<?php
/**
 * Plugin Name: Absolute Contact for Absolute 2026
 * Description: A companion contact form block designed and styled specifically for the Absolute 2026 theme, with accessible feedback and built-in abuse protection.
 * Version: 1.0.0
 * Requires at least: 6.9
 * Requires PHP: 8.3
 * Author: Don Schnitzius
 * License: GPL-2.0-or-later
 * Text Domain: absolute-contact
 */

declare(strict_types=1);

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

function absolute_contact_register_block(): void {
	register_block_type( __DIR__ . '/block' );
}

add_action( 'init', 'absolute_contact_register_block' );

function absolute_contact_is_json_request(): bool {
	$accept = sanitize_text_field( wp_unslash( $_SERVER['HTTP_ACCEPT'] ?? '' ) );

	return str_contains( $accept, 'application/json' );
}

function absolute_contact_response( string $status, string $message, int $http_status ): never {
	if ( absolute_contact_is_json_request() ) {
		wp_send_json(
			[
				'status'  => $status,
				'message' => $message,
			],
			$http_status
		);
	}

	$referer = wp_get_referer();
	$target  = $referer ? wp_validate_redirect( $referer, home_url( '/' ) ) : home_url( '/' );
	$target  = remove_query_arg( 'absolute-contact', $target );
	$target  = add_query_arg( 'absolute-contact', $status, $target );

	wp_safe_redirect( $target . '#absolute-contact-form' );
	exit;
}

function absolute_contact_rate_limited(): bool {
	$address = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ?? 'unknown' ) );
	$key     = 'absolute_contact_' . hash_hmac( 'sha256', $address, wp_salt( 'nonce' ) );
	$record  = get_transient( $key );
	$record  = is_array( $record ) ? $record : [];
	$now     = time();
	$cutoff  = $now - 10 * MINUTE_IN_SECONDS;
	$record  = array_values(
		array_filter(
			$record,
			static fn( $timestamp ): bool => is_int( $timestamp ) && $timestamp >= $cutoff
		)
	);

	if ( count( $record ) >= 5 ) {
		return true;
	}

	$record[] = $now;
	set_transient( $key, $record, 10 * MINUTE_IN_SECONDS );

	return false;
}

function absolute_contact_process_form(): void {
	$request_method = isset( $_SERVER['REQUEST_METHOD'] )
		? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) )
		: '';

	if ( 'POST' !== $request_method ) {
		absolute_contact_response( 'invalid', __( 'Please check the form and try again.', 'absolute-contact' ), 405 );
	}

	$content_length = isset( $_SERVER['CONTENT_LENGTH'] )
		? absint( wp_unslash( $_SERVER['CONTENT_LENGTH'] ) )
		: 0;

	if ( $content_length > 32768 ) {
		absolute_contact_response( 'invalid', __( 'The submitted message is too large.', 'absolute-contact' ), 413 );
	}

	$nonce     = sanitize_text_field( wp_unslash( $_POST['absolute_contact_nonce'] ?? '' ) );
	$name      = sanitize_text_field( wp_unslash( $_POST['name'] ?? '' ) );
	$email_raw = sanitize_email( wp_unslash( $_POST['email'] ?? '' ) );
	$message   = sanitize_textarea_field( wp_unslash( $_POST['message'] ?? '' ) );
	$honeypot  = sanitize_text_field( wp_unslash( $_POST['website'] ?? '' ) );
	$started   = filter_var( wp_unslash( $_POST['form_started'] ?? 0 ), FILTER_VALIDATE_INT );
	$elapsed   = false !== $started ? time() - $started : 0;

	if (
		! wp_verify_nonce( $nonce, 'absolute_contact_submit' ) ||
		'' !== $honeypot ||
		'' === $name ||
		! is_email( $email_raw ) ||
		'' === $message ||
		strlen( $name ) > 120 ||
		strlen( $email_raw ) > 254 ||
		strlen( $message ) > 5000 ||
		$elapsed < 2
	) {
		absolute_contact_response( 'invalid', __( 'Please check the form and try again.', 'absolute-contact' ), 400 );
	}

	if ( absolute_contact_rate_limited() ) {
		absolute_contact_response(
			'rate-limited',
			__( 'Too many messages have been sent. Please wait a few minutes and try again.', 'absolute-contact' ),
			429
		);
	}

	$recipient = sanitize_email( get_option( 'admin_email' ) );
	if ( ! is_email( $recipient ) ) {
		// The WordPress administration email address is invalid
		absolute_contact_response( 'error', __( 'The server is having trouble. Please try again later.', 'absolute-contact' ), 500 );
	}

	$site_name = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
	$subject   = sprintf(
		/* translators: %s: website name. */
		__( 'Message from %s contact form', 'absolute-contact' ),
		$site_name
	);
	$body      = sprintf(
		"Name: %1\$s\nEmail: %2\$s\n\nMessage:\n%3\$s",
		$name,
		$email_raw,
		$message
	);
	$headers   = [
		'Content-Type: text/plain; charset=UTF-8',
		'Reply-To: ' . $name . ' <' . $email_raw . '>',
	];

	if ( ! wp_mail( $recipient, $subject, $body, $headers ) ) {
		// wp_mail() did not accept the contact message
		absolute_contact_response( 'error', __( 'The server is having trouble. Please try again later.', 'absolute-contact' ), 500 );
	}

	absolute_contact_response( 'success', __( 'Thanks for reaching out.', 'absolute-contact' ), 200 );
}

add_action( 'admin_post_absolute_contact_submit', 'absolute_contact_process_form' );
add_action( 'admin_post_nopriv_absolute_contact_submit', 'absolute_contact_process_form' );