<?php
/**
 * Sanitisation helpers.
 *
 * @package AccessibilityOptions
 */

defined( 'ABSPATH' ) || exit;

/**
 * Sanitize class.
 */
class AccessKit_Sanitize {

	/**
	 * Sanitise the full settings array — used as Settings API callback.
	 *
	 * @param array $input Raw input from form.
	 * @return array
	 */
	public static function settings( $input ) {
		$defaults = AccessKit_Defaults::get();
		$output   = array();

		if ( ! is_array( $input ) ) {
			$input = array();
		}

		// Colours.
		foreach ( array( 'brand_color', 'bg_color', 'reset_bg' ) as $key ) {
			$raw            = isset( $input[ $key ] ) ? $input[ $key ] : $defaults[ $key ];
			$output[ $key ] = self::color( $raw, $defaults[ $key ] );
		}

		// Position — whitelist.
		$pos               = isset( $input['position'] ) ? $input['position'] : $defaults['position'];
		$output['position'] = in_array( $pos, array( 'left', 'right' ), true ) ? $pos : $defaults['position'];

		// Title text — plain string, max 80 chars.
		$title              = isset( $input['title_text'] ) ? $input['title_text'] : $defaults['title_text'];
		$output['title_text'] = self::title( $title, $defaults['title_text'] );

		// Feature toggles — checkboxes (present = 1, absent = 0).
		foreach ( array_keys( AccessKit_Defaults::features() ) as $feat ) {
			$output[ $feat ] = ! empty( $input[ $feat ] ) ? 1 : 0;
		}

		// Exclude pages — comma list of post IDs and/or slugs.
		$output['exclude_pages'] = isset( $input['exclude_pages'] )
			? self::id_or_slug_list( $input['exclude_pages'] )
			: '';

		// Custom CSS — strip script tags etc.
		$output['custom_css'] = isset( $input['custom_css'] )
			? self::custom_css( $input['custom_css'] )
			: '';

		return $output;
	}

	/**
	 * Validate hex / rgb() / rgba() / named color. Falls back to default.
	 *
	 * @param string $value   Raw input.
	 * @param string $fallback Fallback colour.
	 * @return string
	 */
	public static function color( $value, $fallback = '#1e1b4b' ) {
		$value = trim( (string) $value );

		if ( '' === $value ) {
			return $fallback;
		}

		// WP core helper for hex.
		$hex = sanitize_hex_color( $value );
		if ( $hex ) {
			return $hex;
		}

		// rgb() / rgba() — limited safe charset.
		if ( preg_match( '/^rgba?\(\s*[0-9.,\s%\/]+\)$/i', $value ) ) {
			return $value;
		}

		// Named keyword (letters only).
		if ( preg_match( '/^[a-z]{3,20}$/i', $value ) ) {
			return $value;
		}

		return $fallback;
	}

	/**
	 * Sanitise the launcher title.
	 *
	 * @param string $value    Raw value.
	 * @param string $fallback Fallback string.
	 * @return string
	 */
	public static function title( $value, $fallback = 'Accessibility Options' ) {
		$value = sanitize_text_field( (string) $value );
		if ( '' === $value ) {
			return $fallback;
		}
		// Cap length.
		if ( function_exists( 'mb_substr' ) ) {
			return mb_substr( $value, 0, 80 );
		}
		return substr( $value, 0, 80 );
	}

	/**
	 * Sanitise comma-separated list of post IDs and/or slugs.
	 *
	 * @param string $value Raw value.
	 * @return string Comma-separated, trimmed.
	 */
	public static function id_or_slug_list( $value ) {
		$value = (string) $value;
		$parts = array_filter( array_map( 'trim', explode( ',', $value ) ) );
		$clean = array();
		foreach ( $parts as $p ) {
			if ( ctype_digit( $p ) ) {
				$clean[] = (int) $p;
				continue;
			}
			$slug = sanitize_title( $p );
			if ( '' !== $slug ) {
				$clean[] = $slug;
			}
		}
		return implode( ',', array_unique( $clean ) );
	}

	/**
	 * Sanitise custom CSS — strips tags, dangerous patterns, caps length.
	 *
	 * @param string $value Raw value.
	 * @return string
	 */
	public static function custom_css( $value ) {
		$value = (string) $value;
		// Strip any HTML.
		$value = wp_strip_all_tags( $value );
		// Cap at 10 KB to prevent abuse.
		if ( strlen( $value ) > 10240 ) {
			$value = substr( $value, 0, 10240 );
		}
		// Reject patterns that don't belong in CSS.
		$blacklist = array( 'javascript:', 'expression(', '<script', '@import', 'behavior:' );
		foreach ( $blacklist as $bad ) {
			if ( false !== stripos( $value, $bad ) ) {
				return '';
			}
		}
		return $value;
	}

	/**
	 * Parse exclude_pages string and return a list of int IDs and string slugs.
	 *
	 * @param string $value Comma-separated.
	 * @return array{ids:int[], slugs:string[]}
	 */
	public static function parse_exclude( $value ) {
		$ids   = array();
		$slugs = array();
		if ( '' === (string) $value ) {
			return array(
				'ids'   => $ids,
				'slugs' => $slugs,
			);
		}
		$parts = array_filter( array_map( 'trim', explode( ',', (string) $value ) ) );
		foreach ( $parts as $p ) {
			if ( ctype_digit( $p ) ) {
				$ids[] = (int) $p;
			} else {
				$slugs[] = sanitize_title( $p );
			}
		}
		return array(
			'ids'   => $ids,
			'slugs' => $slugs,
		);
	}
}