<?php
/**
 * Result messages passed to the admin screen a handler redirects to.
 *
 * @package Abientot
 */

namespace Abientot\Admin;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * A handler adds its result (a notice code, and for some notices the affected record ids)
 * to the redirect URL together with a nonce. The screen reads these values only after
 * verifying that nonce, so a crafted link cannot display a result that did not happen.
 * Values are display-only: they never change data.
 */
final class RedirectNotice {
	public const NONCE_ACTION = 'abientot_redirect_notice';
	public const NONCE_FIELD  = 'abientot_notice_nonce';

	/** Whether the module being rendered may show the result (only the active module does). */
	private static bool $visible = true;

	/**
	 * @param array<string,scalar> $args Result values, for example array( 'abientot_notice' => 'saved' ).
	 */
	public static function url( string $url, array $args ): string {
		$args                      = array_map( 'rawurlencode', array_map( 'strval', $args ) );
		$args[ self::NONCE_FIELD ] = wp_create_nonce( self::NONCE_ACTION );
		return add_query_arg( $args, $url );
	}

	/**
	 * Result value from the current URL after nonce verification; '' when absent, invalid or hidden.
	 *
	 * @param string $type 'key' (sanitize_key()) or 'text' (sanitize_text_field()).
	 */
	public static function get( string $key, string $type = 'key' ): string {
		if ( ! self::$visible ) {
			return '';
		}
		if ( ! isset( $_GET[ self::NONCE_FIELD ] ) ) {
			return '';
		}
		if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET[ self::NONCE_FIELD ] ) ), self::NONCE_ACTION ) ) {
			return '';
		}
		if ( ! isset( $_GET[ $key ] ) || ! is_string( $_GET[ $key ] ) ) {
			return '';
		}
		return 'text' === $type ? sanitize_text_field( wp_unslash( $_GET[ $key ] ) ) : sanitize_key( wp_unslash( $_GET[ $key ] ) );
	}

	/**
	 * Comma-separated record ids from the current URL after nonce verification (at most $limit).
	 *
	 * @return int[]
	 */
	public static function ids( string $key, int $limit = 20 ): array {
		$ids = array_filter( array_map( 'absint', explode( ',', self::get( $key, 'text' ) ) ) );
		return array_slice( array_values( array_unique( $ids ) ), 0, $limit );
	}

	/**
	 * Runs $callback with results shown only when $visible (modules that are preloaded but hidden).
	 */
	public static function scoped( bool $visible, callable $callback ): void {
		$previous      = self::$visible;
		self::$visible = $previous && $visible;
		try {
			$callback();
		} finally {
			self::$visible = $previous;
		}
	}
}