<?php

namespace AcyCheckerCmsServices;


class Security
{
    public static function getVar(string $type, string $name, $default = null)
    {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verification is the caller's responsibility for this generic helper.
        if (!isset($_REQUEST[$name])) {
            return $default;
        }

        // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Nonce checked by caller and sanitization done in cleanVar.
        $result = wp_unslash($_REQUEST[$name]);
        if ($type === 'array') {
            $result = (array)$result;
        }

        return Security::cleanVar($result, $type, 0);
    }

    public static function cleanVar($var, $type, $mask)
    {
        if (is_array($var)) {
            foreach ($var as $i => $val) {
                $var[$i] = Security::cleanVar($val, $type, $mask);
            }

            return $var;
        }

        switch ($type) {
            case 'string':
                $var = (string)$var;
                break;
            case 'int':
                $var = (int)$var;
                break;
            case 'float':
                $var = (float)$var;
                break;
            case 'bool':
                $var = (bool)$var;
                break;
            case 'word':
                $var = preg_replace('#[^a-zA-Z_]#', '', $var);
                break;
            case 'cmd':
                $var = preg_replace('#[^a-zA-Z0-9_\.-]#', '', $var);
                $var = ltrim($var, '.');
                break;
            default:
                break;
        }

        if (!is_string($var)) {
            return $var;
        }

        $var = trim($var);

        if ($mask & 2) {
            return $var;
        }

        if (!preg_match('//u', $var)) {
            // String contains invalid byte sequence, remove it
            $var = htmlspecialchars_decode(htmlspecialchars($var, ENT_IGNORE, 'UTF-8'));
        }

        if (!($mask & 4)) {
            $var = preg_replace('#<[a-zA-Z/]+[^>]*>#Uis', '', $var);
        }

        return $var;
    }

    public static function setVar(string $name, $value)
    {
        $_REQUEST[$name] = $value;
    }

    public static function raiseError($level, $code, $msg, $info = null)
    {
        Message::display($code.': '.$msg, 'error');
        wp_die();
    }

    /**
     * Context hint: are we rendering/handling an admin-side request (vs the plugin's
     * front-end entry point)?
     * This is NOT an authorization check and must never be used as one
     *
     * Use checkAdminAccess() for permission check instead.
     */
    public static function isAdmin()
    {
        $page = Security::getVar('string', 'page', '');

        if ($page === 'acychecker_front') {
            return false;
        }

        return is_admin();
    }

    public static function checkAdminAccess()
    {
        if (!current_user_can('manage_options')) {
            self::raiseError(E_ERROR, 403, __('You are not allowed to access this page', 'acychecker'));
        }
    }

    public static function cmsLoaded()
    {
        defined('ABSPATH') || die('Restricted access');
    }

    public static function isDebug()
    {
        return defined('WP_DEBUG') && WP_DEBUG;
    }

    public static function triggerCmsHook($action, $args = [])
    {
        array_unshift($args, $action);

        return call_user_func_array('do_action', $args);
    }

    public static function arrayToInteger(&$array)
    {
        if (is_array($array)) {
            $array = array_map('intval', $array);
        } else {
            $array = [];
        }
    }

    public static function escape($text)
    {
        if (is_array($text) || is_object($text)) {
            $text = json_encode($text);
        }

        return htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
    }

    public static function escapeUrl(string $url): string
    {
        return esc_url($url);
    }

    public static function escapeWithHtml(string $text, array $allowedTags = []): string
    {
        return wp_kses($text, $allowedTags);
    }

    public static function stripTags(string $text): string
    {
        return wp_strip_all_tags($text);
    }
}