<?php
/**
 * Controller: Alert Manager.
 *
 * Alert manager class file.
 *
 * @since     4.5
 *
 * @package   wsal
 * @subpackage controllers
 */

declare(strict_types=1);

namespace WSAL\Controllers;

use WSAL\Helpers\Logger;
use WSAL\Helpers\WP_Helper;
use WSAL\Helpers\User_Helper;
use WSAL\Controllers\Constants;
use WSAL\Helpers\Classes_Helper;
use WSAL\Helpers\Settings_Helper;
use WSAL\Entities\Metadata_Entity;
use WSAL\Entities\Occurrences_Entity;
use WSAL\Helpers\User_Sessions_Helper;
use WSAL\WP_Sensors\Helpers\Yoast_SEO_Helper;
use WSAL\WP_Sensors\Helpers\Woocommerce_Helper;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( '\WSAL\Controllers\Alert_Manager' ) ) {
	/**
	 * Provides logging functionality for the comments.
	 *
	 * @since 4.5.0
	 */
	class Alert_Manager {
		/**
		 * Holds list of the ignored \WP_Post types.
		 */
		public const IGNORED_POST_TYPES = array(
			// Attachment CPT.
			'attachment',
			// Revision CPT.
			'revision',
			// Nav menu item CPT.
			'nav_menu_item',
			// Customize changeset CPT.
			'customize_changeset',
			// Custom CSS CPT.
			'custom_css',
			// Gutenberg templates.
			'wp_template',
			// WP Core collaborative editing sync storage. Stops 2055 event spam triggered by new WP collaborative feature.
			'wp_sync_storage',
		);

		/**
		 * Array of loggers (WSAL_AbstractLogger).
		 *
		 * @var \WSAL_AbstractLogger[]
		 *
		 * @since 4.5.0
		 */
		private static $loggers = array();

		/**
		 * Contains a list of alerts to trigger.
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $pipeline = array();

		/**
		 * Holds the array with the excluded post types.
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $ignored_cpts = array();

		/**
		 * Holds an array with all the registered alerts.
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $alerts = array();

		/**
		 * Array of Deprecated Events.
		 *
		 * @since 4.5.0
		 *
		 * @var array
		 */
		private static $deprecated_events = array();

		/**
		 * Contains an array of alerts that have been triggered for this request.
		 *
		 * @var int[]
		 *
		 * @since 4.5.0
		 */
		private static $triggered_types = array();

		/**
		 * Holds the array of all the excluded users from the settings.
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $excluded_users = array();

		/**
		 * Holds the array of all the excluded roles from the settings.
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $excluded_roles = array();

		/**
		 * Holds an array of all the post types.
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $all_post_types = array();

		/**
		 * Amount of seconds to check back for the given alert occurrence.
		 *
		 * @var int
		 *
		 * @since 4.5.0
		 */
		private static $seconds_to_check_back = 5;

		/**
		 * Holds a cached value if the checked alerts which were recently fired.
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $cached_alert_checks = array();

		/**
		 * WP Users.
		 *
		 * Store WP Users for caching purposes.
		 *
		 * @var WP_User[]
		 *
		 * @since 4.5.0
		 */
		private static $wp_users = array();

		/**
		 * Is IP address disabled.
		 *
		 * Store WP Users for caching purposes.
		 *
		 * @var bool
		 *
		 * @since 4.5.0
		 */
		private static $is_ip_disabled = null;

		/**
		 * Holds the array with the event types
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $event_types = array();

		/**
		 * Holds the array with the objects data
		 *
		 * @var array
		 *
		 * @since 4.5.0
		 */
		private static $objects_data = array();

		/**
		 * Initializes the class and adds the hooks.
		 *
		 * @return void
		 *
		 * @since 4.5.0
		 */
		public static function init() {
			\add_action( 'shutdown', array( __CLASS__, 'commit_pipeline' ), 8 );
		}

		/**
		 * Trigger an alert.
		 *
		 * @param int   $type    - Alert type.
		 * @param array $data    - Alert data.
		 * @param mixed $delayed - False if delayed, function if not.
		 *
		 * @since 4.5.0
		 */
		public static function trigger_event( $type, $data = array(), $delayed = false ) {
			// Check if IP is disabled.
			if ( self::is_ip_address_disabled() ) {
				return;
			}

			// Check if PostType index is set in data array.
			if ( isset( $data['PostType'] ) && ! empty( $data['PostType'] ) ) {
				// If the post type is disabled then return.
				if ( self::is_disabled_post_type( $data['PostType'] ) ) {
					return;
				}
			}

			// If the post status is disabled then return.
			if ( isset( $data['PostStatus'] ) && ! empty( $data['PostStatus'] ) ) {
				if ( self::is_disabled_post_status( $data['PostStatus'] ) ) {
					return;
				}
			}

			// Figure out the username.
			$username = User_Helper::get_current_user()->user_login;

			// If user switching plugin class exists and filter is set to disable then try to get the old user.
			if ( apply_filters( 'wsal_disable_user_switching_plugin_tracking', false ) && class_exists( '\user_switching' ) ) {
				$old_user = \user_switching::get_old_user();
				if ( isset( $old_user->user_login ) ) {
					// Looks like this is a switched user so setup original user values for use when logging.
					$username              = $old_user->user_login;
					$data['Username']      = $old_user->user_login;
					$data['CurrentUserID'] = $old_user->ID;
				}
			}

			if ( empty( $username ) && ! empty( $data['Username'] ) ) {
				$username = $data['Username'];
			}

			// Get current user roles.
			if ( isset( $old_user ) && false !== $old_user ) {
				// looks like this is a switched user so setup original user
				// roles and values for later user.
				$roles                    = User_Helper::get_user_roles( $old_user );
				$data['CurrentUserRoles'] = $roles;
			} else {
				// not a switched user so get the current user roles.
				$roles = User_Helper::get_user_roles();
			}
			if ( empty( $roles ) && ! empty( $data['CurrentUserRoles'] ) ) {
				$roles = $data['CurrentUserRoles'];
			}

			// If user or user role is enabled then go ahead.
			if ( self::check_enable_user_roles( $username, $roles ) ) {
				$data['Timestamp'] = ( isset( $data['Timestamp'] ) && ! empty( $data['Timestamp'] ) ) ? $data['Timestamp'] : current_time( 'U.u', 'true' );
				if ( $delayed ) {
					self::trigger_event_if( $type, $data, null );
				} else {
					self::commit_item( $type, $data, null );
				}
			}
		}

		/**
		 * Method: Returns if IP is disabled or not.
		 *
		 * @return bool True if current IP address is disabled.
		 *
		 * @since 4.5.0
		 */
		private static function is_ip_address_disabled() {
			if ( null === self::$is_ip_disabled ) {
				self::$is_ip_disabled = false;
				$ip                   = Settings_Helper::get_main_client_ip();
				$excluded_ips         = Settings_Helper::get_excluded_monitoring_ips();

				if ( ! empty( $excluded_ips ) ) {
					foreach ( $excluded_ips as $excluded_ip ) {
						if ( false !== strpos( $excluded_ip, '-' ) ) {
							$ip_range = Settings_Helper::get_ipv4_by_range( $excluded_ip );
							$ip_range = $ip_range['lower'] . '-' . $ip_range['upper'];

							if ( Settings_Helper::check_ipv4_in_range( $ip, $ip_range ) ) {
								self::$is_ip_disabled = true;

								break;
							}
						} elseif ( $ip === $excluded_ip ) {
							self::$is_ip_disabled = true;

							break;
						}
					}
				}
			}

			return self::$is_ip_disabled;
		}

		/**
		 * Method: Check whether post type is disabled or not.
		 *
		 * @param string $post_type - Post type.
		 *
		 * @return bool - True if disabled, False if otherwise.
		 *
		 * @since 4.5.0
		 */
		public static function is_disabled_post_type( $post_type ) {
			return in_array( $post_type, self::get_all_post_types(), true );
		}

		/**
		 * Method: Check whether post status is disabled or not.
		 *
		 * @param string $post_status - Post status.
		 *
		 * @return bool - True if disabled, False if otherwise.
		 *
		 * @since 5.0.0
		 */
		public static function is_disabled_post_status( $post_status ) {
			return in_array( $post_status, Settings_Helper::get_excluded_post_statuses(), true );
		}

		/**
		 * Returns array with all post types
		 *
		 * @return array
		 *
		 * @since 4.5.0
		 */
		public static function get_all_post_types(): array {
			if ( empty( self::$all_post_types ) ) {
				self::$all_post_types = array_merge( Settings_Helper::get_excluded_post_types(), self::get_ignored_post_types() );
			}

			if ( ! \is_array( self::$all_post_types ) ) {
				self::$all_post_types = array();
			}

			return self::$all_post_types;
		}

		/**
		 * Returns all the ignored post types - post types are \WP_Post types
		 * Note: There is a difference between ignored types and disabled types.
		 *
		 * @since 4.5.0
		 */
		public static function get_ignored_post_types(): array {
			if ( empty( self::$ignored_cpts ) ) {
				/*
				 * Filter: `wsal_ignored_custom_post_types`
				 *
				 * Ignored custom post types filter.
				 *
				 * @param array $ignored_cpts - Array of custom post types.
				 *
				 * @since 3.3.1
				 */
				self::$ignored_cpts = apply_filters(
					'wsal_ignored_custom_post_types',
					array_unique(
						array_merge(
							Settings_Helper::get_excluded_post_types(),
							self::IGNORED_POST_TYPES
						)
					)
				);
			}

			if ( ! \is_array( self::$ignored_cpts ) ) {
				self::$ignored_cpts = array();
			}

			return self::$ignored_cpts;
		}

		/**
		 * Removes type from the ignored post types.
		 *
		 * @param string $post_type - The name of the post type to remove.
		 *
		 * @return void
		 *
		 * @since 4.5.0
		 */
		public static function remove_from_ignored_post_types( string $post_type ) {
			if ( empty( self::$ignored_cpts ) ) {
				self::get_ignored_post_types();
			}

			$key = array_search( $post_type, self::$ignored_cpts, true );

			if ( false !== $key ) {
				unset( self::$ignored_cpts[ $key ] );
			}
		}

		/**
		 * Adds type to the ignored post types.
		 *
		 * @param string $post_type - The name of the post type to remove.
		 *
		 * @return void
		 *
		 * @since 5.3.0
		 */
		public static function add_to_ignored_post_types( string $post_type ) {
			if ( empty( self::$ignored_cpts ) ) {
				self::get_ignored_post_types();
			}

			$key = array_search( $post_type, self::$ignored_cpts, true );

			if ( false === $key ) {
				self::$ignored_cpts[] = $post_type;
			}
		}

		/**
		 * Removes type from the ignored post types.
		 *
		 * @param string $post_type - The name of the post type to remove.
		 *
		 * @return void
		 *
		 * @since 5.3.0
		 */
		public static function remove_from_all_ignored_post_types( string $post_type ) {
			if ( empty( self::$all_post_types ) ) {
				self::get_all_post_types();
			}

			$key = array_search( $post_type, self::$all_post_types, true );

			if ( false !== $key ) {
				unset( self::$all_post_types[ $key ] );
			}
		}

		/**
		 * Adds type to the ignored post types.
		 *
		 * @param string $post_type - The name of the post type to remove.
		 *
		 * @return void
		 *
		 * @since 5.3.0
		 */
		public static function add_to_all_ignored_post_types( string $post_type ) {
			if ( empty( self::$all_post_types ) ) {
				self::get_all_post_types();
			}

			$key = array_search( $post_type, self::$all_post_types, true );

			if ( false === $key ) {
				self::$all_post_types[] = $post_type;
			}
		}

		/**
		 * Check enable user and roles.
		 *
		 * @param string $user  - Username.
		 * @param array  $roles - User roles.
		 *
		 * @return bool - True if enable false otherwise.
		 *
		 * @since 4.5.0
		 */
		public static function check_enable_user_roles( $user, $roles ) {
			if ( '' !== $user && self::is_disabled_user( $user ) ) {
				return false;
			}

			if ( '' !== $roles && self::is_disabled_role( $roles ) ) {
				return false;
			}

			return true;
		}

		/**
		 * Returns whether user is enabled or not.
		 *
		 * @param string $user - Username.
		 *
		 * @return bool True if disabled, false otherwise.
		 *
		 * @since 4.5.0
		 */
		public static function is_disabled_user( $user ) {
			if ( empty( self::$excluded_users ) ) {
				self::$excluded_users = Settings_Helper::get_excluded_monitoring_users();
			}

			return in_array( $user, self::$excluded_users, true );
		}

		/**
		 * Returns whether user is enabled or not.
		 *
		 * @param array $roles - User roles.
		 *
		 * @return bool True if disabled, false otherwise.
		 *
		 * @since 4.5.0
		 */
		public static function is_disabled_role( $roles ) {
			$is_disabled = false;

			if ( empty( self::$excluded_roles ) ) {
				self::$excluded_roles = Settings_Helper::get_excluded_monitoring_roles();
			}

			if ( ! \is_array( self::$excluded_roles ) ) {
				self::$excluded_roles = array( self::$excluded_roles );
			}

			if ( ! \is_array( $roles ) ) {
				$roles = array( $roles );
			}

			foreach ( $roles as $role ) {
				if ( in_array( $role, self::$excluded_roles, true ) ) {
					$is_disabled = true;
				}
			}

			return $is_disabled;
		}

		/**
		 * Trigger only if a condition is met at the end of request.
		 *
		 * @param int      $type - Alert type ID.
		 * @param array    $data - Alert data.
		 * @param callable $cond - A future condition callback (receives an object of type WSAL_AlertManager as parameter).
		 *
		 * @since 4.5.0
		 */
		public static function trigger_event_if( $type, $data, $cond = null ) {
			// Check if IP is disabled.
			if ( self::is_ip_address_disabled() ) {
				return;
			}

			// Check if PostType index is set in data array.
			if ( isset( $data['PostType'] ) && ! empty( $data['PostType'] ) ) {
				// If the post type is disabled then return.
				if ( self::is_disabled_post_type( $data['PostType'] ) ) {
					return;
				}
			}

			// If the post status is disabled then return.
			if ( isset( $data['PostStatus'] ) && ! empty( $data['PostStatus'] ) ) {
				if ( self::is_disabled_post_status( $data['PostStatus'] ) ) {
					return;
				}
			}

			$username = null;

			// if user switching plugin class exists and filter is set to disable then try get the old user.
			if ( \apply_filters( 'wsal_disable_user_switching_plugin_tracking', false ) && class_exists( '\user_switching' ) ) {
				$old_user = \user_switching::get_old_user();
				if ( isset( $old_user->user_login ) ) {
					// looks like this is a switched user so setup original user
					// values for use when logging.
					$username              = $old_user->user_login;
					$data['Username']      = $old_user->user_login;
					$data['CurrentUserID'] = $old_user->ID;
				}
			}

			$roles = array();
			if ( 1000 === $type ) {
				// When event 1000 is triggered, the user is not logged in.
				// We need to extract the username and user roles from the event data.
				$username = array_key_exists( 'Username', $data ) ? $data['Username'] : null;
				$roles    = array_key_exists( 'CurrentUserRoles', $data ) ? $data['CurrentUserRoles'] : array();
			} elseif ( class_exists( 'user_switching' ) && isset( $old_user ) && false !== $old_user ) {
				// looks like this is a switched user so setup original user
				// roles and values for later user.
				$roles                    = User_Helper::get_user_roles( $old_user );
				$data['CurrentUserRoles'] = $roles;
			} else {
				$username = User_Helper::get_current_user()->user_login;
				$roles    = User_Helper::get_user_roles();
			}

			if ( self::check_enable_user_roles( $username, $roles ) ) {
				if ( ! array_key_exists( 'Timestamp', $data ) ) {
					$data['Timestamp'] = current_time( 'U.u', 'true' );
				}
				self::$pipeline[] = array(
					'type' => $type,
					'data' => $data,
					'cond' => $cond,
				);
			}
		}

		/**
		 * Method: Commit an alert now.
		 *
		 * @param int   $type   - Alert type.
		 * @param array $data   - Data of the alert.
		 * @param array $cond   - Condition for the alert.
		 * @param bool  $_retry - Retry.
		 *
		 * @return mixed
		 *
		 * @internal
		 *
		 * @since 4.5.0
		 */
		protected static function commit_item( $type, $data, $cond, $_retry = true ) {
			// Double NOT operation here is intentional. Same as ! ( bool ) [ $value ]
			// NOTE: return false on a true condition to compensate.
			if ( ! $cond || (bool) call_user_func( $cond ) ) {
				if ( self::is_enabled( $type ) ) {
					if ( isset( self::get_alerts()[ $type ] ) ) {
						// Ok, convert alert to a log entry.
						self::$triggered_types[] = $type;
						self::log( $type, $data );
					} elseif ( $_retry ) {

						return self::commit_item( $type, $data, $cond, false );
					} else {
						// In general this shouldn't happen, but it could, so we handle it here.
						/* translators: Event ID */
						$error_message = sprintf( esc_html__( 'Event with code %d has not be registered.', 'wp-security-audit-log' ), $type );
						Logger::log( $error_message );
					}
				}
			}
		}

		/**
		 * Returns whether alert of type $type is enabled or not.
		 *
		 * @param int $type Alert type.
		 *
		 * @return bool True if enabled, false otherwise.
		 *
		 * @since 4.5.0
		 */
		public static function is_enabled( $type ) {
			$disabled_events = Settings_Helper::get_disabled_alerts();

			return ! in_array( $type, $disabled_events, true );
		}

		/**
		 * Register a whole group of items.
		 *
		 * @param array $groups - An array with group name as the index and an array of group items as the value.
		 *                      Item values is an array of [type, code, description, message, object, event type] respectively.
		 *
		 * @since 5.1.1
		 */
		public static function register_group( $groups ) {
			foreach ( $groups as $name => $group ) {
				foreach ( $group as $subname => $subgroup ) {
					foreach ( $subgroup as $item ) {
						self::register( $name, $subname, $item );
					}
				}
			}
		}

		/**
		 * Register an alert type.
		 *
		 * @param string $category    Category name.
		 * @param string $subcategory Subcategory name.
		 * @param array  $info        Event information from defaults.php.
		 *
		 * @since 4.5.0
		 */
		public static function register( $category, $subcategory, $info ) {
			// Default for optional fields.
			$metadata   = array();
			$links      = array();
			$object     = '';
			$event_type = '';

			$definition_items_count = count( $info );
			if ( 8 === $definition_items_count ) {
				// Most recent event definition introduced in version 4.2.1.
				list($code, $severity, $desc, $message, $metadata, $links, $object, $event_type) = $info;
			} elseif ( 6 === $definition_items_count ) {
				// Legacy event definition for backwards compatibility (used prior to version 4.2.1).
				list($code, $severity, $desc, $message, $object, $event_type) = $info;
			} else {
				// Even older legacy event definition for backwards compatibility.
				list($code, $severity, $desc, $message) = $info;
			}

			if ( is_string( $links ) ) {
				$links = array( $links );
			}

			if ( isset( self::$alerts[ $code ] ) ) {
				\add_action( 'admin_notices', array( __CLASS__, 'duplicate_event_notice' ) );
				/* Translators: Event ID */
				$error_message = sprintf( esc_html__( 'Event %s already registered with WP Activity Log.', 'wp-security-audit-log' ), $code );
				Logger::log( $error_message );

				return;
			}

			/**
			 * WSAL Filter: `wsal_event_metadata_definition`.
			 *
			 * Filters event metadata definition before registering specific event with the alert manager. This is the
			 * preferred way to change metadata definition of built-in events.
			 *
			 * @param array $metadata - Event data.
			 * @param int   $code     - Event ID.
			 *
			 * @since 4.5.0
			 */
			$metadata = \apply_filters( 'wsal_event_metadata_definition', $metadata, $code );

			self::$alerts[ $code ] = array(
				'code'        => $code,
				'severity'    => $severity,
				'category'    => $category,
				'subcategory' => $subcategory,
				'desc'        => $desc,
				'message'     => $message,
				'metadata'    => $metadata,
				'links'       => $links,
				'object'      => $object,
				'event_type'  => $event_type,
			);
		}

		/**
		 * Duplicate Event Notice.
		 *
		 * @since 4.5.0
		 */
		public static function duplicate_event_notice() {
			$class   = 'notice notice-error';
			$message = __( 'You have custom events that are using the same ID or IDs which are already registered in the plugin, so they have been disabled.', 'wp-security-audit-log' );
			printf(
				/* Translators: 1.CSS classes, 2. Notice, 3. Contact us link */
				'<div class="%1$s"><p>%2$s %3$s ' . \esc_html__( '%4$s to help you solve this issue.', 'wp-security-audit-log' ) . '</p></div>',
				\esc_attr( $class ),
				'<span style="color:#dc3232; font-weight:bold;">' . \esc_html__( 'ERROR:', 'wp-security-audit-log' ) . '</span>',
				\esc_html( $message ),
				'<a href="https://melapress.com/contact" target="_blank">' . \esc_html__( 'Contact us', 'wp-security-audit-log' ) . '</a>'
			);
		}

		/**
		 * Converts an Alert into a Log entry (by invoking loggers).
		 * You should not call this method directly.
		 *
		 * @param int   $event_id   - Alert type.
		 * @param array $event_data - Misc alert data.
		 */
		public static function log( $event_id, $event_data = array() ) {
			$alert_obj = self::get_alerts()[ $event_id ];

			if ( ! isset( $event_data['ClientIP'] ) ) {
				$client_ip = Settings_Helper::get_main_client_ip();
				if ( ! empty( $client_ip ) ) {
					$event_data['ClientIP'] = $client_ip;
				}
			}
			if ( ! isset( $event_data['OtherIPs'] ) && Settings_Helper::get_boolean_option_value( 'use-proxy-ip' ) ) {
				$other_ips = Settings_Helper::get_client_ips();
				if ( ! empty( $other_ips ) ) {
					$event_data['OtherIPs'] = $other_ips;
				}
			}
			if ( ! isset( $event_data['UserAgent'] ) ) {
				if ( isset( $_SERVER['HTTP_USER_AGENT'] ) ) {
					$event_data['UserAgent'] = \sanitize_text_field( \wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) );
				}
			}
			if ( ! isset( $event_data['Username'] ) && ! isset( $event_data['CurrentUserID'] ) ) {
				if ( function_exists( 'get_current_user_id' ) ) {
					$event_data['CurrentUserID'] = \get_current_user_id();
					if ( 0 !== $event_data['CurrentUserID'] ) {
						$user = \get_user_by( 'ID', $event_data['CurrentUserID'] );
						if ( \is_a( $user, '\WP_User' ) ) {
							$event_data['Username'] = $user->user_login;
						} else {
							$event_data['Username'] = 'Unknown User';
						}
					}
					if ( 0 === $event_data['CurrentUserID'] ) {
						$alert_object = \strtolower( (string) ( $alert_obj['object'] ?? '' ) );

						if ( 'system' === $alert_object ) {
							$event_data['Username'] = 'System';
						} elseif ( str_starts_with( $alert_object, 'woocommerce' ) && 9130 !== (int) $event_id ) {
							$event_data['Username'] = 'WooCommerce System';
						} else {
							$event_data['Username'] = 'Unknown User';
						}
					}
				}
			}
			if ( isset( $event_data['CurrentUserID'] ) && ! isset( $event_data['Username'] ) ) {
				if ( 0 === $event_data['CurrentUserID'] ) {
					$alert_object = \strtolower( (string) ( $alert_obj['object'] ?? '' ) );

					if ( 'system' === $alert_object ) {
						$event_data['Username'] = 'System';
					} elseif ( str_starts_with( $alert_object, 'woocommerce' ) ) {
						$event_data['Username'] = 'WooCommerce System';
					} else {
						$event_data['Username'] = 'Unknown User';
					}
				} else {
					$user = \get_user_by( 'ID', $event_data['CurrentUserID'] );
					if ( $user ) {
						$event_data['Username'] = $user->user_login;
					} else {
						$event_data['Username'] = 'Deleted';
					}
				}
			}
			if ( ! isset( $event_data['CurrentUserRoles'] ) && function_exists( 'is_user_logged_in' ) && \is_user_logged_in() ) {
				$current_user_roles = User_Helper::get_user_roles();
				if ( ! empty( $current_user_roles ) ) {
					$event_data['CurrentUserRoles'] = $current_user_roles;
				}
			}

			// If the user sessions plugin is loaded try to attach the SessionID.
			if ( ! isset( $event_data['SessionID'] ) && class_exists( '\WSAL\Helpers\User_Sessions_Helper' ) ) {
				// Try to get the session id generated from logged in cookie.
				$session_id = User_Sessions_Helper::get_session_id_from_logged_in_user_cookie();
				// If we have a SessionID then add it to event_data.
				if ( ! empty( $session_id ) ) {
					$event_data['SessionID'] = $session_id;
				}
			}

			// Get event severity.
			$alert_code = $alert_obj ? Constants::get_constant_code( $alert_obj['severity'] ) : -1;

			if ( -1 !== $alert_code ) {
				$event_data['Severity'] = $alert_code;
			}

			/*
			 * In cases where we were not able to figure out a severity already
			 * use a default of 200: info.
			 *
			 * @since 4.5.0
			 */
			if ( ! isset( $event_data['Severity'] ) ) {
				// Assuming this is a misclassified item and using info code.
				// INFO (200): Interesting events.
				$event_data['Severity'] = 200;
			}

			// Add event object.
			if ( $alert_obj && ! isset( $event_data['Object'] ) ) {
				$event_data['Object'] = $alert_obj['object'];
			}

			// Add event type.
			if ( $alert_obj && ! isset( $event_data['EventType'] ) ) {
				$event_data['EventType'] = $alert_obj['event_type'];
			}

			// Append further details if in multisite.
			if ( WP_Helper::is_multisite() ) {
				$event_data['SiteID']  = get_current_blog_id();
				$event_data['SiteURL'] = get_site_url( $event_data['SiteID'] );
			}

			/**
			 * WSAL Filter: `wsal_event_id_before_log`.
			 *
			 * Filters event id before logging it to the database.
			 *
			 * @since 3.3.1
			 *
			 * @param int   $event_id   - Event ID.
			 * @param array $event_data - Event data.
			 */
			$event_id = \apply_filters( 'wsal_event_id_before_log', $event_id, $event_data );

			/**
			 * WSAL Filter: `wsal_event_data_before_log`.
			 *
			 * Filters event data before logging it to the database.
			 *
			 * @since 3.3.1
			 *
			 * @param array $event_data - Event data.
			 * @param int   $event_id   - Event ID.
			 */
			$event_data = \apply_filters( 'wsal_event_data_before_log', $event_data, $event_id );


			foreach ( self::get_loggers() as $logger ) {
				if ( $logger instanceof \WSAL\Loggers\WSAL_Ext_MirrorLogger ) {
					$logger->log( $event_id, $event_data );
				} else {
					$logger::log( $event_id, $event_data );
				}
			}
		}

		/**
		 * Returns all the alerts. If the array with the alerts is not initialized - it first tries to initialize it.
		 *
		 * @since 4.5.0
		 */
		public static function get_alerts(): array {
			if ( empty( self::$alerts ) ) {
				if ( ! \function_exists( 'set_wsal_alerts' ) ) {
					\WpSecurityAuditLog::load_defaults();
				}
				set_wsal_alerts();
			}

			if ( ! array( self::$alerts ) ) {
				self::$alerts = array();
			}

			return self::$alerts;
		}

		/**
		 * Add newly created logger to list.
		 *
		 * @param \WSAL_AbstractLogger $logger The new logger.
		 *
		 * @since 4.5.0
		 */
		public static function add_logger_instance( \WSAL_AbstractLogger $logger ) {
			self::get_loggers();
			self::$loggers[] = $logger;
		}

		/**
		 * Collects all loggers (if not already) and returns them.
		 *
		 * @since 4.5.0
		 */
		public static function get_loggers(): array {
			if ( empty( self::$loggers ) ) {
				$loggers_list = Classes_Helper::get_classes_by_namespace( '\WSAL\Loggers' );

				foreach ( $loggers_list as $class_name ) {
					self::$loggers[] = ( new $class_name() );
				}
			}

			return self::$loggers;
		}


		/**
		 * Method: Runs over triggered alerts in pipeline and passes them to loggers.
		 *
		 * @internal
		 *
		 * @since 5.1.1
		 */
		public static function commit_pipeline() {
			foreach ( self::$pipeline as $key => $item ) {
				unset( self::$pipeline[ $key ] );
				self::commit_item( $item['type'], $item['data'], $item['cond'] );
				self::$pipeline[ $key ] = $item;
			}
		}

		/**
		 * Returns the list with all the deprecated events.
		 *
		 * @return array
		 *
		 * @since 4.5.0
		 */
		public static function get_deprecated_events() {
			if ( empty( self::$deprecated_events ) ) {
				self::$deprecated_events = apply_filters( 'wsal_deprecated_event_ids', array( 0000, 0001, 0002, 0003, 0004, 0005, 2004, 2005, 2006, 2007, 2009, 2013, 2015, 2018, 2020, 2022, 2026, 2028, 2059, 2060, 2061, 2064, 2066, 2069, 2075, 2087, 2102, 2103, 2113, 2114, 2115, 2116, 2117, 2118, 5020, 5026, 2107, 2003, 2029, 2030, 2031, 2032, 2033, 2034, 2035, 2036, 2037, 2038, 2039, 2040, 2041, 2056, 2057, 2058, 2063, 2067, 2068, 2070, 2072, 2076, 2088, 2104, 2105, 5021, 5027, 2108, 7014, 7015, 7016, 7017 ) );
			}

			return self::$deprecated_events;
		}

		/**
		 * Method: True if at the end of request an alert of this type will be triggered.
		 *
		 * @param int $type  - Alert type ID.
		 * @param int $count - A minimum number of event occurrences.
		 *
		 * @since 4.5.0
		 */
		public static function will_trigger( $type, $count = 1 ): bool {
			$number_found = 0;
			foreach ( self::$pipeline as $item ) {
				if ( $item['type'] === $type ) {
					++$number_found;
					if ( 1 === $count || $number_found === $count ) {
						return true;
					}
				}
			}

			return false;
		}

		/**
		 * Method: True if an alert has been or will be triggered in this request, false otherwise.
		 *
		 * @param int $type  - Alert type ID.
		 * @param int $count - A minimum number of event occurrences.
		 *
		 * @return bool
		 *
		 * @since 4.5.0
		 */
		public static function will_or_has_triggered( $type, $count = 1 ) {
			return in_array( $type, self::$triggered_types, true ) || self::will_trigger( $type, $count );
		}

		/**
		 * Method: True if an alert has been or will be triggered in this request, false otherwise.
		 *
		 * @param int $type  - Alert type ID.
		 * @param int $count - A minimum number of event occurrences.
		 *
		 * @return bool
		 *
		 * @since 4.5.0
		 */
		public static function has_triggered( $type, $count = 1 ) {
			return in_array( $type, self::$triggered_types, true );
		}

		/**
		 * Method: Returns array of alerts by category.
		 *
		 * @param string $category - Alerts category.
		 *
		 * @return WSAL_Alert[]
		 *
		 * @since 4.5.0
		 */
		public static function get_alerts_by_category( $category ) {
			// Categorized alerts array.
			$alerts = array();
			foreach ( self::get_alerts() as $alert ) {
				if ( $category === $alert['category'] ) {
					$alerts[ $alert['code'] ] = $alert;
				}
			}

			return $alerts;
		}

		/**
		 * Method: Returns array of alerts by sub-category.
		 *
		 * @param string $sub_category - Alerts sub-category.
		 *
		 * @return WSAL_Alert[]
		 *
		 * @since 4.5.0
		 */
		public static function get_alerts_by_sub_category( $sub_category ) {
			// Sub-categorized alerts array.
			$alerts = array();
			foreach ( self::get_alerts() as $alert ) {
				if ( $sub_category === $alert['subcategory'] ) {
					$alerts[ $alert['code'] ] = $alert;
				}
			}

			return $alerts;
		}

		/**
		 * Check if the alert was triggered.
		 *
		 * @param integer|array $alert_id - Alert code.
		 *
		 * @return boolean
		 *
		 * @since 4.5.0
		 */
		public static function was_triggered( $alert_id ) {

			$last_occurrence = Occurrences_Entity::build_query(
				array( 'alert_id' => 'alert_id' ),
				array(),
				array( 'created_on' => 'DESC' ),
				array( 1 )
			);

			if ( ! empty( $last_occurrence ) && isset( $last_occurrence[0]['alert_id'] ) ) {
				if ( ! is_array( $alert_id ) && (int) $last_occurrence[0]['alert_id'] === (int) $alert_id ) {
					return true;
				} elseif ( is_array( $alert_id ) && in_array( (int) $last_occurrence[0]['alert_id'], $alert_id, true ) ) {
					return true;
				}
			}

			return false;
		}

		/**
		 * Check if the alert was triggered recently.
		 *
		 * Checks last 5 events if they occurred less than self::$seconds_to_check_back seconds ago.
		 *
		 * @param int|array $alert_id - Alert code.
		 *
		 * @return bool
		 *
		 * @since 4.6.3
		 */
		public static function was_triggered_recently( $alert_id ) {
			// if we have already checked this don't check again.
			if ( isset( self::$cached_alert_checks ) && array_key_exists( $alert_id, self::$cached_alert_checks ) && self::$cached_alert_checks[ $alert_id ] ) {
				return true;
			}

			$last_occurrences = self::get_latest_events( 5 );

			$known_to_trigger = false;

			if ( \is_array( $last_occurrences ) ) {
				foreach ( $last_occurrences as $last_occurrence ) {
					if ( $known_to_trigger ) {
						break;
					}
					if ( ! empty( $last_occurrence ) && \is_array( $last_occurrence ) && \key_exists( 'created_on', $last_occurrence ) && ( $last_occurrence['created_on'] + self::$seconds_to_check_back ) > time() ) {
						if ( ! is_array( $alert_id ) && (int) $last_occurrence['alert_id'] === $alert_id ) {
							$known_to_trigger = true;
						} elseif ( is_array( $alert_id ) && in_array( (int) $last_occurrence[0]['alert_id'], $alert_id, true ) ) {
							$known_to_trigger = true;
						}
					}
				}
			}
			// once we know the answer to this don't check again to avoid queries.
			self::$cached_alert_checks[ $alert_id ] = $known_to_trigger;

			return $known_to_trigger;
		}

		/**
		 * Get latest events from DB.
		 *
		 * @param int  $limit – Number of events.
		 * @param bool $include_meta - Should we include meta to the collected events.
		 * @param bool $first - If is set to true, it will extract oldest events (default is most recent ones).
		 *
		 * @return array|bool
		 *
		 * @since 4.5.0
		 * @since 5.0.0 $first flag is added
		 */
		public static function get_latest_events( $limit = 1, bool $include_meta = false, bool $first = false ) {

			if ( ! Occurrences_Entity::get_connection()->has_connected ) {
				// Connection problem while using external database (if local database is used, we would see WordPress's
				// "Error Establishing a Database Connection" screen).
				return false;
			}

			$direction = 'DESC';
			if ( $first ) {
				$direction = 'ASC';
			}

			$query = array();

			// Get site id.
			$site_id = (int) WP_Helper::get_view_site_id();

			$site_id = \apply_filters( 'wsal_alter_site_id', $site_id );

			// if we have a blog id then add it.
			if ( $site_id && 0 < $site_id ) {
				$query['AND'][] = array( ' site_id = %s ' => $site_id );
			}

			if ( ! $include_meta ) {
				$events = Occurrences_Entity::build_query( array(), $query, array( 'created_on' => $direction ), array( $limit ) );
			} else {

				$meta_table_name = Metadata_Entity::get_table_name();
				$join_clause     = array(
					$meta_table_name => array(
						'direction'   => 'LEFT',
						'join_fields' => array(
							array(
								'join_field_left'  => 'occurrence_id',
								'join_table_right' => Occurrences_Entity::get_table_name(),
								'join_field_right' => 'id',
							),
						),
					),
				);
				// order results by date and return the query.
				$meta_full_fields_array       = Metadata_Entity::prepare_full_select_statement();
				$occurrence_full_fields_array = Occurrences_Entity::prepare_full_select_statement();

				/**
				 * Limit here is set to $limit * 15, because now we have to extract metadata as well.
				 * Because of that we can not use limit directly here. We will extract enough data to include the metadata as well and limit the results later on - still fastest than creating enormous amount of queries.
				 * Currently there are no more than 10 records (meta) per occurrence, we are using 12 just in case.
				 */
				$events = Occurrences_Entity::build_query( array_merge( $meta_full_fields_array, $occurrence_full_fields_array ), $query, array( 'created_on' => $direction ), array( $limit * 12 ), $join_clause );

				$events = Occurrences_Entity::prepare_with_meta_data( $events );

				$events = array_slice( $events, 0, $limit );
			}

			if ( ! empty( $events ) && is_array( $events ) ) {
				return $events;
			}

			return array();
		}

		/**
		 * Method: Log the message for sensor.
		 *
		 * @param int    $type    - Type of alert.
		 * @param string $message - Alert message.
		 * @param mixed  $args    - Message arguments.
		 *
		 * @since 5.1.1
		 */
		public static function log_problem( $type, $message, $args ) {
			self::trigger_event(
				$type,
				array(
					'Message' => $message,
					'Context' => $args,
					'Trace'   => debug_backtrace(), //phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_debug_backtrace
				)
			);
		}

		/**
		 * Method: Log error message for sensor.
		 *
		 * @param string $message - Alert message.
		 * @param mixed  $args    - Message arguments.
		 *
		 * @since 4.5.0
		 */
		public static function log_error( $message, $args ) {
			self::log_problem( 0001, $message, $args );
		}

		/**
		 * Method: Log warning message for sensor.
		 *
		 * @param string $message - Alert message.
		 * @param mixed  $args    - Message arguments.
		 *
		 * @since 4.5.0
		 */
		public static function log_warn( $message, $args ) {
			self::log_problem( 0002, $message, $args );
		}

		/**
		 * Method: Log info message for sensor.
		 *
		 * @param string $message - Alert message.
		 * @param mixed  $args    - Message arguments.
		 *
		 * @since 4.5.0
		 */
		protected function log_info( $message, $args ) {
			self::log_problem( 0003, $message, $args );
		}

		/**
		 * Get event type data array or optionally just value of a single type.
		 *
		 * @param string $type A type that the string is requested for (optional).
		 *
		 * @return array|string
		 *
		 * @since 4.5.0
		 */
		public static function get_event_type_data( $type = '' ) {
			if ( empty( self::$event_types ) ) {

				self::$event_types = array(
					'login'        => esc_html__( 'Login', 'wp-security-audit-log' ),
					'logout'       => esc_html__( 'Logout', 'wp-security-audit-log' ),
					'installed'    => esc_html__( 'Installed', 'wp-security-audit-log' ),
					'activated'    => esc_html__( 'Activated', 'wp-security-audit-log' ),
					'deactivated'  => esc_html__( 'Deactivated', 'wp-security-audit-log' ),
					'uninstalled'  => esc_html__( 'Uninstalled', 'wp-security-audit-log' ),
					'updated'      => esc_html__( 'Updated', 'wp-security-audit-log' ),
					'created'      => esc_html__( 'Created', 'wp-security-audit-log' ),
					'modified'     => esc_html__( 'Modified', 'wp-security-audit-log' ),
					'deleted'      => esc_html__( 'Deleted', 'wp-security-audit-log' ),
					'assigned'     => esc_html__( 'Assigned', 'wp-security-audit-log' ),
					'published'    => esc_html__( 'Published', 'wp-security-audit-log' ),
					'approved'     => esc_html__( 'Approved', 'wp-security-audit-log' ),
					'unapproved'   => esc_html__( 'Unapproved', 'wp-security-audit-log' ),
					'enabled'      => esc_html__( 'Enabled', 'wp-security-audit-log' ),
					'disabled'     => esc_html__( 'Disabled', 'wp-security-audit-log' ),
					'added'        => esc_html__( 'Added', 'wp-security-audit-log' ),
					'failed-login' => esc_html__( 'Failed Login', 'wp-security-audit-log' ),
					'blocked'      => esc_html__( 'Blocked', 'wp-security-audit-log' ),
					'uploaded'     => esc_html__( 'Uploaded', 'wp-security-audit-log' ),
					'restored'     => esc_html__( 'Restored', 'wp-security-audit-log' ),
					'opened'       => esc_html__( 'Opened', 'wp-security-audit-log' ),
					'viewed'       => esc_html__( 'Viewed', 'wp-security-audit-log' ),
					'started'      => esc_html__( 'Started', 'wp-security-audit-log' ),
					'stopped'      => esc_html__( 'Stopped', 'wp-security-audit-log' ),
					'removed'      => esc_html__( 'Removed', 'wp-security-audit-log' ),
					'unblocked'    => esc_html__( 'Unblocked', 'wp-security-audit-log' ),
					'renamed'      => esc_html__( 'Renamed', 'wp-security-audit-log' ),
					'duplicated'   => esc_html__( 'Duplicated', 'wp-security-audit-log' ),
					'submitted'    => esc_html__( 'Submitted', 'wp-security-audit-log' ),
					'revoked'      => esc_html__( 'Revoked', 'wp-security-audit-log' ),
					'sent'         => esc_html__( 'Sent', 'wp-security-audit-log' ),
					'executed'     => esc_html__( 'Executed', 'wp-security-audit-log' ),
					'failed'       => esc_html__( 'Failed', 'wp-security-audit-log' ),
					'denied'       => esc_html__( 'Denied', 'wp-security-audit-log' ),
					'available'    => esc_html__( 'Available', 'wp-security-audit-log' ),
					'completed'    => esc_html__( 'Completed', 'wp-security-audit-log' ),
					'connected'    => esc_html__( 'Connected', 'wp-security-audit-log' ),
					'disconnected' => esc_html__( 'Disconnected', 'wp-security-audit-log' ),
				);
				// sort the types alphabetically.
				asort( self::$event_types );
				self::$event_types = apply_filters(
					'wsal_event_type_data',
					self::$event_types
				);
			}

			/*
			 * If a specific type was requested then try return that otherwise the
			 * full array gets returned.
			 *
			 * @since 4.0.3
			 */
			if ( ! empty( $type ) ) {
				// NOTE: if we requested type doesn't exist returns 'unknown type'.
				return ( isset( self::$event_types[ $type ] ) ) ? self::$event_types[ $type ] : __( 'unknown type', 'wp-security-audit-log' );
			}

			// if a specific type was not requested return the full array.
			return self::$event_types;
		}

		/**
		 * Get event objects.
		 *
		 * @param string $object An object the string is requested for (optional).
		 *
		 * @return array|string
		 *
		 * @since 4.5.0
		 */
		public static function get_event_objects_data( $object = '' ) {
			if ( empty( self::$objects_data ) ) {

				self::$objects_data = array(
					'user'              => esc_html__( 'User', 'wp-security-audit-log' ),
					'system'            => esc_html__( 'System', 'wp-security-audit-log' ),
					'plugin'            => esc_html__( 'Plugin', 'wp-security-audit-log' ),
					'database'          => esc_html__( 'Database', 'wp-security-audit-log' ),
					'post'              => esc_html__( 'Post', 'wp-security-audit-log' ),
					'file'              => esc_html__( 'File', 'wp-security-audit-log' ),
					'tag'               => esc_html__( 'Tag', 'wp-security-audit-log' ),
					'comment'           => esc_html__( 'Comment', 'wp-security-audit-log' ),
					'setting'           => esc_html__( 'Setting', 'wp-security-audit-log' ),
					'system-setting'    => esc_html__( 'System Setting', 'wp-security-audit-log' ),
					'cron-job'          => esc_html__( 'Cron Jobs', 'wp-security-audit-log' ),
					'mainwp-network'    => esc_html__( 'MainWP Network', 'wp-security-audit-log' ),
					'mainwp'            => esc_html__( 'MainWP', 'wp-security-audit-log' ),
					'category'          => esc_html__( 'Category', 'wp-security-audit-log' ),
					'custom-field'      => esc_html__( 'Custom Field', 'wp-security-audit-log' ),
					'widget'            => esc_html__( 'Widget', 'wp-security-audit-log' ),
					'menu'              => esc_html__( 'Menu', 'wp-security-audit-log' ),
					'theme'             => esc_html__( 'Theme', 'wp-security-audit-log' ),
					'activity-log'      => esc_html__( 'Activity log', 'wp-security-audit-log' ),
					'wp-activity-log'   => esc_html__( 'WP Activity Log', 'wp-security-audit-log' ),
					'multisite-network' => esc_html__( 'Multisite Network', 'wp-security-audit-log' ),
					'ip-address'        => esc_html__( 'IP Address', 'wp-security-audit-log' ),
				);

				asort( self::$objects_data );
				self::$objects_data = apply_filters(
					'wsal_event_objects',
					self::$objects_data
				);
			}

			/*
			 * If a specific object was requested then try return that otherwise
			 * the full array gets returned.
			 *
			 * @since 4.0.3
			 */
			if ( ! empty( $object ) ) {
				// NOTE: if we requested object doesn't exist returns 'unknown object'.
				return ( isset( self::$objects_data[ $object ] ) ) ? self::$objects_data[ $object ] : __( 'unknown object', 'wp-security-audit-log' );
			}

			// if a specific object was not requested return the full array.
			return self::$objects_data;
		}

		/**
		 * Return user data array of the events.
		 *
		 * @param string $username – Username.
		 *
		 * @return array
		 *
		 * @since 4.5.0
		 */
		public static function get_event_user_data( $username ) {
			// User data.
			$user_data = array();

			// Handle WSAL usernames.
			if ( empty( $username ) ) {
				$user_data['username'] = 'System';
			} elseif ( 'Plugin' === $username ) {
				$user_data['username'] = 'Plugin';
			} elseif ( 'Plugins' === $username ) {
				$user_data['username'] = 'Plugins';
			} elseif ( 'Website Visitor' === $username || 'Unregistered user' === $username ) {
				$user_data['username'] = 'Unregistered user';
			} else {
				// Check WP user.
				if ( isset( self::$wp_users[ $username ] ) ) {
					// Retrieve from users cache.
					$user_data = self::$wp_users[ $username ];
				} else {
					// Get user from WP.
					$user = \get_user_by( 'login', $username );

					if ( $user && $user instanceof \WP_User ) {
						// Store the user data in class member.
						self::$wp_users[ $username ] = array(
							'ID'            => $user->ID,
							'user_login'    => $user->user_login,
							'first_name'    => $user->first_name,
							'last_name'     => $user->last_name,
							'display_name'  => $user->display_name,
							'user_email'    => $user->user_email,
							'user_nicename' => $user->user_nicename,
							'user_roles'    => User_Helper::get_user_roles( $user ),
						);

						$user_data = self::$wp_users[ $username ];
					}
				}

				// Set user data.
				if ( ! $user ) {
					$user_data['username'] = 'System';
				}
			}

			return $user_data;
		}

		/**
		 * Returns the cached wp users.
		 *
		 * @return array
		 *
		 * @since 4.5.0
		 */
		public static function get_wp_users() {
			return self::$wp_users;
		}

		/**
		 * Get event for WP-Admin bar.
		 *
		 * @param bool $from_db - Query from DB if set to true.
		 *
		 * @return WSAL_Models_Occurrence|bool
		 *
		 * @since 4.5.0
		 */
		public static function get_admin_bar_event( $from_db = false ) {
			// Get event from transient.
			$event_transient = 'wsal_admin_bar_event';
			$admin_bar_event = WP_Helper::get_transient( $event_transient );
			if ( false === $admin_bar_event || false !== $from_db ) {
				$event = self::get_latest_events( 1 );

				if ( $event ) {
					WP_Helper::set_transient( $event_transient, $event[0], 30 * MINUTE_IN_SECONDS );
					$admin_bar_event = $event[0];
				}
			}

			return $admin_bar_event;
		}

		/**
		 * Returns all supported alerts.
		 *
		 * @param bool $sorted – Sort the alerts array or not.
		 *
		 * @return array
		 *
		 * @since 4.5.0
		 */
		public static function get_categorized_alerts( $sorted = true ) {

			$result = array();

			foreach ( self::get_alerts() as $alert ) {
				if ( ! isset( $result[ \html_entity_decode( $alert['category'] ) ] ) ) {
					$result[ \html_entity_decode( $alert['category'] ) ] = array();
				}
				if ( ! isset( $result[ \html_entity_decode( $alert['category'] ) ][ \html_entity_decode( $alert['subcategory'] ) ] ) ) {
					$result[ \html_entity_decode( $alert['category'] ) ][ \html_entity_decode( $alert['subcategory'] ) ] = array();
				}
				$result[ \html_entity_decode( $alert['category'] ) ][ \html_entity_decode( $alert['subcategory'] ) ][] = $alert;
			}

			if ( $sorted ) {
				ksort( $result );
			}

			return $result;
		}

		/**
		 * Returns give alert property by its id
		 *
		 * @param int    $alert_id - The id of the alert.
		 * @param string $property - The property name.
		 *
		 * @return mixed
		 *
		 * @since 4.5.0
		 */
		public static function get_alert_property( $alert_id, $property ) {

			if ( isset( self::get_alerts()[ $alert_id ] ) && isset( self::get_alerts()[ $alert_id ][ $property ] ) ) {
				return self::get_alerts()[ $alert_id ][ $property ];
			}

			return false;
		}

		/**
		 * Disables the alert by its identifier
		 *
		 * @param string|array $alert - The array or comma separated string with the ids that needs to be set as disabled.
		 *
		 * @return false|void
		 *
		 * @since 5.2.2
		 */
		public static function disable_enable_alert( $alert ) {

			if ( \is_array( $alert ) && ! empty( $alert ) ) {
				$alert = array_unique( array_map( 'intval', $alert ) );
			} elseif ( \is_array( $alert ) && empty( $alert ) ) {
				return false;
			}

			if ( \is_string( $alert ) ) {
				$alert = \explode( ',', $alert );
				$alert = array_unique( array_map( 'intval', $alert ) );
			}

			if ( empty( $alert ) ) {
				return false;
			}

			$currently_disabled = Settings_Helper::get_disabled_alerts();
			$disabled           = \array_flip( $currently_disabled );
			$enabled            = array();

			foreach ( $alert as $alert_id ) {
				if ( in_array( $alert_id, $currently_disabled, true ) ) {
					$enabled[] = $alert_id;
					unset( $disabled[ $alert_id ] );
				} else {
					$disabled[ $alert_id ] = '';
				}
			}

			$disabled = \array_flip( $disabled );

			$disabled = \apply_filters( 'wsal_save_settings_disabled_events', $disabled, self::get_alerts(), array(), $enabled );

			// Report any changes as an event.
			self::report_enabled_disabled_event( $enabled, $disabled );

			// Save the disabled events.
			Settings_Helper::set_disabled_alerts( $disabled ); // Save the disabled events.
		}

		/**
		 * Reports an event if an alert has been disabled/enabled.
		 *
		 * @param array $enabled - Array of enabled event IDs prior to saving.
		 * @param array $disabled - Array of disabled events prior to saving.
		 * @param bool  $is_frontend - If set as frontend - check the frontend event codes.
		 *
		 * @return void
		 *
		 * @since 5.2.2
		 */
		public static function report_enabled_disabled_event( $enabled, $disabled, $is_frontend = false ) {

			if ( $is_frontend ) {
				$current_enabled = $enabled;
				$fresh_enabled   = $disabled;
				$frontend_labels = array(
					'register'    => esc_html__( 'Keep a log when a visitor registers a user on the website. Only enable this if you allow visitors to register as users on your website. User registration is disabled by default in WordPress.', 'wp-security-audit-log' ),
					'login'       => esc_html__( 'Keep a log of user log in activity on custom login forms (such as WooCommerce & membership plugins)', 'wp-security-audit-log' ),
					'woocommerce' => esc_html__( 'Keep a log of visitor orders, stock changes and other public events?', 'wp-security-audit-log' ),
				);

				$frontend_codes = array(
					'register'     => 4000,
					'login'        => 1000,
					'woocommerce'  => 9035,
					'gravityforms' => 5709,
				);

				foreach ( $current_enabled as $frontend_event => $value ) {
					if ( $value !== $fresh_enabled[ $frontend_event ] ) {
						self::trigger_event(
							6060,
							array(
								'ID'          => $frontend_codes[ $frontend_event ],
								'description' => $frontend_labels[ $frontend_event ],
								'EventType'   => ( $fresh_enabled[ $frontend_event ] ) ? 'enabled' : 'disabled',
							)
						);
					}
				}
			} else {
				// Grab currently saved list of disabled events for comparison.
				$currently_disabled = Settings_Helper::get_disabled_alerts();

				// Further remove items which are disabled in the UI but potentially not saved as disabled in the settings yet (for example fresh WSAL install).
				$obsolete_events  = array( 9999, 2126, 99999, 0000, 0001, 0002, 0003, 0004, 0005, 0006 );
				$obsolete_events  = apply_filters( 'wsal_togglealerts_obsolete_events', $obsolete_events );
				$ms_alerts        = ( ! WP_Helper::is_multisite() ) ? array_keys( self::get_alerts_by_category( 'Multisite Network Sites' ) ) : array();
				$ms_user_alerts   = ( ! WP_Helper::is_multisite() ) ? array_keys( self::get_alerts_by_sub_category( 'Multisite User Profiles' ) ) : array();
				$wc_alerts        = ( ! Woocommerce_Helper::load_alerts_for_sensor() ) ? array_keys( self::get_alerts_by_category( 'WooCommerce' ) ) : array();
				$yoast_alerts     = ( ! Yoast_SEO_Helper::load_alerts_for_sensor() ) ? array_keys( self::get_alerts_by_category( 'Yoast SEO' ) ) : array();
				$deprecated_event = self::get_deprecated_events();
				$always_disabled  = Settings_Helper::get_default_always_disabled_alerts();
				$events_to_ignore = array_merge( $obsolete_events, $ms_alerts, $always_disabled, $deprecated_event, $ms_user_alerts, $wc_alerts, $yoast_alerts );

				// Remove items we dont want to trigger alerts for here.
				$disabled = array_diff( $disabled, $events_to_ignore );

				// Check for events which are newly enabled.
				foreach ( $enabled as $enabled_alert_id ) {
					if ( in_array( $enabled_alert_id, $currently_disabled, true ) ) {
						$alert_data = Alert::get_alert( $enabled_alert_id );
						self::trigger_event(
							6060,
							array(
								'ID'          => $enabled_alert_id,
								'description' => $alert_data['desc'],
								'EventType'   => 'enabled',
							)
						);
					}
				}

				// Check for events which are newly disabled.
				foreach ( $disabled as $disabled_alert_id ) {
					if ( ! in_array( $disabled_alert_id, $currently_disabled, true ) ) {
						$alert_data = Alert::get_alert( $disabled_alert_id );
						self::trigger_event(
							6060,
							array(
								'ID'          => $disabled_alert_id,
								'description' => $alert_data['desc'],
								'EventType'   => 'disabled',
							)
						);
					}
				}
			}
		}
	}
}