<?php
/**
 * Renders synced product payloads on the front end.
 *
 * @package AffiliateBoxes
 */

defined( 'ABSPATH' ) || exit;

/**
 * Class AffiliateBoxes_Renderer
 *
 * Handles output of the structured product payload ({ html, css, version }) that the
 * /wpbox/{slug} endpoint returns.
 *
 * Security model:
 * - Markup is passed through wp_kses() against an explicit allow list before it is output,
 *   so no scripts, event handlers or unknown elements can reach the page.
 * - Stylesheets have any "</style" break-out sequence removed, then queued through
 *   wp_add_inline_style() (normal front-end rendering) or, for standalone preview fragments
 *   that never pass through WordPress's asset pipeline, handed back to the caller to attach
 *   to the document itself rather than being concatenated into markup here.
 * - All behaviour (coupon toggles, copy to clipboard) is driven by a script that ships with
 *   this plugin and is triggered by data attributes, never by remote code.
 */
class AffiliateBoxes_Renderer {

	/**
	 * Script handle for the bundled front-end behaviour script.
	 */
	const SCRIPT_HANDLE = 'affiliateboxes-boxes';

	/**
	 * Style handle used to queue a product's stylesheet via wp_add_inline_style().
	 */
	const STYLE_HANDLE = 'affiliateboxes-boxes-style';

	/**
	 * Hashes of stylesheets already emitted during this request.
	 *
	 * @var array<string, bool>
	 */
	private static $printed_styles = array();

	/**
	 * Register the front-end behaviour script and the stylesheet handle used to carry
	 * per-product CSS via wp_add_inline_style().
	 *
	 * Safe to call more than once, and safe to call from render time: a block's render
	 * callback can run before wp_enqueue_scripts depending on the theme and how the page is
	 * assembled, so registration cannot assume that hook has already fired.
	 */
	public static function register_assets(): void {
		if ( ! wp_script_is( self::SCRIPT_HANDLE, 'registered' ) ) {
			wp_register_script(
				self::SCRIPT_HANDLE,
				AFFILIATEBOXES_PLUGIN_URL . 'public/js/affiliateboxes-boxes.js',
				array(),
				defined( 'AFFILIATEBOXES_VERSION' ) ? AFFILIATEBOXES_VERSION : '1.0.0',
				true
			);
		}

		// No src: this handle exists only to carry per-product CSS via wp_add_inline_style().
		if ( ! wp_style_is( self::STYLE_HANDLE, 'registered' ) ) {
			wp_register_style(
				self::STYLE_HANDLE,
				false,
				array(),
				defined( 'AFFILIATEBOXES_VERSION' ) ? AFFILIATEBOXES_VERSION : '1.0.0'
			);
		}
	}

	/**
	 * Build the list of HTML elements and attributes allowed in a product payload.
	 *
	 * @return array<string, array<string, bool>> A wp_kses() compatible allow list.
	 */
	public static function allowed_html(): array {
		// Attributes every element may carry.
		$common = array(
			'class'    => true,
			'id'       => true,
			'style'    => true,
			'title'    => true,
			'role'     => true,
			'lang'     => true,
			'dir'      => true,
			'hidden'   => true,
			// Behaviour hooks for public/js/affiliateboxes-boxes.js. wp_kses() treats
			// 'data-*' as a wildcard, so the server can add hooks without waiting on a
			// plugin release. Data attributes carry no script or URL surface of their own.
			'data-*'   => true,

			// Makes a non-native control keyboard reachable. Pinned to exactly "0" so a
			// payload cannot reorder the whole page's tab sequence with a positive value.
			'tabindex' => array(
				'minval' => 0,
				'maxval' => 0,
			),
		);

		/*
		 * wp_kses() supports a data-* wildcard but has no aria-* equivalent, so every ARIA
		 * state and property has to be named. The complete ARIA 1.2 set is listed rather
		 * than the handful in use today: they are inert attributes with no script or URL
		 * surface, and a partial list silently drops accessibility markup the service adds
		 * later. Deprecated aria-dropeffect and aria-grabbed are excluded.
		 */
		$aria_attributes = array(
			'activedescendant',
			'atomic',
			'autocomplete',
			'braillelabel',
			'brailleroledescription',
			'busy',
			'checked',
			'colcount',
			'colindex',
			'colindextext',
			'colspan',
			'controls',
			'current',
			'describedby',
			'description',
			'details',
			'disabled',
			'errormessage',
			'expanded',
			'flowto',
			'haspopup',
			'hidden',
			'invalid',
			'keyshortcuts',
			'label',
			'labelledby',
			'level',
			'live',
			'modal',
			'multiline',
			'multiselectable',
			'orientation',
			'owns',
			'placeholder',
			'posinset',
			'pressed',
			'readonly',
			'relevant',
			'required',
			'roledescription',
			'rowcount',
			'rowindex',
			'rowindextext',
			'rowspan',
			'selected',
			'setsize',
			'sort',
			'valuemax',
			'valuemin',
			'valuenow',
			'valuetext',
		);

		foreach ( $aria_attributes as $aria_attribute ) {
			$common[ 'aria-' . $aria_attribute ] = true;
		}

		$text_elements = array(
			'div',
			'span',
			'section',
			'article',
			'header',
			'footer',
			'aside',
			'nav',
			'main',
			'p',
			'br',
			'hr',
			'h1',
			'h2',
			'h3',
			'h4',
			'h5',
			'h6',
			'strong',
			'b',
			'em',
			'i',
			'u',
			's',
			'small',
			'sup',
			'sub',
			'mark',
			'del',
			'ins',
			'code',
			'pre',
			'blockquote',
			'cite',
			'ul',
			'ol',
			'li',
			'dl',
			'dt',
			'dd',
			'figure',
			'figcaption',
			'details',
			'summary',
			'table',
			'thead',
			'tbody',
			'tfoot',
			'tr',
			'caption',
			'colgroup',
		);

		$allowed = array();
		foreach ( $text_elements as $element ) {
			$allowed[ $element ] = $common;
		}

		$allowed['a'] = array_merge(
			$common,
			array(
				'href'     => true,
				'target'   => true,
				'rel'      => true,
				'download' => true,
			)
		);

		$allowed['img'] = array_merge(
			$common,
			array(
				'src'      => true,
				'srcset'   => true,
				'sizes'    => true,
				'alt'      => true,
				'width'    => true,
				'height'   => true,
				'loading'  => true,
				'decoding' => true,
			)
		);

		$allowed['picture'] = $common;
		$allowed['source']  = array_merge(
			$common,
			array(
				'src'    => true,
				'srcset' => true,
				'sizes'  => true,
				'type'   => true,
				'media'  => true,
			)
		);

		$allowed['th']  = array_merge(
			$common,
			array(
				'colspan' => true,
				'rowspan' => true,
				'scope'   => true,
			)
		);
		$allowed['td']  = array_merge(
			$common,
			array(
				'colspan' => true,
				'rowspan' => true,
			)
		);
		$allowed['col'] = array_merge( $common, array( 'span' => true ) );

		// Checkbox-driven disclosure widgets. Only type="checkbox" survives; see filter_inputs().
		$allowed['input'] = array_merge(
			$common,
			array(
				'type'    => true,
				'checked' => true,
				'name'    => true,
			)
		);
		$allowed['label'] = array_merge( $common, array( 'for' => true ) );

		// Inline SVG icons. Element keys must be lower case: wp_kses() looks the element up
		// with strtolower() but preserves the original casing on output, so camelCase SVG
		// elements and attributes such as viewBox still render correctly.
		$svg_common = array_merge(
			$common,
			array(
				'fill'             => true,
				'fill-rule'        => true,
				'fill-opacity'     => true,
				'stroke'           => true,
				'stroke-width'     => true,
				'stroke-linecap'   => true,
				'stroke-linejoin'  => true,
				'stroke-dasharray' => true,
				'stroke-opacity'   => true,
				'opacity'          => true,
				'transform'        => true,
				'clip-path'        => true,
				'clip-rule'        => true,
			)
		);

		$allowed['svg'] = array_merge(
			$svg_common,
			array(
				'xmlns'               => true,
				'xmlns:xlink'         => true,
				'viewbox'             => true,
				'width'               => true,
				'height'              => true,
				'preserveaspectratio' => true,
				'focusable'           => true,
			)
		);

		$allowed['path']           = array_merge( $svg_common, array( 'd' => true ) );
		$allowed['g']              = $svg_common;
		$allowed['defs']           = $svg_common;
		$allowed['use']            = array_merge(
			$svg_common,
			array(
				'href'       => true,
				'xlink:href' => true,
				'x'          => true,
				'y'          => true,
			)
		);
		$allowed['circle']         = array_merge(
			$svg_common,
			array(
				'cx' => true,
				'cy' => true,
				'r'  => true,
			)
		);
		$allowed['ellipse']        = array_merge(
			$svg_common,
			array(
				'cx' => true,
				'cy' => true,
				'rx' => true,
				'ry' => true,
			)
		);
		$allowed['rect']           = array_merge(
			$svg_common,
			array(
				'x'      => true,
				'y'      => true,
				'width'  => true,
				'height' => true,
				'rx'     => true,
				'ry'     => true,
			)
		);
		$allowed['line']           = array_merge(
			$svg_common,
			array(
				'x1' => true,
				'y1' => true,
				'x2' => true,
				'y2' => true,
			)
		);
		$allowed['polygon']        = array_merge( $svg_common, array( 'points' => true ) );
		$allowed['polyline']       = array_merge( $svg_common, array( 'points' => true ) );
		$allowed['text']           = array_merge(
			$svg_common,
			array(
				'x'           => true,
				'y'           => true,
				'dx'          => true,
				'dy'          => true,
				'text-anchor' => true,
				'font-size'   => true,
				'font-family' => true,
				'font-weight' => true,
			)
		);
		$allowed['tspan']          = $allowed['text'];
		$allowed['clippath']       = array_merge( $svg_common, array( 'clippathunits' => true ) );
		$allowed['mask']           = $svg_common;
		$allowed['lineargradient'] = array_merge(
			$svg_common,
			array(
				'x1'                => true,
				'y1'                => true,
				'x2'                => true,
				'y2'                => true,
				'gradientunits'     => true,
				'gradienttransform' => true,
			)
		);
		$allowed['radialgradient'] = array_merge(
			$svg_common,
			array(
				'cx'            => true,
				'cy'            => true,
				'r'             => true,
				'fx'            => true,
				'fy'            => true,
				'gradientunits' => true,
			)
		);
		$allowed['stop']           = array_merge(
			$svg_common,
			array(
				'offset'       => true,
				'stop-color'   => true,
				'stop-opacity' => true,
			)
		);
		$allowed['title']          = $common;
		$allowed['desc']           = $common;

		/**
		 * Filters the HTML elements and attributes allowed in a synced product payload.
		 *
		 * Anything not listed here is removed by wp_kses() before the payload reaches the page.
		 *
		 * @param array<string, array<string, bool>> $allowed A wp_kses() compatible allow list.
		 */
		return apply_filters( 'affiliateboxes_allowed_html', $allowed );
	}

	/**
	 * Sanitize a product payload's markup.
	 *
	 * @param string $html Raw markup from affiliateboxes.com.
	 * @return string Markup safe to output.
	 */
	public static function sanitize_html( string $html ): string {
		$html = self::strip_raw_text_elements( $html );
		$html = wp_kses( $html, self::allowed_html(), array( 'http', 'https', 'mailto', 'tel' ) );

		return self::filter_inputs( $html );
	}

	/**
	 * Remove elements whose text content must not survive as visible copy.
	 *
	 * Note that wp_kses() drops disallowed tags but keeps the text between them, so a stray
	 * <script> or <style> in the markup field would otherwise be printed on the page as
	 * literal text. Removing these elements wholesale first keeps the output clean.
	 *
	 * @param string $html Raw markup from affiliateboxes.com.
	 * @return string
	 */
	private static function strip_raw_text_elements( string $html ): string {
		$elements = 'script|style|noscript|template|iframe|object|embed|applet|frameset|noframes';

		return (string) preg_replace( '#<(' . $elements . ')\b[^>]*>.*?</\s*\1\s*>#is', '', $html );
	}

	/**
	 * Drop any <input> that is not a checkbox.
	 *
	 * The allow list permits <input> so that CSS-only disclosure widgets keep working, but
	 * nothing else needs a form control. wp_kses() has no way to restrict an attribute to a
	 * set of values, so the restriction is applied afterwards, on markup wp_kses() has already
	 * normalised to double-quoted attributes.
	 *
	 * @param string $html Markup that has already passed through wp_kses().
	 * @return string
	 */
	private static function filter_inputs( string $html ): string {
		return (string) preg_replace_callback(
			'#<input\b[^>]*>#i',
			static function ( $matches ) {
				if ( preg_match( '#\stype="checkbox"#i', $matches[0] ) ) {
					return $matches[0];
				}
				return '';
			},
			$html
		);
	}

	/**
	 * Sanitize a product payload's stylesheet.
	 *
	 * Removes any sequence that would close the <style> element early, which is the only way
	 * stylesheet text can escape into markup.
	 *
	 * @param string $css Raw CSS from affiliateboxes.com.
	 * @return string CSS safe to place inside a <style> element.
	 */
	public static function sanitize_css( string $css ): string {
		$css = wp_kses_no_null( $css );

		return (string) preg_replace( '#</\s*style\b[^>]*>?#i', '', $css );
	}

	/**
	 * Render a structured product payload for a normal page request.
	 *
	 * @param string $html    Raw markup from affiliateboxes.com.
	 * @param string $css     Raw CSS from affiliateboxes.com.
	 * @param string $wrapper_class Wrapper class name.
	 * @return string
	 */
	public static function render( string $html, string $css, string $wrapper_class = '' ): string {
		$safe_html = self::sanitize_html( $html );

		if ( '' === trim( $safe_html ) ) {
			return '';
		}

		// Register on demand rather than trusting that wp_enqueue_scripts has already run.
		// The previous guard skipped the enqueue silently when it had not, which left boxes
		// on the page with no behaviour script behind them: coupon panels and galleries
		// rendered but did nothing.
		self::register_assets();

		$css = self::sanitize_css( $css );

		if ( '' !== trim( $css ) ) {
			$fingerprint = md5( $css );

			// Products built from the same template share a stylesheet; emit it only once
			// per request.
			if ( ! isset( self::$printed_styles[ $fingerprint ] ) ) {
				self::$printed_styles[ $fingerprint ] = true;

				wp_enqueue_style( self::STYLE_HANDLE );
				wp_add_inline_style( self::STYLE_HANDLE, $css );
			}
		}

		wp_enqueue_script( self::SCRIPT_HANDLE );

		$wrapper_class = trim( 'affiliateboxes-box ' . $wrapper_class );

		return '<div class="' . esc_attr( $wrapper_class ) . '">' . $safe_html . '</div>';
	}

	/**
	 * Render a structured product payload for the block editor preview.
	 *
	 * The preview panel fetches this over REST and injects the markup into a DOM node on an
	 * admin page that has already finished loading, so wp_head()/wp_footer() have long since
	 * run and wp_add_inline_style() has nothing left to print into. The stylesheet is handed
	 * back separately instead, for the caller to attach to the document itself (a DOM-created
	 * <style> element - see admin/js/block-editor.js).
	 *
	 * @param string $html    Raw markup from affiliateboxes.com.
	 * @param string $css     Raw CSS from affiliateboxes.com.
	 * @param string $wrapper_class Wrapper class name.
	 * @return array{html: string, css: string}
	 */
	public static function render_preview( string $html, string $css, string $wrapper_class = '' ): array {
		$safe_html = self::sanitize_html( $html );

		if ( '' === trim( $safe_html ) ) {
			return array(
				'html' => '',
				'css'  => '',
			);
		}

		self::register_assets();
		wp_enqueue_script( self::SCRIPT_HANDLE );

		$wrapper_class = trim( 'affiliateboxes-box ' . $wrapper_class );

		return array(
			'html' => '<div class="' . esc_attr( $wrapper_class ) . '">' . $safe_html . '</div>',
			'css'  => self::sanitize_css( $css ),
		);
	}

	/**
	 * Forget which stylesheets have been emitted.
	 *
	 * Used by the block editor preview routes, which build standalone fragments that each need
	 * to carry their own stylesheet.
	 */
	public static function reset_printed_styles(): void {
		self::$printed_styles = array();
	}

	/**
	 * Print the front-end stylesheet if it was queued after wp_head's normal print pass.
	 *
	 * Shortcodes and blocks render during the_content, which fires after wp_head on most
	 * themes, so styles queued there miss wp_head's wp_print_styles() call. The bundled
	 * script avoids this because it is registered footer-only and WordPress prints footer
	 * scripts automatically; styles have no equivalent automatic footer flush, so this hooks
	 * wp_footer to catch up.
	 */
	public static function print_deferred_style(): void {
		if ( wp_style_is( self::STYLE_HANDLE, 'enqueued' ) && ! wp_style_is( self::STYLE_HANDLE, 'done' ) ) {
			wp_print_styles( array( self::STYLE_HANDLE ) );
		}
	}
}