<?php
/**
 * The shortcode that places a form, and the rule for when the assets load at all.
 *
 * Copyright (c) 2026 Quantum, Serbia. https://2ranq.com
 *
 * This program is free software: you can redistribute it and change it under
 * the terms of the GNU General Public License as published by the Free Software
 * Foundation, either version 2 of the License, or any later version. The full
 * text is in LICENSE.txt, next to this file.
 *
 * @package Ranq_Forms
 */

defined( 'ABSPATH' ) || exit;

/**
 * Ranq_Forms_Shortcode
 */
class Ranq_Forms_Shortcode {

	/**
	 * Whether the assets are already queued on this request.
	 *
	 * @var bool
	 */
	private static $enqueued = false;

	/**
	 * Whether the section style is already queued on this request.
	 *
	 * It is counted SEPARATELY from the form style. One shared switch has already
	 * swallowed the section style once: the form would turn it on while
	 * rendering, and the check on the page content would leave through the door
	 * before it ever reached the section.
	 *
	 * @var bool
	 */
	private static $sections_enqueued = false;

	/**
	 * Registers the shortcode and the asset setup.
	 *
	 * @return void
	 */
	public static function register() {

		// The company name starts with a digit, and a shortcode allows that, so there
		// is no reason to shorten it here. The old name stays registered forever,
		// because it is already written into pages that are published.
		add_shortcode( '2ranq_form', array( __CLASS__, 'render' ) );
		add_shortcode( 'ranq_form', array( __CLASS__, 'render' ) );

		// Registering costs nothing, only `enqueue` sends a file to the visitor.
		add_action( 'wp_enqueue_scripts', array( __CLASS__, 'register_assets' ) );

		// When the shortcode is in the page content, we send the assets in the head.
		add_action( 'wp_enqueue_scripts', array( __CLASS__, 'maybe_enqueue' ), 20 );
	}

	/**
	 * Only registers, sends nothing.
	 *
	 * @return void
	 */
	public static function register_assets() {

		// Whoever wants to style it themselves turns our style sheet off in the
		// settings. The form still works, it just inherits what the theme does.
		if ( ! get_option( 'ranq_forms_disable_styles', false ) ) {
			wp_register_style(
				'ranq-forms',
				RANQ_FORMS_URL . 'assets/css/form.css',
				array(),
				RANQ_FORMS_VERSION
			);

			// The sections are their own file, because a page usually has no section
			// but does have a form. Without that split fifty kilobytes travel for nothing.
			wp_register_style(
				'ranq-forms-sections',
				RANQ_FORMS_URL . 'assets/css/sections.css',
				array( 'ranq-forms' ),
				RANQ_FORMS_VERSION
			);
		}

		// No jQuery. That is an order, not a suggestion.
		wp_register_script(
			'ranq-forms',
			RANQ_FORMS_URL . 'assets/js/form.js',
			array(),
			RANQ_FORMS_VERSION,
			true
		);

		// The words the script prints, so they can be translated.
		wp_localize_script(
			'ranq-forms',
			'ranqFormsText',
			array(
				'next'   => __( 'Next', '2ranq-forms' ),
				'back'   => __( 'Back', '2ranq-forms' ),
				'stepOf' => __( 'Step', '2ranq-forms' ),
			)
		);
	}

	/**
	 * Sends the assets only when this page really has a form on it.
	 *
	 * @return void
	 */
	public static function maybe_enqueue() {

		// 🔴 `self::$enqueued` must NOT stand here as a reason to leave. A theme built
		// out of blocks renders the page BEFORE the head is printed, so the form gets
		// to turn its own style on before this check even runs. With the old
		// condition we would leave through the door and the section style would never
		// arrive: a section placed as a pattern came out bare on a live page.
		if ( ! is_singular() ) {
			return;
		}

		$post = get_post();

		if ( ! $post instanceof WP_Post ) {
			return;
		}

		// Both shortcode names. The new one starts with a digit, the old one stays forever.
		$ima_formu = has_shortcode( $post->post_content, '2ranq_form' )
			|| has_shortcode( $post->post_content, 'ranq_form' )
			|| has_block( 'ranq/form', $post );

		// A section placed as a pattern sits in the content as ordinary blocks, so it
		// cannot be found by the shortcode or by the block. It is recognised by the
		// class every one of our sections carries.
		$ima_sekciju = has_shortcode( $post->post_content, '2ranq_widget' )
			|| has_shortcode( $post->post_content, 'ranq_widget' )
			|| false !== strpos( $post->post_content, 'alignfull ranq-' );

		if ( $ima_sekciju ) {
			self::enqueue_sections();

			return;
		}

		if ( $ima_formu ) {
			self::enqueue();
		}
	}

	/**
	 * Queues the assets, once per request.
	 *
	 * @return void
	 */
	public static function enqueue() {

		if ( self::$enqueued ) {
			return;
		}

		wp_enqueue_style( 'ranq-forms' );
		wp_enqueue_script( 'ranq-forms' );

		self::$enqueued = true;
	}

	/**
	 * Sends the section style.
	 *
	 * Called only when a section is really being rendered, from the widget or
	 * from the content of a page our pattern sits in.
	 *
	 * @return void
	 */
	public static function enqueue_sections() {

		self::enqueue();

		if ( self::$sections_enqueued ) {
			return;
		}

		wp_enqueue_style( 'ranq-forms-sections' );

		self::$sections_enqueued = true;
	}

	/**
	 * The small form that asks for a password.
	 *
	 * @param int $form_id The form id.
	 *
	 * @return string
	 */
	private static function password_gate( $form_id ) {

		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- only a message, no action is carried out.
		$promasaj = isset( $_POST['ranq_forms_password'] );

		$style = Ranq_Forms_Design::inline_style( $form_id );

		ob_start();
		?>
		<form class="ranq-form ranq-form--gate" method="post" <?php if ( $style ) : ?>style="<?php echo esc_attr( $style ); ?>"<?php endif; ?>>
			<?php if ( Ranq_Forms_Form_Settings::password_locked_out() ) : ?>
				<div class="ranq-form__notice ranq-form__notice--bad" role="alert">
					<?php esc_html_e( 'Too many tries from your connection. Please wait a few minutes.', '2ranq-forms' ); ?>
				</div>
			<?php elseif ( $promasaj ) : ?>
				<div class="ranq-form__notice ranq-form__notice--bad" role="alert">
					<?php esc_html_e( 'That password is not right.', '2ranq-forms' ); ?>
				</div>
			<?php endif; ?>

			<div class="ranq-field">
				<label class="ranq-field__label" for="<?php echo esc_attr( 'ranq-pw-' . $form_id ); ?>">
					<?php esc_html_e( 'Password', '2ranq-forms' ); ?>
				</label>
				<input
					class="ranq-field__input"
					type="password"
					id="<?php echo esc_attr( 'ranq-pw-' . $form_id ); ?>"
					name="ranq_forms_password"
					autocomplete="off"
					required
				/>
			</div>

			<button type="submit" class="ranq-form__submit"><?php esc_html_e( 'Open the form', '2ranq-forms' ); ?></button>
		</form>
		<?php

		return (string) ob_get_clean();
	}

	/**
	 * Prints the form.
	 *
	 * @param array $atts The shortcode attributes.
	 *
	 * @return string
	 */
	public static function render( $atts ) {

		$atts = shortcode_atts(
			array(
				'id' => 0,
			),
			$atts,
			'2ranq_form'
		);

		$form_id = absint( $atts['id'] );

		if ( ! $form_id ) {
			return '';
		}

		$form = get_post( $form_id );

		if ( ! $form instanceof WP_Post || Ranq_Forms_Post_Type::POST_TYPE !== $form->post_type ) {
			return '';
		}

		$settings = Ranq_Forms_Form_Settings::get( $form_id );

		// The form is closed to guests. In place of the form stands the sentence the
		// owner wrote, so the visitor knows why they see no fields.
		if ( $settings['login_only'] && ! is_user_logged_in() ) {

			$text = '' !== $settings['login_text']
				? $settings['login_text']
				: __( 'Please log in to use this form.', '2ranq-forms' );

			return '<div class="ranq-form ranq-form--locked"><p class="ranq-form__notice">'
				. esc_html( $text ) . '</p></div>';
		}

		// A closed form: before the date, after the date, or filled to the limit. The
		// same rule holds on sending, because sending can be reached around the page.
		$zatvorena = Ranq_Forms_Form_Settings::closed_reason( $form_id );

		if ( '' !== $zatvorena && ! Ranq_Forms_Submission::was_sent( $form_id ) ) {

			self::enqueue();

			return '<div class="ranq-form ranq-form--locked"><p class="ranq-form__notice">'
				. esc_html( Ranq_Forms_Form_Settings::closed_text( $form_id, $zatvorena ) ) . '</p></div>';
		}

		// A password protected form. In place of the fields stands one password field.
		if ( ! Ranq_Forms_Form_Settings::password_ok( $form_id ) ) {

			self::enqueue();

			return self::password_gate( $form_id );
		}

		// After a successful send the fields are taken away, unless the owner asks for
		// them to stay, for example when a form is filled in several times in a row.
		$hide_after = Ranq_Forms_Submission::was_sent( $form_id ) && ! $settings['confirm_keep'];

		// The assets only now, once we know the form really exists.
		self::enqueue();

		// The design travels as custom properties in an attribute, not as a file of its
		// own. Only what differs from the default is printed, so the attribute is short
		// or not there at all.
		$style = Ranq_Forms_Design::inline_style( $form_id );

		// A form with a file attached has to use a different way of sending, or the
		// file never reaches the server.
		$has_file = false;

		foreach ( Ranq_Forms_Fields::get_form_fields( $form_id ) as $one ) {
			if ( isset( $one['type'] ) && 'file' === $one['type'] ) {
				$has_file = true;

				break;
			}
		}

		ob_start();
		?>
		<form
			class="ranq-form"
			method="post"
			<?php echo $has_file ? 'enctype="multipart/form-data"' : ''; ?>
			data-form-id="<?php echo esc_attr( (string) $form_id ); ?>"
			<?php if ( $style ) : ?>
				style="<?php echo esc_attr( $style ); ?>"
			<?php endif; ?>
		>
			<?php wp_nonce_field( 'ranq_forms_submit_' . $form_id, 'ranq_forms_nonce' ); ?>
			<input type="hidden" name="ranq_forms_id" value="<?php echo esc_attr( (string) $form_id ); ?>" />

			<?php
			// The bot trap. The field is moved off the screen, takes no focus and a screen
			// reader skips it, so a person never fills it in. A robot that fills in
			// everything it finds fills that in too, and stops right there.
			?>
			<div class="ranq-hp" aria-hidden="true">
				<label for="<?php echo esc_attr( 'ranq-hp-' . $form_id ); ?>"><?php esc_html_e( 'Leave this field empty', '2ranq-forms' ); ?></label>
				<input
					type="text"
					id="<?php echo esc_attr( 'ranq-hp-' . $form_id ); ?>"
					name="ranq_hp"
					value=""
					tabindex="-1"
					autocomplete="off"
				/>
			</div>

			<?php if ( Ranq_Forms_Submission::was_sent( $form_id ) ) : ?>
				<div class="ranq-form__notice ranq-form__notice--good" role="status">
					<?php echo esc_html( self::success_text( $form_id ) ); ?>
				</div>
			<?php endif; ?>

			<?php
			$errors = Ranq_Forms_Submission::get_errors( $form_id );

			if ( $errors ) :
				?>
				<div class="ranq-form__notice ranq-form__notice--bad" role="alert">
					<p><?php esc_html_e( 'Please check the form and try again.', '2ranq-forms' ); ?></p>
					<ul>
						<?php foreach ( self::error_lines( $form_id, $errors ) as $line ) : ?>
							<li><?php echo esc_html( $line ); ?></li>
						<?php endforeach; ?>
					</ul>
				</div>
			<?php endif; ?>

			<?php if ( ! $hide_after ) : ?>

			<?php
			foreach ( Ranq_Forms_Fields::get_form_fields( $form_id ) as $field ) {

				$type   = isset( $field['type'] ) ? $field['type'] : '';
				$object = Ranq_Forms_Fields::get( $type );

				// An unknown type is skipped quietly. The form has to work even when the
				// module that brought that field is switched off.
				if ( ! $object instanceof Ranq_Forms_Field ) {
					continue;
				}

				$object->render( $field, $form_id );
			}

			/**
			 * After the fields. The hook has been there since day one so that
			 * modules can attach without touching the core.
			 *
			 * @param int $form_id The form id.
			 */
			do_action( 'ranq_forms_render_fields_after', $form_id );
			?>

			<?php
			// The spam check, when the owner entered the keys and this form
			// asks for it.
			echo Ranq_Forms_Spam::field( $form_id ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- everything is escaped in the method itself.
			?>

			<button type="submit" class="ranq-form__submit">
				<?php echo esc_html__( 'Submit', '2ranq-forms' ); ?>
			</button>

			<?php endif; ?>
		</form>
		<?php

		return (string) ob_get_clean();
	}

	/**
	 * The message after a successful send.
	 *
	 * @param int $form_id The form id.
	 *
	 * @return string
	 */
	private static function success_text( $form_id ) {

		$saved = Ranq_Forms_Form_Settings::value( $form_id, 'confirm_message' );

		if ( is_string( $saved ) && '' !== trim( $saved ) ) {
			return $saved;
		}

		return __( 'Thank you. Your message has been sent.', '2ranq-forms' );
	}

	/**
	 * Errors turned into sentences a person understands.
	 *
	 * Every error carries the field label with it, because the message "This
	 * field is required" says nothing without the name of the field.
	 *
	 * @param int   $form_id The form id.
	 * @param array $errors  The errors, by field key.
	 *
	 * @return array
	 */
	private static function error_lines( $form_id, $errors ) {

		$labels = array();

		foreach ( Ranq_Forms_Fields::get_form_fields( $form_id ) as $field ) {

			if ( isset( $field['id'] ) ) {
				$labels[ $field['id'] ] = isset( $field['label'] ) && '' !== $field['label']
					? $field['label']
					: $field['id'];
			}
		}

		$lines = array();

		foreach ( $errors as $key => $message ) {

			$lines[] = isset( $labels[ $key ] )
				? $labels[ $key ] . ': ' . $message
				: $message;
		}

		return $lines;
	}
}