<?php
declare(strict_types=1);


namespace OneClickFormSync\Mapping;

if (!defined('ABSPATH')) {
    exit;
}

/**
 * Handles input sanitization and formula injection protection for spreadsheet cells.
 */
class ValueSanitizer
{
    /**
     * Sanitize and format a field value for writing to a sheet.
     *
     * @param mixed $value
     * @return string Sanitized cell value.
     */
    public function sanitize($value): string
    {
        if (is_array($value)) {
            // Flatten arrays (e.g., checkboxes, multi-selects) into comma-separated text.
            $value = implode(', ', $value);
        }

        $stringValue = trim((string)$value);

        return $this->protectFormulaInjection($stringValue);
    }

    /**
     * Prevents Spreadsheet Formula Injection (CSV Injection) attacks.
     *
     * @param string $value
     * @return string Escaped cell value.
     */
    private function protectFormulaInjection(string $value): string
    {
        if ($value === '') {
            return '';
        }

        $formulaChars = ['=', '+', '-', '@', "\t", "\r"];
        $firstChar = substr($value, 0, 1);

        if (in_array($firstChar, $formulaChars, true)) {
            // Prepend a single quote to instruct Google Sheets to treat this cell value strictly as raw text.
            return "'" . $value;
        }

        return $value;
    }
}