<?php
if (!defined('ABSPATH')) {
    exit;
}
$ui_labels = isset($ui_labels) && is_array($ui_labels) ? $ui_labels : [];
$profile_key = sanitize_key((string) ($ui_labels['profile_key'] ?? ''));
$account_description = isset($account_description) ? (string) $account_description : (string) ($ui_labels['account_description'] ?? __('Update your profile and manage your listing activity.', 'nexdirectory'));
$gdpr_marketing_opt_in = !empty($gdpr_marketing_opt_in);
$event_messages_enabled = !isset($event_messages_enabled) || !empty($event_messages_enabled);
$gdpr_terms_accepted_label = isset($gdpr_terms_accepted_label) ? sanitize_text_field((string) $gdpr_terms_accepted_label) : '';
$page_kicker = sanitize_text_field((string) $this->get_event_hero_kicker_text());
echo $this->render_notice();
echo $this->render_platform_breadcrumbs(__('Account Management', 'nexdirectory')); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
?>
<section class="eep-page-banner">
    <p class="eep-page-kicker"><?php echo esc_html($page_kicker); ?></p>
    <h1><?php esc_html_e('Account Management', 'nexdirectory'); ?></h1>
    <p><?php echo esc_html($account_description); ?></p>
</section>
<?php echo $this->render_account_tabs('account', $profile_key); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>
<div class="eep-account-shell">
<div class="eep-account-panel">
<form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" class="eep-form eep-account-form">
    <input type="hidden" name="action" value="eep_account_update">
    <?php wp_nonce_field('eep_account_update_nonce', 'eep_account_nonce'); ?>

    <h3><?php esc_html_e('Account Management', 'nexdirectory'); ?></h3>

    <label><?php esc_html_e('Username', 'nexdirectory'); ?></label>
    <input type="text" value="<?php echo esc_attr($user->user_login); ?>" disabled>

    <label><?php esc_html_e('Display Name', 'nexdirectory'); ?></label>
    <input type="text" name="display_name" value="<?php echo esc_attr($user->display_name); ?>">

    <label><?php esc_html_e('Email', 'nexdirectory'); ?></label>
    <input type="email" name="user_email" value="<?php echo esc_attr($user->user_email); ?>" required>

    <div class="eep-account-consent-box">
        <h4><?php esc_html_e('Communication & GDPR', 'nexdirectory'); ?></h4>
        <p class="eep-meta"><?php esc_html_e('Essential event-account emails (verification, moderation, RSVP/system updates) remain enabled for platform operation.', 'nexdirectory'); ?></p>
        <label class="eep-auth-consent-item">
            <input type="checkbox" name="eep_gdpr_marketing_opt_in" value="1" <?php checked($gdpr_marketing_opt_in, true); ?>>
            <span><?php esc_html_e('Allow organizer announcements and platform news emails (non-essential).', 'nexdirectory'); ?></span>
        </label>
        <?php if ((string) ($ui_labels['is_events_profile'] ?? '1') === '1') : ?>
            <input type="hidden" name="eep_event_messages_enabled" value="0">
            <label class="eep-auth-consent-item">
                <input type="checkbox" name="eep_event_messages_enabled" value="1" <?php checked($event_messages_enabled, true); ?>>
                <span><?php esc_html_e('Show the Message button on my event pages.', 'nexdirectory'); ?></span>
            </label>
            <p class="eep-meta"><?php esc_html_e('If disabled, visitors will only see the Visit Event Site CTA.', 'nexdirectory'); ?></p>
        <?php endif; ?>
        <?php if ($gdpr_terms_accepted_label !== '') : ?>
            <p class="eep-meta"><?php echo esc_html(sprintf(__('GDPR acceptance recorded: %s', 'nexdirectory'), $gdpr_terms_accepted_label)); ?></p>
        <?php endif; ?>
    </div>

    <label><?php esc_html_e('New Password (optional)', 'nexdirectory'); ?></label>
    <input type="password" name="new_pass" autocomplete="new-password">

    <button type="submit"><?php esc_html_e('Save Account', 'nexdirectory'); ?></button>
</form>
</div>
</div>
