, $remaining ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fread
				if ( false === $chunk ) {
					break;
				}
				echo $chunk; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Binary download stream.
				$remaining -= strlen( $chunk );
				flush();
			}
			fclose( $handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose
		}
		exit;
	}

	public function save_settings() {
		if ( ! backupflow_user_can_manage() ) {
			wp_die( esc_html__( 'Permission denied.', 'backupflow' ) );
		}

		check_admin_referer( 'backupflow_save_settings' );

		$settings = backupflow_get_settings();
		$section  = backupflow_post_key( 'backupflow_section', 'general' );

		if ( 'general' === $section ) {
			$settings['retention_count'] = max( 1, backupflow_post_int( 'retention_count', 8 ) );
			$settings['exclude_paths']   = backupflow_post_textarea( 'exclude_paths' );
			$settings['skip_wp_config_restore'] = backupflow_post_bool( 'skip_wp_config_restore' );
			$settings['safety_backup_before_restore'] = backupflow_post_bool( 'safety_backup_before_restore' );
		}

		if ( 'ftp' === $section ) {
			$settings['ftp']['host']     = backupflow_post_text( 'ftp_host' );
			$settings['ftp']['port']     = max( 1, backupflow_post_int( 'ftp_port', 21 ) );
			$settings['ftp']['username'] = backupflow_post_text( 'ftp_username' );
			$settings['ftp']['path']     = '/' . trim( backupflow_post_text( 'ftp_path', '/backupflow' ), '/' );
			$settings['ftp']['passive']  = backupflow_post_bool( 'ftp_passive' );
			if ( backupflow_post_text( 'ftp_password' ) ) {
				$settings['ftp']['password'] = backupflow_encrypt_secret( backupflow_post_text( 'ftp_password' ) );
			}
		}

		if ( 'google_drive' === $section ) {
			$settings['google_drive']['client_id'] = backupflow_post_text( 'google_client_id' );
			$settings['google_drive']['folder_id'] = backupflow_post_text( 'google_folder_id' );
			if ( backupflow_post_text( 'google_client_secret' ) ) {
				$settings['google_drive']['client_secret'] = backupflow_encrypt_secret( backupflow_post_text( 'google_client_secret' ) );
			}
		}

		backupflow_update_settings( $settings );
		wp_safe_redirect( add_query_arg( array( 'page' => $this->redirect_page_for_section( $section ), 'backupflow_notice' => 'settings_saved' ), admin_url( 'admin.php' ) ) );
		exit;
	}

	public function render_dashboard() {
		$this->render_shell( __( 'Dashboard', 'backupflow' ), array( $this, 'view_dashboard' ) );
	}

	public function render_create() {
		$this->render_shell( __( 'Create Backup', 'backupflow' ), array( $this, 'view_create' ) );
	}

	public function render_wizard() {
		$this->render_shell( __( 'Create Your First Backup', 'backupflow' ), array( $this, 'view_wizard' ), 'wizard' );
	}

	public function render_backups() {
		$this->render_shell( __( 'Backups', 'backupflow' ), array( $this, 'view_backups' ) );
	}

	public function render_restore() {
		$this->render_shell( __( 'Restore & Migrate', 'backupflow' ), array( $this, 'view_restore' ) );
	}

	public function render_storage() {
		$this->render_shell( __( 'Storage', 'backupflow' ), array( $this, 'view_storage' ) );
	}

	public function render_settings() {
		$this->render_shell( __( 'Settings', 'backupflow' ), array( $this, 'view_settings' ) );
	}

	public function render_addons() {
		$this->render_shell( __( 'Premium Roadmap', 'backupflow' ), array( $this, 'view_addons' ) );
	}

	public function render_shell( $title, $callback, $variant = '' ) {
		$classes = 'wrap backupflow-wrap';
		if ( $variant ) {
			$classes .= ' backupflow-' . sanitize_html_class( $variant );
		}
		?>
		<div class="<?php echo esc_attr( $classes ); ?>">
			<?php $this->notices(); ?>
			<header class="backupflow-topbar">
				<div class="backupflow-brand">
					<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/BackupFlow.png' ); ?>" alt="" />
					<div>
						<span><?php esc_html_e( 'BackupFlow', 'backupflow' ); ?></span>
						<strong><?php echo esc_html( $title ); ?></strong>
					</div>
				</div>
				<nav class="backupflow-actions" aria-label="<?php esc_attr_e( 'BackupFlow actions', 'backupflow' ); ?>">
					<a class="backupflow-link" href="<?php echo esc_url( admin_url( 'admin.php?page=backupflow-backups' ) ); ?>"><?php esc_html_e( 'Backups', 'backupflow' ); ?></a>
					<a class="backupflow-button backupflow-button-secondary" href="<?php echo esc_url( admin_url( 'admin.php?page=backupflow-restore' ) ); ?>"><?php esc_html_e( 'Import', 'backupflow' ); ?></a>
					<a class="backupflow-button" href="<?php echo esc_url( admin_url( 'admin.php?page=backupflow-create' ) ); ?>"><?php esc_html_e( 'Create Backup', 'backupflow' ); ?></a>
				</nav>
			</header>
			<div class="backupflow-layout">
				<main class="backupflow-main">
					<?php call_user_func( $callback ); ?>
				</main>
				<?php $this->sidebar(); ?>
			</div>
			<?php $this->job_modal(); ?>
		</div>
		<?php
	}

	public function view_dashboard() {
		$catalog = backupflow_backup_catalog();
		$latest  = $catalog ? reset( $catalog ) : null;
		?>
		<section class="backupflow-hero">
			<div>
				<p class="backupflow-eyebrow"><?php esc_html_e( 'Simple Backup, Restore, Migrate', 'backupflow' ); ?></p>
				<h2><?php esc_html_e( 'Ready to protect this WordPress site?', 'backupflow' ); ?></h2>
				<p><?php esc_html_e( 'Create a complete backup, restore in one click, or import a backup from another domain with URL rewriting handled during restore.', 'backupflow' ); ?></p>
			</div>
			<button class="backupflow-button backupflow-start-backup" data-backup-type="full" data-destination="local"><?php esc_html_e( 'Run Full Backup', 'backupflow' ); ?></button>
		</section>

		<section class="backupflow-metrics" aria-label="<?php esc_attr_e( 'Backup status', 'backupflow' ); ?>">
			<?php $this->metric( __( 'Latest backup', 'backupflow' ), $latest ? esc_html( $latest['created_at'] ) : __( 'Not created yet', 'backupflow' ), $latest ? backupflow_format_bytes( $latest['size'] ) : __( 'Start with the wizard', 'backupflow' ) ); ?>
			<?php $this->metric( __( 'Local storage', 'backupflow' ), backupflow_is_writable_path( backupflow_backups_dir() ) ? __( 'Writable', 'backupflow' ) : __( 'Needs attention', 'backupflow' ), backupflow_backups_dir() ); ?>
			<?php $this->metric( __( 'Migration target', 'backupflow' ), home_url(), __( 'URL rewrite uses this site URL', 'backupflow' ) ); ?>
			<?php $this->metric( __( 'Runtime', 'backupflow' ), 'WP ' . get_bloginfo( 'version' ), 'PHP ' . PHP_VERSION ); ?>
		</section>

		<section class="backupflow-panel">
			<div class="backupflow-section-head">
				<div>
					<h3><?php esc_html_e( 'Recent backups', 'backupflow' ); ?></h3>
					<p><?php esc_html_e( 'Download, restore, or delete ready backups from one place.', 'backupflow' ); ?></p>
				</div>
				<a class="backupflow-link" href="<?php echo esc_url( admin_url( 'admin.php?page=backupflow-backups' ) ); ?>"><?php esc_html_e( 'View all', 'backupflow' ); ?></a>
			</div>
			<?php $this->backup_table( array_slice( $catalog, 0, 5, true ) ); ?>
		</section>
		<?php
	}

	public function view_create() {
		?>
		<section class="backupflow-panel">
			<div class="backupflow-section-head">
				<div>
					<h3><?php esc_html_e( 'Create a backup', 'backupflow' ); ?></h3>
					<p><?php esc_html_e( 'Choose what to include and where BackupFlow should store the archive.', 'backupflow' ); ?></p>
				</div>
			</div>
			<?php $this->backup_builder( false ); ?>
		</section>
		<?php
	}

	public function view_wizard() {
		?>
		<nav class="backupflow-tabs" aria-label="<?php esc_attr_e( 'BackupFlow setup', 'backupflow' ); ?>">
			<a class="is-active" href="<?php echo esc_url( admin_url( 'admin.php?page=backupflow-wizard' ) ); ?>"><?php esc_html_e( 'Create Backup', 'backupflow' ); ?></a>
			<a href="<?php echo esc_url( admin_url( 'admin.php?page=backupflow-restore' ) ); ?>"><?php esc_html_e( 'Import Backup', 'backupflow' ); ?></a>
		</nav>
		<?php $this->backup_builder( true ); ?>
		<?php
	}

	public function view_backups() {
		?>
		<section class="backupflow-panel">
			<div class="backupflow-section-head">
				<div>
					<h3><?php esc_html_e( 'Backup library', 'backupflow' ); ?></h3>
					<p><?php esc_html_e( 'Every local, imported, and cloud-uploaded backup remains restorable from this catalog while the archive exists locally.', 'backupflow' ); ?></p>
				</div>
				<button class="backupflow-button backupflow-start-backup" data-backup-type="full" data-destination="local"><?php esc_html_e( 'Run Full Backup', 'backupflow' ); ?></button>
			</div>
			<?php $this->backup_table( backupflow_backup_catalog() ); ?>
		</section>
		<?php
	}

	public function view_restore() {
		$settings    = backupflow_get_settings();
		$storage_url = admin_url( 'admin.php?page=backupflow-storage' );
		$ftp_ready   = function_exists( 'ftp_connect' ) && ! empty( $settings['ftp']['host'] ) && ! empty( $settings['ftp']['username'] ) && ! empty( $settings['ftp']['password'] );
		$drive_ready = ! empty( $settings['google_drive']['client_id'] ) && ! empty( $settings['google_drive']['client_secret'] ) && ! empty( $settings['google_drive']['refresh_token'] );
		?>
		<section class="backupflow-import-band backupflow-import-workflow">
			<div class="backupflow-source-tabs" role="tablist" aria-label="<?php esc_attr_e( 'Choose restore source', 'backupflow' ); ?>">
				<button class="is-active" data-import-source-tab="local" type="button" role="tab" aria-selected="true"><?php esc_html_e( 'Local', 'backupflow' ); ?></button>
				<button data-import-source-tab="cloud" type="button" role="tab" aria-selected="false"><?php esc_html_e( 'Cloud', 'backupflow' ); ?></button>
			</div>

			<div class="backupflow-import-source is-active" data-import-source-panel="local">
				<div class="backupflow-import-head">
					<p class="backupflow-eyebrow"><?php esc_html_e( 'Restore from file', 'backupflow' ); ?></p>
					<h3><?php esc_html_e( 'Upload a BackupFlow ZIP', 'backupflow' ); ?></h3>
					<p><?php esc_html_e( 'Choose a backup file, then restore the database, files, or the full site. You can also upload the ZIP now and restore it later.', 'backupflow' ); ?></p>
				</div>

				<div class="backupflow-upload-box" data-import-uploader>
					<input id="backupflow-import-file" data-import-file type="file" accept=".zip" />
					<label for="backupflow-import-file">
						<span class="dashicons dashicons-upload" aria-hidden="true"></span>
						<strong><?php esc_html_e( 'Drop your backup ZIP here or choose a file', 'backupflow' ); ?></strong>
						<small><?php esc_html_e( 'BackupFlow uploads the file first and shows live progress before any restore starts.', 'backupflow' ); ?></small>
					</label>
					<div class="backupflow-selected-file" data-selected-file hidden></div>
					<div class="backupflow-restore-choice" data-restore-choice hidden>
						<h4><?php esc_html_e( 'What do you want to restore from this backup?', 'backupflow' ); ?></h4>
						<div class="backupflow-restore-options">
							<button type="button" data-import-restore-mode="database"><img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/database.png' ); ?>" alt="" /><span><?php esc_html_e( 'Database only', 'backupflow' ); ?></span></button>
							<button type="button" data-import-restore-mode="files"><img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/local-server.png' ); ?>" alt="" /><span><?php esc_html_e( 'Files only', 'backupflow' ); ?></span></button>
							<button type="button" data-import-restore-mode="full"><img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/BackupFlow.png' ); ?>" alt="" /><span><?php esc_html_e( 'Full restore', 'backupflow' ); ?></span></button>
						</div>
						<div class="backupflow-upload-only-row">
							<button class="backupflow-button backupflow-button-secondary" type="button" data-import-restore-mode="upload"><?php esc_html_e( 'Upload only', 'backupflow' ); ?></button>
							<small><?php esc_html_e( 'Add this ZIP to Restore Points without restoring it now.', 'backupflow' ); ?></small>
						</div>
					</div>
				</div>
			</div>

			<div class="backupflow-import-source" data-import-source-panel="cloud" hidden>
				<div class="backupflow-import-head">
					<p class="backupflow-eyebrow"><?php esc_html_e( 'Restore from cloud', 'backupflow' ); ?></p>
					<h3><?php esc_html_e( 'Connect a storage account', 'backupflow' ); ?></h3>
					<p><?php esc_html_e( 'Connected storage can be used for cloud backup workflows. Configure a storage account first, then return here to restore from uploaded backups.', 'backupflow' ); ?></p>
				</div>
				<div class="backupflow-cloud-grid">
					<a class="backupflow-cloud-card<?php echo $ftp_ready ? ' is-connected' : ''; ?>" href="<?php echo esc_url( $storage_url ); ?>">
						<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/ftp.png' ); ?>" alt="" />
						<span>
							<strong><?php esc_html_e( 'FTP', 'backupflow' ); ?></strong>
							<small><?php echo esc_html( $ftp_ready ? __( 'Connected and ready to manage.', 'backupflow' ) : __( 'Click to connect FTP storage.', 'backupflow' ) ); ?></small>
						</span>
						<em><?php echo esc_html( $ftp_ready ? __( 'Connected', 'backupflow' ) : __( 'Connect', 'backupflow' ) ); ?></em>
					</a>
					<a class="backupflow-cloud-card<?php echo $drive_ready ? ' is-connected' : ''; ?>" href="<?php echo esc_url( $storage_url ); ?>">
						<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/google-drive.png' ); ?>" alt="" />
						<span>
							<strong><?php esc_html_e( 'Google Drive', 'backupflow' ); ?></strong>
							<small><?php echo esc_html( $drive_ready ? __( 'Connected and ready to manage.', 'backupflow' ) : __( 'Click to connect Google Drive.', 'backupflow' ) ); ?></small>
						</span>
						<em><?php echo esc_html( $drive_ready ? __( 'Connected', 'backupflow' ) : __( 'Connect', 'backupflow' ) ); ?></em>
					</a>
				</div>
			</div>
		</section>
		<section class="backupflow-panel">
			<div class="backupflow-section-head">
				<div>
					<h3><?php esc_html_e( 'Restore points', 'backupflow' ); ?></h3>
					<p><?php esc_html_e( 'Start restore from any compatible backup. A live status window shows file extraction, database import, and URL rewrite progress.', 'backupflow' ); ?></p>
				</div>
			</div>
			<?php $this->backup_table( backupflow_backup_catalog(), true ); ?>
		</section>
		<?php
	}

	public function view_storage() {
		$settings = backupflow_get_settings();
		$google   = new BackupFlow_Storage_Google_Drive( $settings['google_drive'] );
		$google_url = '';
		if ( ! empty( $settings['google_drive']['client_id'] ) && ! empty( $settings['google_drive']['client_secret'] ) ) {
			$google_url = add_query_arg( 'state', wp_create_nonce( 'backupflow_google_oauth' ), $google->auth_url( admin_url( 'admin.php?page=backupflow-storage' ) ) );
		}
		?>
		<section class="backupflow-storage-grid">
			<?php $this->storage_tile( 'local-server.png', __( 'Website Server', 'backupflow' ), __( 'Included', 'backupflow' ), __( 'Store backups locally in protected wp-content storage.', 'backupflow' ) ); ?>
			<?php $this->storage_tile( 'ftp.png', __( 'FTP', 'backupflow' ), __( 'Included', 'backupflow' ), __( 'Upload completed backups to your own FTP location.', 'backupflow' ) ); ?>
			<?php $this->storage_tile( 'google-drive.png', __( 'Google Drive', 'backupflow' ), __( 'Included', 'backupflow' ), __( 'Connect a Google OAuth app and upload backups to Drive.', 'backupflow' ) ); ?>
		</section>

		<section class="backupflow-settings-grid">
			<form class="backupflow-panel" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" method="post">
				<?php wp_nonce_field( 'backupflow_save_settings' ); ?>
				<input type="hidden" name="action" value="backupflow_save_settings" />
				<input type="hidden" name="backupflow_section" value="ftp" />
				<h3><?php esc_html_e( 'FTP settings', 'backupflow' ); ?></h3>
				<div class="backupflow-fields">
					<label><?php esc_html_e( 'Host', 'backupflow' ); ?><input type="text" name="ftp_host" value="<?php echo esc_attr( $settings['ftp']['host'] ); ?>" /></label>
					<label><?php esc_html_e( 'Port', 'backupflow' ); ?><input type="number" name="ftp_port" value="<?php echo esc_attr( $settings['ftp']['port'] ); ?>" /></label>
					<label><?php esc_html_e( 'Username', 'backupflow' ); ?><input type="text" name="ftp_username" value="<?php echo esc_attr( $settings['ftp']['username'] ); ?>" /></label>
					<label><?php esc_html_e( 'Password', 'backupflow' ); ?><input type="password" name="ftp_password" placeholder="<?php esc_attr_e( 'Leave blank to keep existing', 'backupflow' ); ?>" /></label>
					<label><?php esc_html_e( 'Remote folder', 'backupflow' ); ?><input type="text" name="ftp_path" value="<?php echo esc_attr( $settings['ftp']['path'] ); ?>" /></label>
					<label class="backupflow-checkbox"><input type="checkbox" name="ftp_passive" value="1" <?php checked( ! empty( $settings['ftp']['passive'] ) ); ?> /><?php esc_html_e( 'Use passive mode', 'backupflow' ); ?></label>
				</div>
				<button class="backupflow-button" type="submit"><?php esc_html_e( 'Save FTP', 'backupflow' ); ?></button>
			</form>

			<form class="backupflow-panel" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" method="post">
				<?php wp_nonce_field( 'backupflow_save_settings' ); ?>
				<input type="hidden" name="action" value="backupflow_save_settings" />
				<input type="hidden" name="backupflow_section" value="google_drive" />
				<h3><?php esc_html_e( 'Google Drive settings', 'backupflow' ); ?></h3>
				<div class="backupflow-fields">
					<label><?php esc_html_e( 'Client ID', 'backupflow' ); ?><input type="text" name="google_client_id" value="<?php echo esc_attr( $settings['google_drive']['client_id'] ); ?>" /></label>
					<label><?php esc_html_e( 'Client Secret', 'backupflow' ); ?><input type="password" name="google_client_secret" placeholder="<?php esc_attr_e( 'Leave blank to keep existing', 'backupflow' ); ?>" /></label>
					<label><?php esc_html_e( 'Folder ID', 'backupflow' ); ?><input type="text" name="google_folder_id" value="<?php echo esc_attr( $settings['google_drive']['folder_id'] ); ?>" /></label>
				</div>
				<div class="backupflow-form-actions">
					<button class="backupflow-button" type="submit"><?php esc_html_e( 'Save Google Settings', 'backupflow' ); ?></button>
					<?php if ( $google_url ) : ?>
						<a class="backupflow-button backupflow-button-secondary" href="<?php echo esc_url( $google_url ); ?>"><?php esc_html_e( 'Connect Google Drive', 'backupflow' ); ?></a>
					<?php endif; ?>
				</div>
			</form>
		</section>
		<?php $this->premium_storage_grid(); ?>
		<?php
	}

	public function view_settings() {
		$settings = backupflow_get_settings();
		?>
		<form class="backupflow-panel backupflow-settings-wide" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" method="post">
			<?php wp_nonce_field( 'backupflow_save_settings' ); ?>
			<input type="hidden" name="action" value="backupflow_save_settings" />
			<input type="hidden" name="backupflow_section" value="general" />
			<h3><?php esc_html_e( 'Backup behavior', 'backupflow' ); ?></h3>
			<div class="backupflow-fields">
				<label><?php esc_html_e( 'Backups to keep', 'backupflow' ); ?><input type="number" min="1" name="retention_count" value="<?php echo esc_attr( $settings['retention_count'] ); ?>" /></label>
				<label><?php esc_html_e( 'Excluded paths', 'backupflow' ); ?><textarea name="exclude_paths" rows="8"><?php echo esc_textarea( $settings['exclude_paths'] ); ?></textarea></label>
				<label class="backupflow-checkbox"><input type="checkbox" name="skip_wp_config_restore" value="1" <?php checked( ! empty( $settings['skip_wp_config_restore'] ) ); ?> /><?php esc_html_e( 'Do not overwrite wp-config.php during restore', 'backupflow' ); ?></label>
				<label class="backupflow-checkbox"><input type="checkbox" name="safety_backup_before_restore" value="1" <?php checked( ! empty( $settings['safety_backup_before_restore'] ) ); ?> /><?php esc_html_e( 'Create a safety database backup before database restore', 'backupflow' ); ?></label>
			</div>
			<button class="backupflow-button" type="submit"><?php esc_html_e( 'Save Settings', 'backupflow' ); ?></button>
		</form>
		<?php
	}

	public function view_addons() {
		?>
		<section class="backupflow-panel">
			<div class="backupflow-section-head">
				<div>
					<h3><?php esc_html_e( 'Coming soon premium power', 'backupflow' ); ?></h3>
					<p><?php esc_html_e( 'BackupFlow is built so future add-ons can register storage, schedules, WP-CLI commands, cloning, and professional support without changing the free backup engine.', 'backupflow' ); ?></p>
				</div>
			</div>
			<?php $this->premium_storage_grid(); ?>
			<div class="backupflow-roadmap">
				<span><?php esc_html_e( 'Automatic backups', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'Selective schedules', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'Website cloning', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'SFTP / FTPS', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'Dropbox', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'Microsoft OneDrive', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'Amazon S3', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'Cloudflare R2', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'WP-CLI', 'backupflow' ); ?></span>
				<span><?php esc_html_e( 'Priority support', 'backupflow' ); ?></span>
			</div>
		</section>
		<?php
	}

	private function backup_builder( $wizard = false ) {
		$settings          = backupflow_get_settings();
		$ftp_ready         = ! empty( $settings['ftp']['host'] ) && ! empty( $settings['ftp']['username'] ) && ! empty( $settings['ftp']['password'] );
		$google_ready      = ! empty( $settings['google_drive']['client_id'] ) && ! empty( $settings['google_drive']['client_secret'] ) && ! empty( $settings['google_drive']['refresh_token'] );
		$ftp_message       = __( 'Configure FTP settings before using this storage.', 'backupflow' );
		$google_message    = __( 'Connect Google Drive before using this storage.', 'backupflow' );
		?>
		<div class="backupflow-builder<?php echo $wizard ? ' is-wizard' : ''; ?>" data-current-step="1">
			<aside class="backupflow-stepper" aria-label="<?php esc_attr_e( 'Backup setup steps', 'backupflow' ); ?>">
				<button class="is-active" data-step="1"><span>1</span><strong><?php esc_html_e( 'What?', 'backupflow' ); ?></strong><small><?php esc_html_e( 'Select files and database', 'backupflow' ); ?></small></button>
				<button data-step="2"><span>2</span><strong><?php esc_html_e( 'When?', 'backupflow' ); ?></strong><small><?php esc_html_e( 'Run now or schedule later', 'backupflow' ); ?></small></button>
				<button data-step="3"><span>3</span><strong><?php esc_html_e( 'Where?', 'backupflow' ); ?></strong><small><?php esc_html_e( 'Choose backup storage', 'backupflow' ); ?></small></button>
			</aside>
			<div class="backupflow-builder-panel">
				<section class="backupflow-builder-step is-active" data-step-panel="1">
					<h3><?php esc_html_e( 'What do you want to backup?', 'backupflow' ); ?></h3>
					<div class="backupflow-toggle-list">
						<label class="backupflow-toggle-row">
							<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/local-server.png' ); ?>" alt="" />
							<span><strong><?php esc_html_e( 'Files', 'backupflow' ); ?></strong><small><?php esc_html_e( 'Include WordPress core, plugins, themes, uploads, and content files.', 'backupflow' ); ?></small></span>
							<input type="checkbox" data-backup-part="files" checked />
						</label>
						<label class="backupflow-toggle-row">
							<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/database.png' ); ?>" alt="" />
							<span><strong><?php esc_html_e( 'Database', 'backupflow' ); ?></strong><small><?php esc_html_e( 'Include posts, pages, users, settings, plugin data, and serialized WordPress options.', 'backupflow' ); ?></small></span>
							<input type="checkbox" data-backup-part="database" checked />
						</label>
					</div>
					<div class="backupflow-builder-actions">
						<button class="backupflow-button backupflow-next-step" data-next-step="2" type="button"><?php esc_html_e( 'Save & Continue', 'backupflow' ); ?></button>
					</div>
				</section>
				<section class="backupflow-builder-step" data-step-panel="2">
					<h3><?php esc_html_e( 'When should BackupFlow run?', 'backupflow' ); ?></h3>
					<div class="backupflow-choice-list">
						<label class="backupflow-choice is-selected"><input type="radio" name="backupflow_when" value="now" checked /><strong><?php esc_html_e( 'Run now', 'backupflow' ); ?></strong><small><?php esc_html_e( 'Create a manual backup immediately.', 'backupflow' ); ?></small></label>
						<label class="backupflow-choice is-locked"><input type="radio" disabled /><strong><?php esc_html_e( 'Automatic schedule', 'backupflow' ); ?></strong><small><?php esc_html_e( 'Daily, weekly, monthly, and custom intervals are coming soon.', 'backupflow' ); ?></small></label>
					</div>
					<div class="backupflow-builder-actions">
						<button class="backupflow-button backupflow-button-secondary backupflow-next-step" data-next-step="1" type="button"><?php esc_html_e( 'Back', 'backupflow' ); ?></button>
						<button class="backupflow-button backupflow-next-step" data-next-step="3" type="button"><?php esc_html_e( 'Save & Continue', 'backupflow' ); ?></button>
					</div>
				</section>
				<section class="backupflow-builder-step" data-step-panel="3">
					<h3><?php esc_html_e( 'Where to store your backup?', 'backupflow' ); ?></h3>
					<div class="backupflow-destination-grid">
						<button class="backupflow-destination is-selected" data-destination="local" type="button"><img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/local-server.png' ); ?>" alt="" /><span><?php esc_html_e( 'Website Server', 'backupflow' ); ?></span></button>
						<button class="backupflow-destination<?php echo $ftp_ready ? '' : ' is-disabled'; ?>" data-destination="ftp" data-disabled-message="<?php echo esc_attr( $ftp_message ); ?>" <?php disabled( ! $ftp_ready ); ?> type="button"><img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/ftp.png' ); ?>" alt="" /><span><?php esc_html_e( 'FTP', 'backupflow' ); ?><small><?php echo esc_html( $ftp_ready ? __( 'Ready', 'backupflow' ) : __( 'Configure first', 'backupflow' ) ); ?></small></span></button>
						<button class="backupflow-destination<?php echo $google_ready ? '' : ' is-disabled'; ?>" data-destination="google_drive" data-disabled-message="<?php echo esc_attr( $google_message ); ?>" <?php disabled( ! $google_ready ); ?> type="button"><img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/google-drive.png' ); ?>" alt="" /><span><?php esc_html_e( 'Google Drive', 'backupflow' ); ?><small><?php echo esc_html( $google_ready ? __( 'Ready', 'backupflow' ) : __( 'Connect first', 'backupflow' ) ); ?></small></span></button>
					</div>
					<div class="backupflow-locked-grid">
						<span><?php esc_html_e( 'Coming soon:', 'backupflow' ); ?></span>
						<em><?php esc_html_e( 'Dropbox', 'backupflow' ); ?></em>
						<em><?php esc_html_e( 'OneDrive', 'backupflow' ); ?></em>
						<em><?php esc_html_e( 'Amazon S3', 'backupflow' ); ?></em>
						<em><?php esc_html_e( 'Cloudflare R2', 'backupflow' ); ?></em>
					</div>
					<div class="backupflow-builder-actions">
						<button class="backupflow-button backupflow-button-secondary backupflow-next-step" data-next-step="2" type="button"><?php esc_html_e( 'Back', 'backupflow' ); ?></button>
						<button class="backupflow-button backupflow-run-builder" type="button"><?php esc_html_e( 'Create Backup', 'backupflow' ); ?></button>
					</div>
				</section>
			</div>
		</div>
		<?php
	}

	private function backup_table( $catalog, $restore_only = false ) {
		if ( ! $catalog ) {
			echo '<div class="backupflow-empty"><strong>' . esc_html__( 'No backups yet.', 'backupflow' ) . '</strong><p>' . esc_html__( 'Create your first backup to unlock restore and migration actions.', 'backupflow' ) . '</p></div>';
			return;
		}
		?>
		<table class="backupflow-table">
			<colgroup>
				<col class="backupflow-col-backup" />
				<col class="backupflow-col-type" />
				<col class="backupflow-col-location" />
				<col class="backupflow-col-size" />
				<col class="backupflow-col-actions" />
			</colgroup>
			<thead>
				<tr>
					<th><?php esc_html_e( 'Backup', 'backupflow' ); ?></th>
					<th><?php esc_html_e( 'Type', 'backupflow' ); ?></th>
					<th><?php esc_html_e( 'Location', 'backupflow' ); ?></th>
					<th><?php esc_html_e( 'Size', 'backupflow' ); ?></th>
					<th><?php esc_html_e( 'Actions', 'backupflow' ); ?></th>
				</tr>
			</thead>
			<tbody>
				<?php foreach ( $catalog as $record ) : ?>
					<tr data-backup-row="<?php echo esc_attr( $record['id'] ); ?>">
						<td>
							<strong><?php echo esc_html( $record['name'] ); ?></strong>
							<small><?php echo esc_html( isset( $record['created_at'] ) ? $record['created_at'] : '' ); ?><?php echo ! empty( $record['source_url'] ) ? ' | ' . esc_html( $record['source_url'] ) : ''; ?></small>
						</td>
						<td><?php echo esc_html( ucfirst( isset( $record['type'] ) ? $record['type'] : 'full' ) ); ?></td>
						<td><?php echo esc_html( $this->backup_location_label( $record ) ); ?></td>
						<td><?php echo esc_html( isset( $record['size_human'] ) ? $record['size_human'] : backupflow_format_bytes( isset( $record['size'] ) ? $record['size'] : 0 ) ); ?></td>
						<td class="backupflow-table-actions">
							<button class="backupflow-icon-action backupflow-restore-backup" data-backup-id="<?php echo esc_attr( $record['id'] ); ?>" title="<?php esc_attr_e( 'Restore', 'backupflow' ); ?>" type="button"><span class="dashicons dashicons-update-alt" aria-hidden="true"></span><span class="screen-reader-text"><?php esc_html_e( 'Restore', 'backupflow' ); ?></span></button>
							<?php if ( ! $restore_only ) : ?>
								<a class="backupflow-icon-action" href="<?php echo esc_url( $this->download_url( $record['id'] ) ); ?>" title="<?php esc_attr_e( 'Download', 'backupflow' ); ?>"><span class="dashicons dashicons-download" aria-hidden="true"></span><span class="screen-reader-text"><?php esc_html_e( 'Download', 'backupflow' ); ?></span></a>
								<button class="backupflow-icon-action backupflow-delete-backup" data-backup-id="<?php echo esc_attr( $record['id'] ); ?>" title="<?php esc_attr_e( 'Delete', 'backupflow' ); ?>" type="button"><span class="dashicons dashicons-trash" aria-hidden="true"></span><span class="screen-reader-text"><?php esc_html_e( 'Delete', 'backupflow' ); ?></span></button>
							<?php endif; ?>
						</td>
					</tr>
				<?php endforeach; ?>
			</tbody>
		</table>
		<?php
	}

	private function backup_location_label( $record ) {
		$destination = isset( $record['destination'] ) ? sanitize_key( $record['destination'] ) : 'local';
		$labels      = array(
			'local'        => __( 'Local', 'backupflow' ),
			'imported'     => __( 'Uploaded file', 'backupflow' ),
			'ftp'          => __( 'Cloud - FTP', 'backupflow' ),
			'google_drive' => __( 'Cloud - Google Drive', 'backupflow' ),
		);

		return isset( $labels[ $destination ] ) ? $labels[ $destination ] : ucwords( str_replace( array( '-', '_' ), ' ', $destination ) );
	}

	private function metric( $label, $value, $meta ) {
		?>
		<div class="backupflow-metric">
			<span><?php echo esc_html( $label ); ?></span>
			<strong><?php echo esc_html( $value ); ?></strong>
			<small><?php echo esc_html( $meta ); ?></small>
		</div>
		<?php
	}

	private function storage_tile( $icon, $title, $badge, $copy ) {
		?>
		<div class="backupflow-storage-tile">
			<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/' . $icon ); ?>" alt="" />
			<div>
				<strong><?php echo esc_html( $title ); ?></strong>
				<span><?php echo esc_html( $badge ); ?></span>
				<p><?php echo esc_html( $copy ); ?></p>
			</div>
		</div>
		<?php
	}

	private function premium_storage_grid() {
		$items = array(
			array( 'dropbox.png', __( 'Dropbox', 'backupflow' ) ),
			array( 'microsoft-onedrive.png', __( 'Microsoft OneDrive', 'backupflow' ) ),
			array( 'amazons3.png', __( 'Amazon S3', 'backupflow' ) ),
			array( 'cloudflare-r2.png', __( 'Cloudflare R2', 'backupflow' ) ),
			array( 'ftp.png', __( 'SFTP / FTPS', 'backupflow' ) ),
			array( 'local-server.png', __( 'WP-CLI', 'backupflow' ) ),
		);
		?>
		<section class="backupflow-premium-grid" aria-label="<?php esc_attr_e( 'Premium storage roadmap', 'backupflow' ); ?>">
			<?php foreach ( $items as $item ) : ?>
				<div>
					<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/' . $item[0] ); ?>" alt="" />
					<strong><?php echo esc_html( $item[1] ); ?></strong>
					<span><?php esc_html_e( 'Coming soon', 'backupflow' ); ?></span>
				</div>
			<?php endforeach; ?>
		</section>
		<?php
	}

	private function sidebar() {
		?>
		<aside class="backupflow-sidebar">
			<section class="backupflow-side-card backupflow-side-brand">
				<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/BackupFlow.png' ); ?>" alt="" />
				<h3><?php esc_html_e( 'BackupFlow Free', 'backupflow' ); ?></h3>
				<p><?php esc_html_e( 'Local backups, FTP, Google Drive, one-click restore, migration URL rewrite, database-only and files-only backups.', 'backupflow' ); ?></p>
			</section>
			<section class="backupflow-side-card">
				<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/pageforge.png' ); ?>" alt="" />
				<h3><?php esc_html_e( 'PageForge', 'backupflow' ); ?></h3>
				<p><?php esc_html_e( 'Programmatic SEO pages and growth content for WordPress.', 'backupflow' ); ?></p>
				<a href="https://wordpress.org/plugins/pageforge/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'View Plugin', 'backupflow' ); ?></a>
			</section>
			<section class="backupflow-side-card">
				<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/nimora.png' ); ?>" alt="" />
				<h3><?php esc_html_e( 'Nimora AI', 'backupflow' ); ?></h3>
				<p><?php esc_html_e( 'Find revenue leaks, fix important SEO issues, and create watermark-free WooCommerce UGC images, product videos, and more.', 'backupflow' ); ?></p>
				<a href="https://wordpress.org/plugins/nimora-ai-seo-product-media-analytics/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'View Plugin', 'backupflow' ); ?></a>
			</section>
			<section class="backupflow-side-card">
				<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/immersa-core.png' ); ?>" alt="" />
				<h3><?php esc_html_e( 'Immersa Builder + Core', 'backupflow' ); ?></h3>
				<p><?php esc_html_e( 'Build a WordPress website in one click with starter templates and Core AI.', 'backupflow' ); ?></p>
				<a href="https://wordpress.org/themes/immersa-builder/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Theme', 'backupflow' ); ?></a>
				<a href="https://wordpress.org/plugins/immersa-core-starter-templates-ai/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Plugin', 'backupflow' ); ?></a>
			</section>
		</aside>
		<?php
	}

	private function job_modal() {
		?>
		<div class="backupflow-modal" hidden>
			<div class="backupflow-modal-backdrop"></div>
			<div class="backupflow-modal-panel" role="dialog" aria-modal="true" aria-labelledby="backupflow-modal-title">
				<div class="backupflow-modal-head">
					<img src="<?php echo esc_url( BACKUPFLOW_URL . 'assets/img/BackupFlow.png' ); ?>" alt="" />
					<div>
						<h2 id="backupflow-modal-title"><?php esc_html_e( 'Process running', 'backupflow' ); ?></h2>
						<p data-job-message><?php esc_html_e( 'Preparing...', 'backupflow' ); ?></p>
					</div>
				</div>
				<div class="backupflow-progress"><span style="width:0%"></span><strong>0%</strong></div>
				<div class="backupflow-log" data-job-log></div>
				<div class="backupflow-cancel-confirm" data-cancel-confirm hidden>
					<strong><?php esc_html_e( 'Are you sure you want to cancel the process?', 'backupflow' ); ?></strong>
					<div>
						<button class="backupflow-button backupflow-button-secondary" data-cancel-no type="button"><?php esc_html_e( 'No, continue', 'backupflow' ); ?></button>
						<button class="backupflow-button" data-cancel-yes type="button"><?php esc_html_e( 'Yes, cancel', 'backupflow' ); ?></button>
					</div>
				</div>
				<div class="backupflow-modal-actions">
					<a class="backupflow-button" data-backup-download hidden href="#"><?php esc_html_e( 'Download Backup', 'backupflow' ); ?></a>
					<a class="backupflow-button backupflow-button-secondary" data-dashboard-link hidden href="<?php echo esc_url( admin_url( 'admin.php?page=backupflow' ) ); ?>"><?php esc_html_e( 'Back to Dashboard', 'backupflow' ); ?></a>
					<button class="backupflow-button backupflow-button-secondary" data-job-close type="button"><?php esc_html_e( 'Cancel', 'backupflow' ); ?></button>
				</div>
			</div>
		</div>
		<?php
	}

	private function notices() {
		$notice = isset( $_GET['backupflow_notice'] ) ? sanitize_key( wp_unslash( $_GET['backupflow_notice'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( ! $notice ) {
			return;
		}

		$messages = array(
			'settings_saved'      => __( 'BackupFlow settings saved.', 'backupflow' ),
			'imported'            => __( 'Backup imported and added to restore points.', 'backupflow' ),
			'import_failed'       => __( 'Backup import failed. Check the ZIP file and try again.', 'backupflow' ),
			'google_connected'    => __( 'Google Drive connected successfully.', 'backupflow' ),
			'google_failed'       => __( 'Google Drive connection failed.', 'backupflow' ),
			'google_state_failed' => __( 'Google Drive security check failed. Please try again.', 'backupflow' ),
		);

		if ( isset( $messages[ $notice ] ) ) {
			echo '<div class="notice notice-info is-dismissible backupflow-notice"><p>' . esc_html( $messages[ $notice ] ) . '</p></div>';
		}
	}

	private function redirect_page_for_section( $section ) {
		return in_array( $section, array( 'ftp', 'google_drive' ), true ) ? 'backupflow-storage' : 'backupflow-settings';
	}

	private function prepare_job_response( $job ) {
		if ( empty( $job['result']['backup']['id'] ) ) {
			return $job;
		}

		$backup_id = sanitize_key( $job['result']['backup']['id'] );
		$job['result']['backup']['download_url'] = $this->download_url( $backup_id );

		return $job;
	}

	private function download_url( $backup_id ) {
		$backup_id = sanitize_key( $backup_id );
		return add_query_arg(
			array(
				'action'    => 'backupflow_download_backup',
				'backup_id' => $backup_id,
				'_wpnonce'  => wp_create_nonce( 'backupflow_download_backup_' . $backup_id ),
			),
			admin_url( 'admin-post.php' )
		);
	}
}