<?php
/**
 * Field: a file upload.
 *
 * All the dangerous work is done by `Ranq_Forms_Uploads`. What sits here is only
 * what belongs to the field: how it looks, what it offers in the settings, and
 * how it is shown in the entry.
 *
 * Copyright (c) 2026 Quantum, Serbia. https://2ranq.com
 *
 * This program is free software: you can redistribute it and change it under
 * the terms of the GNU General Public License as published by the Free Software
 * Foundation, either version 2 of the License, or any later version. The full
 * text is in LICENSE.txt, next to this file.
 *
 * @package Ranq_Forms
 */

defined( 'ABSPATH' ) || exit;

/**
 * Ranq_Forms_Field_File
 */
class Ranq_Forms_Field_File extends Ranq_Forms_Field {

	/**
	 * The type.
	 *
	 * @return string
	 */
	public function get_type() {

		return 'file';
	}

	/**
	 * The name in the builder.
	 *
	 * @return string
	 */
	public function get_label() {

		return __( 'File upload', '2ranq-forms' );
	}

	/**
	 * The icon.
	 *
	 * @return string
	 */
	public function get_icon() {

		return 'dashicons-upload';
	}

	/**
	 * The group.
	 *
	 * @return string
	 */
	public function get_group() {

		return 'fancy';
	}

	/**
	 * The name the file arrives under.
	 *
	 * Files do not travel through `ranq_fields`, they have a name of their own.
	 * That way they do not mix with ordinary fields and they are easier to read
	 * out of `$_FILES`.
	 *
	 * @param array $field The field settings.
	 *
	 * @return string
	 */
	protected function input_name( $field ) {

		return 'ranq_file_' . $this->field_key( $field );
	}

	/**
	 * The file types allowed for this field.
	 *
	 * @param array $field The field settings.
	 *
	 * @return array
	 */
	public function allowed_types( $field ) {

		$raw = isset( $field['file_types'] ) ? (string) $field['file_types'] : '';

		if ( '' === trim( $raw ) ) {
			return Ranq_Forms_Uploads::default_types();
		}

		$list = array();

		foreach ( preg_split( '/[\s,]+/', strtolower( $raw ) ) as $ext ) {

			$ext = ltrim( trim( $ext ), '.' );
			$ext = preg_replace( '/[^a-z0-9]/', '', $ext );

			// What is forbidden stays forbidden even when someone types it in by hand.
			if ( '' !== $ext && ! in_array( $ext, Ranq_Forms_Uploads::forbidden(), true ) ) {
				$list[] = $ext;
			}
		}

		return $list ? array_values( array_unique( $list ) ) : Ranq_Forms_Uploads::default_types();
	}

	/**
	 * The largest size for this field, in bytes.
	 *
	 * Never more than what the server itself allows, whatever the settings say.
	 *
	 * @param array $field The field settings.
	 *
	 * @return int
	 */
	public function max_size( $field ) {

		$server = Ranq_Forms_Uploads::server_limit();
		$wanted = isset( $field['max_size'] ) ? (int) $field['max_size'] : 0;

		if ( $wanted < 1 ) {
			return $server;
		}

		return min( $server, $wanted * MB_IN_BYTES );
	}

	/**
	 * How many files at most.
	 *
	 * @param array $field The field settings.
	 *
	 * @return int
	 */
	public function max_files( $field ) {

		$count = isset( $field['max_files'] ) ? (int) $field['max_files'] : 1;

		return max( 1, min( 10, $count ) );
	}

	/**
	 * The settings.
	 *
	 * @return array
	 */
	public function get_settings() {

		$settings = parent::get_settings();

		$settings['basic'][] = array(
			'key'   => 'file_types',
			'type'  => 'text',
			'label' => __( 'Allowed file types', '2ranq-forms' ),
			'help'  => sprintf(
				/* translators: %s: default list of file types. */
				__( 'Separate with commas. Leave empty for: %s', '2ranq-forms' ),
				implode( ', ', Ranq_Forms_Uploads::default_types() )
			),
		);

		$settings['basic'][] = array(
			'key'   => 'max_size',
			'type'  => 'number',
			'label' => __( 'Largest file, in MB', '2ranq-forms' ),
			'help'  => sprintf(
				/* translators: %s: server limit, for example 64 MB. */
				__( 'This server allows up to %s no matter what you put here.', '2ranq-forms' ),
				size_format( Ranq_Forms_Uploads::server_limit() )
			),
		);

		$settings['basic'][] = array(
			'key'   => 'max_files',
			'type'  => 'number',
			'label' => __( 'How many files', '2ranq-forms' ),
			'help'  => __( 'Between 1 and 10.', '2ranq-forms' ),
		);

		return $settings;
	}

	/**
	 * Prints the field.
	 *
	 * @param array $field   The field settings.
	 * @param int   $form_id The form id.
	 *
	 * @return void
	 */
	public function render( $field, $form_id ) {

		$describedby = $this->describedby( $field, $form_id );
		$id          = $this->input_id( $field, $form_id );
		$types       = $this->allowed_types( $field );
		$multiple    = $this->max_files( $field ) > 1;

		$accept = array();

		foreach ( $types as $ext ) {
			$accept[] = '.' . $ext;
		}
		?>
		<div class="ranq-field ranq-field--file<?php echo esc_attr( $this->extra_classes( $field ) ); ?>"<?php echo $this->wrapper_data( $field ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- already escaped in wrapper_data().?>>
			<?php $this->render_label( $field, $form_id ); ?>

			<div class="ranq-file">
				<input
					type="file"
					id="<?php echo esc_attr( $id ); ?>"
					name="<?php echo esc_attr( $this->input_name( $field ) . ( $multiple ? '[]' : '' ) ); ?>"
					class="ranq-file__input"
					accept="<?php echo esc_attr( implode( ',', $accept ) ); ?>"
					<?php echo $multiple ? 'multiple' : ''; ?>
					<?php if ( $describedby ) : ?>
						aria-describedby="<?php echo esc_attr( $describedby ); ?>"
					<?php endif; ?>
					<?php echo empty( $field['required'] ) ? '' : 'required aria-required="true"'; ?>
				/>
				<label class="ranq-file__drop" for="<?php echo esc_attr( $id ); ?>">
					<span class="ranq-file__text"><?php esc_html_e( 'Choose a file, or drop it here', '2ranq-forms' ); ?></span>
					<span class="ranq-file__hint">
						<?php
						echo esc_html(
							sprintf(
								/* translators: 1: allowed types, 2: largest size. */
								__( '%1$s, up to %2$s', '2ranq-forms' ),
								implode( ', ', $types ),
								size_format( $this->max_size( $field ) )
							)
						);
						?>
					</span>
				</label>
			</div>

			<?php $this->render_description( $field, $form_id ); ?>
		</div>
		<?php
	}

	/**
	 * Cleaning. A file does not arrive through `$_POST`, so `$_FILES` is read
	 * here.
	 *
	 * @param mixed $value Not used.
	 * @param array $field The field settings.
	 *
	 * @return array
	 */
	public function sanitize( $value, $field ) {

		unset( $value );

		$name = $this->input_name( $field );

		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- the nonce is checked before the call, in Ranq_Forms_Submission.
		if ( ! isset( $_FILES[ $name ] ) ) {
			return array();
		}

		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- every file goes through the full check in Ranq_Forms_Uploads::accept().
		$raw     = $_FILES[ $name ];
		$files   = self::normalize( $raw );
		$allowed = $this->allowed_types( $field );
		$max     = $this->max_size( $field );
		$limit   = $this->max_files( $field );

		$saved  = array();
		$errors = array();
		$count  = 0;

		foreach ( $files as $file ) {

			// An empty row shows up when a person picked no file. That is not an error.
			if ( isset( $file['error'] ) && UPLOAD_ERR_NO_FILE === (int) $file['error'] ) {
				continue;
			}

			++$count;

			if ( $count > $limit ) {
				$errors[] = sprintf(
					/* translators: %d: how many files are allowed. */
					_n( 'Only %d file can be attached.', 'Only %d files can be attached.', $limit, '2ranq-forms' ),
					$limit
				);
				break;
			}

			$result = Ranq_Forms_Uploads::accept( $file, $allowed, $max );

			if ( is_wp_error( $result ) ) {
				$errors[] = $result->get_error_message();

				continue;
			}

			$saved[] = $result;
		}

		// The error travels with the value, so `validate()` only reads it.
		return array(
			'files'  => $saved,
			'errors' => $errors,
		);
	}

	/**
	 * Validation.
	 *
	 * @param mixed $value What `sanitize()` returned.
	 * @param array $field The field settings.
	 *
	 * @return string
	 */
	public function validate( $value, $field ) {

		if ( ! empty( $value['errors'] ) ) {
			return (string) $value['errors'][0];
		}

		if ( ! empty( $field['required'] ) && empty( $value['files'] ) ) {
			return $this->required_message( $field );
		}

		return '';
	}

	/**
	 * How it is shown in the entry and in the email.
	 *
	 * The ORIGINAL name is shown, while the file on disk carries a random one.
	 *
	 * @param mixed $value The value.
	 * @param array $field The field settings.
	 *
	 * @return string
	 */
	public function format_value( $value, $field ) {

		unset( $field );

		if ( empty( $value['files'] ) ) {
			return '';
		}

		$names = array();

		foreach ( $value['files'] as $file ) {
			$names[] = $file['name'] . ' (' . size_format( (int) $file['size'] ) . ')';
		}

		return implode( ', ', $names );
	}

	/**
	 * For one field with several files PHP builds an array of arrays. This turns
	 * that into a plain list of files, so each one can be handled on its own.
	 *
	 * @param array $raw One row out of `$_FILES`.
	 *
	 * @return array
	 */
	private static function normalize( $raw ) {

		if ( ! isset( $raw['name'] ) ) {
			return array();
		}

		if ( ! is_array( $raw['name'] ) ) {
			return array( $raw );
		}

		$files = array();

		foreach ( array_keys( $raw['name'] ) as $index ) {
			$files[] = array(
				'name'     => isset( $raw['name'][ $index ] ) ? $raw['name'][ $index ] : '',
				'type'     => isset( $raw['type'][ $index ] ) ? $raw['type'][ $index ] : '',
				'tmp_name' => isset( $raw['tmp_name'][ $index ] ) ? $raw['tmp_name'][ $index ] : '',
				'error'    => isset( $raw['error'][ $index ] ) ? $raw['error'][ $index ] : UPLOAD_ERR_NO_FILE,
				'size'     => isset( $raw['size'][ $index ] ) ? $raw['size'][ $index ] : 0,
			);
		}

		return $files;
	}
}