<?php
namespace AdvancedAddons;

/**
 * Register and securely render the trusted Custom JavaScript block.
 */
class Custom_Javascript_Block {
	private const BLOCK_NAME = 'advanced-addons/custom-javascript';

	public function __construct() {
		add_action( 'init', array( $this, 'register' ) );
		add_filter( 'content_save_pre', array( $this, 'authorize_saved_code' ), 9 );
	}

	/** Register the server-side block and its render callback. */
	public function register(): void {
		register_block_type(
			dirname( __DIR__ ) . '/blocks/custom-javascript',
			array( 'render_callback' => array( $this, 'render' ) )
		);
	}

	/**
	 * Sign code saved by trusted users and remove code submitted by everyone else.
	 *
	 * A signature prevents an unprivileged author from placing executable code in
	 * a block comment and having it evaluated on the frontend.
	 */
	public function authorize_saved_code( $content ) {
		if ( ! is_string( $content ) || false === strpos( $content, '<!-- wp:' . self::BLOCK_NAME ) ) {
			return $content;
		}

		// Save filters receive slashed content; block JSON must be parsed unslashed.
		$blocks  = parse_blocks( wp_unslash( $content ) );
		$trusted = current_user_can( 'manage_options' );
		$changed = $this->authorize_blocks( $blocks, $trusted );

		return $changed ? wp_slash( serialize_blocks( $blocks ) ) : $content;
	}

	/** Recursively authorize Custom JavaScript blocks. */
	private function authorize_blocks( array &$blocks, bool $trusted ): bool {
		$changed = false;
		foreach ( $blocks as &$block ) {
			if ( self::BLOCK_NAME === ( $block['blockName'] ?? '' ) ) {
				$code = is_string( $block['attrs']['code'] ?? null )
					? $block['attrs']['code']
					: '';
				$scripts = self::normalize_scripts( $block['attrs']['scripts'] ?? array() );
				if ( $trusted && ( '' !== trim( $code ) || $scripts ) ) {
					if ( ( $block['attrs']['scripts'] ?? array() ) !== $scripts ) {
						$block['attrs']['scripts'] = $scripts;
						$changed = true;
					}
					$signature = $this->signature( $code, $scripts );
					if ( ( $block['attrs']['signature'] ?? '' ) !== $signature ) {
						$block['attrs']['signature'] = $signature;
						$changed = true;
					}
				} else {
					if ( '' !== $code || ! empty( $block['attrs']['signature'] ) || ! empty( $block['attrs']['scripts'] ) ) {
						$block['attrs']['scripts']   = array();
						$block['attrs']['code']      = '';
						$block['attrs']['signature'] = '';
						$changed = true;
					}
				}
			}

			if ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) ) {
				$changed = $this->authorize_blocks( $block['innerBlocks'], $trusted ) || $changed;
			}
		}
		unset( $block );

		return $changed;
	}

	/** Add executable code to the wrapper only when its signature is valid. */
	public function render( array $attributes, string $content ): string {
		$code      = is_string( $attributes['code'] ?? null ) ? $attributes['code'] : '';
		$signature = is_string( $attributes['signature'] ?? null ) ? $attributes['signature'] : '';
		$scripts = self::normalize_scripts( $attributes['scripts'] ?? array() );
		if ( ( '' === trim( $code ) && ! $scripts ) || ! hash_equals( $this->signature( $code, $scripts ), $signature ) ) {
			return $content;
		}

		if ( ! class_exists( '\\WP_HTML_Tag_Processor' ) ) {
			return $content;
		}

		$processor = new \WP_HTML_Tag_Processor( $content );
		if ( ! $processor->next_tag() ) {
			return $content;
		}

		$processor->set_attribute( 'data-aa-custom-javascript', base64_encode( $code ) );
		if ( $scripts ) {
			$processor->set_attribute( 'data-aa-custom-javascript-scripts', base64_encode( json_encode( $scripts, JSON_UNESCAPED_SLASHES ) ) );
		}
		return $processor->get_updated_html();
	}

	/** Create a site-specific integrity signature for executable block code. */
	public static function normalize_scripts( $scripts ): array {
		if ( ! is_array( $scripts ) ) {
			return array();
		}
		return array_values( array_unique( array_filter( $scripts, static function( $url ) {
			return is_string( $url ) && preg_match( '~^https?://~i', $url ) && false !== filter_var( $url, FILTER_VALIDATE_URL );
		} ) ) );
	}

	private function signature( string $code, array $scripts = array() ): string {
		// Preserve the legacy signature for blocks with no dependencies.
		$payload = $scripts ? json_encode( array( 'code' => $code, 'scripts' => $scripts ), JSON_UNESCAPED_SLASHES ) : $code;
		return hash_hmac( 'sha256', $payload, wp_salt( 'auth' ) );
	}
}