<?php
/**
 * Front-end output of the form block.
 *
 * @package ALPEG\Forms
 */

namespace ALPEG\Forms;

defined( 'ABSPATH' ) || exit;

/**
 * Renders the block on the server. The configuration therefore never ends up
 * as HTML in the stored post content; it is created fresh on every request
 * and packed into the encrypted token.
 */
class Renderer {

	/**
	 * Counter in case the same form appears more than once on a page.
	 *
	 * @var int
	 */
	private static $instance = 0;

	/**
	 * Default texts.
	 *
	 * @return array
	 */
	public static function defaults() {
		return array(
			'formTitle'           => __( 'Contact form', 'alpeg-forms' ),
			'submitLabel'         => __( 'Send', 'alpeg-forms' ),
			'successMessage'      => __( 'Thank you! Your message has been received. We will get back to you as soon as possible.', 'alpeg-forms' ),
			'confirmationSubject' => __( 'We have received your message', 'alpeg-forms' ),
			'confirmationMessage' => __( "Hello,\n\nthank you for your message. We have received it and will get back to you as soon as possible.\n\nHere is a copy of your details:\n{fields}", 'alpeg-forms' ),
			'firstStepTitle'      => __( 'Your details', 'alpeg-forms' ),
		);
	}

	/**
	 * Block render callback.
	 *
	 * @param array     $attributes Attributes.
	 * @param string    $content    Content (empty).
	 * @param \WP_Block $block      Block instance.
	 * @return string
	 */
	public static function render( $attributes, $content = '', $block = null ) {
		$fields = Fields::normalize( isset( $attributes['fields'] ) ? $attributes['fields'] : array() );
		$inputs = array_filter( $fields, array( Fields::class, 'is_input' ) );
		if ( ! $inputs ) {
			return '';
		}

		wp_enqueue_style( 'alpeg-forms-frontend' );

		$d       = self::defaults();
		$form_id = isset( $attributes['formId'] ) && '' !== $attributes['formId'] ? substr( sanitize_key( $attributes['formId'] ), 0, 64 ) : 'af_' . substr( md5( wp_json_encode( $fields ) ), 0, 10 );
		$title   = self::attr( $attributes, 'formTitle', $d['formTitle'] );
		$post_id = ( $block instanceof \WP_Block && isset( $block->context['postId'] ) ) ? (int) $block->context['postId'] : (int) get_queried_object_id();
		$steps   = Fields::steps( $fields, self::attr( $attributes, 'firstStepTitle', $d['firstStepTitle'] ) );
		$multi   = count( $steps ) > 1;
		$files   = (bool) wp_list_filter( $fields, array( 'type' => 'file' ) );

		$token = Token::encode(
			array(
				'v'       => 2,
				'fid'     => $form_id,
				'title'   => $title,
				'fields'  => $fields,
				'notify'  => sanitize_text_field( self::attr( $attributes, 'notifyEmail', '' ) ),
				'subject' => sanitize_text_field( self::attr( $attributes, 'notifySubject', '' ) ),
				'attach'  => $files && ! empty( $attributes['attachFiles'] ),
				'confirm' => array(
					'on'      => ! empty( $attributes['sendConfirmation'] ),
					'subject' => sanitize_text_field( self::attr( $attributes, 'confirmationSubject', $d['confirmationSubject'] ) ),
					'message' => sanitize_textarea_field( self::attr( $attributes, 'confirmationMessage', $d['confirmationMessage'] ) ),
				),
				'success' => sanitize_textarea_field( self::attr( $attributes, 'successMessage', $d['successMessage'] ) ),
				'pid'     => $post_id,
				'blog'    => get_current_blog_id(),
				'ts'      => time(),
			)
		);

		++self::$instance;
		$uid = $form_id . '-' . self::$instance;

		// Result of a submission without JavaScript (redirect back).
		$state = self::no_js_state( $form_id );

		$style  = '';
		$accent = sanitize_hex_color( self::attr( $attributes, 'accentColor', '' ) );
		if ( $accent ) {
			$style = '--af-accent:' . $accent . ';';
		}

		$wrapper = get_block_wrapper_attributes(
			array(
				'class' => 'alpeg-form' . ( $multi ? ' alpeg-form--steps' : '' ),
				'style' => $style,
			)
		);

		$config = array(
			'i18n'  => array_merge(
				Fields::messages(),
				array(
					/* translators: 1: current step, 2: number of steps, 3: step title */
					'step'    => __( 'Step %1$d of %2$d: %3$s', 'alpeg-forms' ),
					'error'   => __( 'Something went wrong while sending. Please try again.', 'alpeg-forms' ),
					'network' => __( 'No connection to the server. Please check your internet connection and try again.', 'alpeg-forms' ),
					'too_large' => __( 'The uploaded files are too large in total. Please send smaller files.', 'alpeg-forms' ),
					'units'   => array( 'B', 'KB', 'MB', 'GB' ),
				)
			),
			'steps' => count( $steps ),
		);

		ob_start();
		?>
		<div <?php echo $wrapper; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?>>
			<?php if ( 1 === self::$instance ) : ?>
				<span id="<?php echo esc_attr( $form_id ); ?>" class="alpeg-form__anchor"></span>
			<?php endif; ?>
			<?php if ( 'success' === $state['status'] ) : ?>
				<div class="alpeg-form__notice alpeg-form__notice--success" role="status"><?php echo nl2br( esc_html( self::attr( $attributes, 'successMessage', $d['successMessage'] ) ) ); ?></div>
			<?php else : ?>
			<form class="alpeg-form__form" method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>" data-af-form<?php echo $files ? ' enctype="multipart/form-data"' : ''; ?>>
				<script type="application/json" data-af-config><?php echo wp_json_encode( $config, JSON_HEX_TAG | JSON_HEX_AMP | JSON_UNESCAPED_UNICODE ); ?></script>
				<input type="hidden" name="action" value="alpeg_forms_submit">
				<input type="hidden" name="_af_token" value="<?php echo esc_attr( $token ); ?>">
				<input type="hidden" name="_af_js" value="0">
				<input type="hidden" name="_af_t" value="0">
				<div class="alpeg-form__hp" aria-hidden="true">
					<label for="<?php echo esc_attr( $uid ); ?>-hp"><?php esc_html_e( 'Please leave empty', 'alpeg-forms' ); ?></label>
					<input type="text" id="<?php echo esc_attr( $uid ); ?>-hp" name="af_website" value="" tabindex="-1" autocomplete="off">
				</div>

				<div class="alpeg-form__notice alpeg-form__notice--error" role="alert" data-af-errors <?php echo $state['errors'] ? '' : 'hidden'; ?>>
					<?php
					foreach ( $state['errors'] as $msg ) {
						echo '<p>' . esc_html( $msg ) . '</p>';
					}
					?>
				</div>

				<?php if ( $multi ) : ?>
					<div class="alpeg-form__progress" data-af-progress hidden>
						<div class="alpeg-form__progress-bar" aria-hidden="true"><span data-af-progress-bar></span></div>
						<p class="alpeg-form__progress-label" aria-live="polite" data-af-progress-label></p>
					</div>
				<?php endif; ?>

				<?php foreach ( $steps as $i => $step ) : ?>
					<?php if ( $multi ) : ?>
						<fieldset class="alpeg-form__step" data-af-step="<?php echo (int) $i; ?>" data-af-step-title="<?php echo esc_attr( $step['title'] ); ?>">
							<legend class="alpeg-form__step-title"><?php echo esc_html( $step['title'] ); ?></legend>
					<?php endif; ?>
					<div class="alpeg-form__grid">
						<?php
						foreach ( $step['fields'] as $field ) {
							$value = isset( $state['values'][ $field['id'] ] ) ? $state['values'][ $field['id'] ] : '';
							$error = isset( $state['field_errors'][ $field['id'] ] ) ? $state['field_errors'][ $field['id'] ] : '';
							self::field( $field, $uid, $value, $error );
						}
						?>
					</div>
					<?php if ( $multi ) : ?>
						</fieldset>
					<?php endif; ?>
				<?php endforeach; ?>

				<div class="alpeg-form__actions">
					<?php if ( $multi ) : ?>
						<button type="button" class="alpeg-form__back" data-af-back hidden><?php esc_html_e( 'Back', 'alpeg-forms' ); ?></button>
						<button type="button" class="alpeg-form__next wp-element-button" data-af-next hidden><?php esc_html_e( 'Next', 'alpeg-forms' ); ?></button>
					<?php endif; ?>
					<button type="submit" class="alpeg-form__submit wp-element-button" data-af-submit>
						<span class="alpeg-form__submit-label"><?php echo esc_html( self::attr( $attributes, 'submitLabel', $d['submitLabel'] ) ); ?></span>
					</button>
				</div>
				<div class="alpeg-form__notice alpeg-form__notice--success" role="status" data-af-success hidden></div>
			</form>
			<?php endif; ?>
		</div>
		<?php
		return (string) ob_get_clean();
	}

	/**
	 * Output one field.
	 *
	 * @param array  $f     Field.
	 * @param string $uid   Unique form ID in the document.
	 * @param mixed  $value Prefill (after an error without JS).
	 * @param string $error Error message for this field.
	 */
	private static function field( array $f, $uid, $value, $error ) {
		$id       = $uid . '-' . $f['id'];
		$name     = 'af[' . $f['id'] . ']';
		// Conditional requirements are evaluated by the server (and view.js); native validation cannot evaluate them without JS.
		$req      = $f['required'] && ! $f['condition'] ? ' required aria-required="true"' : '';
		$invalid  = $error ? ' aria-invalid="true"' : '';
		$help_id  = $id . '-help';
		$err_id   = $id . '-error';
		$help     = $f['help'];
		$describe = array();

		if ( 'file' === $f['type'] ) {
			$exts = Files::allowed_extensions( $f );
			$info = strtoupper( implode( ', ', $exts ) ) . ' · ' . sprintf(
				/* translators: %s: max file size, e.g. "5 MB" */
				__( 'max. %s', 'alpeg-forms' ),
				size_format( Files::max_bytes( $f ) )
			);
			if ( $f['max_files'] > 1 ) {
				/* translators: %d: max number of files */
				$info .= ' · ' . sprintf( __( 'up to %d files', 'alpeg-forms' ), $f['max_files'] );
			}
			$help = trim( $help . ( $help ? ' – ' : '' ) . $info );
		}
		if ( $help ) {
			$describe[] = $help_id;
		}
		if ( $error ) {
			$describe[] = $err_id;
		}
		$describe = $describe ? ' aria-describedby="' . esc_attr( implode( ' ', $describe ) ) . '"' : '';

		$classes = 'alpeg-form__field alpeg-form__field--' . $f['type'] . ( 'half' === $f['width'] ? ' alpeg-form__field--half' : '' ) . ( $error ? ' has-error' : '' );
		$star    = $f['required'] ? ' <span class="alpeg-form__req" aria-hidden="true">*</span>' : '';
		$data    = ' data-af-field="' . esc_attr( $f['id'] ) . '" data-af-type="' . esc_attr( $f['type'] ) . '" data-af-label="' . esc_attr( wp_strip_all_tags( $f['label'] ) ) . '"' . ( $f['required'] ? ' data-af-required' : '' );
		if ( $f['condition'] ) {
			$data .= " data-af-cond='" . esc_attr( wp_json_encode( $f['condition'] ) ) . "'";
		}

		echo '<div class="' . esc_attr( $classes ) . '"' . $data . '>'; // phpcs:ignore WordPress.Security.EscapeOutput

		switch ( $f['type'] ) {
			case 'textarea':
				echo '<label for="' . esc_attr( $id ) . '">' . esc_html( $f['label'] ) . $star . '</label>'; // phpcs:ignore WordPress.Security.EscapeOutput
				echo '<textarea id="' . esc_attr( $id ) . '" name="' . esc_attr( $name ) . '" rows="5" placeholder="' . esc_attr( $f['placeholder'] ) . '"' . $req . $invalid . $describe . '>' . esc_textarea( (string) $value ) . '</textarea>'; // phpcs:ignore WordPress.Security.EscapeOutput
				break;

			case 'select':
				echo '<label for="' . esc_attr( $id ) . '">' . esc_html( $f['label'] ) . $star . '</label>'; // phpcs:ignore WordPress.Security.EscapeOutput
				echo '<select id="' . esc_attr( $id ) . '" name="' . esc_attr( $name ) . '"' . $req . $invalid . $describe . '>'; // phpcs:ignore WordPress.Security.EscapeOutput
				echo '<option value="">' . esc_html( $f['placeholder'] ? $f['placeholder'] : __( 'Please choose …', 'alpeg-forms' ) ) . '</option>';
				foreach ( $f['options'] as $opt ) {
					echo '<option value="' . esc_attr( $opt ) . '"' . selected( (string) $value, $opt, false ) . '>' . esc_html( $opt ) . '</option>';
				}
				echo '</select>';
				break;

			case 'radio':
			case 'checkbox':
				$input_type = 'radio' === $f['type'] ? 'radio' : 'checkbox';
				$input_name = 'checkbox' === $f['type'] ? $name . '[]' : $name;
				$checked    = (array) $value;
				// Radios form a radiogroup, which supports aria-required/aria-invalid. A checkbox group is a plain
				// group: it gets no ARIA state, but announces "required" through hidden legend text.
				if ( 'radio' === $f['type'] ) {
					$group = ' role="radiogroup"' . ( $f['required'] ? ' aria-required="true"' : '' ) . $invalid;
					$sr    = '';
				} else {
					$group = '';
					$sr    = $f['required'] ? ' <span class="screen-reader-text">' . esc_html__( '(required)', 'alpeg-forms' ) . '</span>' : '';
				}
				echo '<fieldset' . $describe . $group . '><legend>' . esc_html( $f['label'] ) . $star . $sr . '</legend>'; // phpcs:ignore WordPress.Security.EscapeOutput
				foreach ( $f['options'] as $i => $opt ) {
					$oid      = $id . '-' . $i;
					$req_attr = ( 'radio' === $f['type'] && $f['required'] && ! $f['condition'] && 0 === $i ) ? ' required' : '';
					echo '<label class="alpeg-form__choice" for="' . esc_attr( $oid ) . '"><input type="' . esc_attr( $input_type ) . '" id="' . esc_attr( $oid ) . '" name="' . esc_attr( $input_name ) . '" value="' . esc_attr( $opt ) . '"' . checked( in_array( $opt, $checked, true ), true, false ) . $req_attr . '> <span>' . esc_html( $opt ) . '</span></label>'; // phpcs:ignore WordPress.Security.EscapeOutput
				}
				echo '</fieldset>';
				break;

			case 'consent':
				$policy = get_privacy_policy_url();
				$text   = str_replace( '{datenschutz}', esc_url( $policy ? $policy : home_url( '/' ) ), $f['label'] );
				$text   = str_replace( '{privacy}', esc_url( $policy ? $policy : home_url( '/' ) ), $text );
				$text   = preg_replace( '/<a (?![^>]*\btarget=)/i', '<a target="_blank" rel="noopener" ', $text );
				echo '<label class="alpeg-form__choice alpeg-form__consent" for="' . esc_attr( $id ) . '"><input type="checkbox" id="' . esc_attr( $id ) . '" name="' . esc_attr( $name ) . '" value="1"' . $req . checked( '1', (string) $value, false ) . $invalid . $describe . '> <span>' . wp_kses( $text, Fields::consent_kses() ) . $star . '</span></label>'; // phpcs:ignore WordPress.Security.EscapeOutput
				break;

			case 'file':
				$exts     = Files::allowed_extensions( $f );
				$multiple = $f['max_files'] > 1;
				$accept   = implode( ',', array_map( static function ( $e ) { return '.' . $e; }, $exts ) );
				echo '<label for="' . esc_attr( $id ) . '">' . esc_html( $f['label'] ) . $star . '</label>'; // phpcs:ignore WordPress.Security.EscapeOutput
				echo '<input type="file" id="' . esc_attr( $id ) . '" name="' . esc_attr( $multiple ? $name . '[]' : $name ) . '"' . ( $multiple ? ' multiple' : '' )
					. ' accept="' . esc_attr( $accept ) . '" data-af-ext="' . esc_attr( implode( ',', $exts ) ) . '" data-af-max-bytes="' . (int) Files::max_bytes( $f ) . '" data-af-max-files="' . (int) $f['max_files'] . '"'
					. $req . $invalid . $describe . '>'; // phpcs:ignore WordPress.Security.EscapeOutput
				break;

			default:
				$auto = array(
					'email' => 'email',
					'tel'   => 'tel',
					'url'   => 'url',
				);
				$ac   = isset( $auto[ $f['type'] ] ) ? ' autocomplete="' . $auto[ $f['type'] ] . '"' : '';
				if ( 'text' === $f['type'] && preg_match( '/\bname\b|vorname|nachname/i', $f['id'] . ' ' . $f['label'] ) ) {
					$ac = ' autocomplete="name"';
				}
				$extra = 'number' === $f['type'] ? ' inputmode="decimal" step="any"' : '';
				echo '<label for="' . esc_attr( $id ) . '">' . esc_html( $f['label'] ) . $star . '</label>'; // phpcs:ignore WordPress.Security.EscapeOutput
				echo '<input type="' . esc_attr( $f['type'] ) . '" id="' . esc_attr( $id ) . '" name="' . esc_attr( $name ) . '" value="' . esc_attr( (string) $value ) . '" placeholder="' . esc_attr( $f['placeholder'] ) . '"' . $req . $invalid . $describe . $ac . $extra . '>'; // phpcs:ignore WordPress.Security.EscapeOutput
		}

		if ( $help ) {
			echo '<p class="alpeg-form__help" id="' . esc_attr( $help_id ) . '">' . esc_html( $help ) . '</p>';
		}
		echo '<p class="alpeg-form__field-error" id="' . esc_attr( $err_id ) . '" data-af-error' . ( $error ? '' : ' hidden' ) . '>' . esc_html( $error ) . '</p>';
		echo '</div>';
	}

	/**
	 * State after a redirect (submission without JavaScript).
	 *
	 * @param string $form_id Form ID.
	 * @return array
	 */
	private static function no_js_state( $form_id ) {
		$state = array(
			'status'       => '',
			'errors'       => array(),
			'field_errors' => array(),
			'values'       => array(),
		);
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- display only, no action.
		if ( empty( $_GET['alpeg_form'] ) || sanitize_key( wp_unslash( $_GET['alpeg_form'] ) ) !== $form_id ) {
			return $state;
		}
		if ( isset( $_GET['alpeg_form_status'] ) && 'ok' === $_GET['alpeg_form_status'] ) {
			$state['status'] = 'success';
			return $state;
		}
		if ( ! empty( $_GET['alpeg_form_key'] ) ) {
			$key  = 'alpeg_forms_state_' . sanitize_key( wp_unslash( $_GET['alpeg_form_key'] ) );
			$data = get_transient( $key );
			if ( is_array( $data ) ) {
				delete_transient( $key );
				$state = array_merge( $state, $data );
			}
		}
		// phpcs:enable
		return $state;
	}

	/**
	 * Read an attribute with fallback.
	 *
	 * @param array  $a       Attributes.
	 * @param string $key     Key.
	 * @param string $default Fallback when empty.
	 * @return string
	 */
	private static function attr( $a, $key, $default ) {
		return isset( $a[ $key ] ) && '' !== trim( (string) $a[ $key ] ) ? (string) $a[ $key ] : $default;
	}
}