<?php

namespace ChargeForms\Includes;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Enforces `field.validation` (minLength, regex, min, max, customMessage)
 * — settings a form author could already configure in the builder's
 * "Validation" section, but that FieldSettings.js's own doc comment
 * admits "nothing here enforces them yet (client or server)" (Milestone
 * 7 Validation Engine, deferred). This is the PHP-authoritative half of
 * that gap (production-readiness-audit.md issue #32): ONE place these
 * four rules are actually checked, called from SubmissionHandler instead
 * of each rule being bolted on inline. The full cross-JS/PHP validation
 * contract Milestone 7 envisions (per-field-type `validate()` hooks,
 * builder live-preview of violations, repeaters/files) remains its own,
 * larger, separate effort — this closes the concrete "these settings are
 * currently decorative" gap, not the whole future engine.
 *
 * class-shortcode.php's render_text_like()/render_field_row() mirror the
 * same four rules as native HTML5 constraint attributes (minlength,
 * pattern, min, max) so the browser enforces the same thing this class
 * re-checks server-side — real client/server parity, not just a server
 * backstop no visitor ever sees before submitting.
 */
class Field_Validator {
	const MAX_REGEX_LENGTH = 200;

	/**
	 * @return string|null A human-readable violation message (the field's
	 *                      own customMessage if set, else a sensible
	 *                      default), or null if the value satisfies every
	 *                      configured rule (or none are configured).
	 */
	public static function validate_value( array $field, $value ) {
		$rules = is_array( $field['validation'] ?? null ) ? $field['validation'] : [];
		if ( empty( $rules ) || is_array( $value ) ) {
			return null; // Array-shaped values (address, multi-select, repeaters) aren't in scope for these scalar text/number rules.
		}

		$val = (string) $value;
		if ( '' === trim( $val ) ) {
			return null; // "required" is enforced separately; an empty optional value never fails format/length/range rules.
		}

		if ( ! empty( $rules['minLength'] ) && strlen( $val ) < (int) $rules['minLength'] ) {
			return self::message( $rules, sprintf(
				/* translators: %d: minimum character count */
				__( 'Must be at least %d characters.', 'chargeforms' ),
				(int) $rules['minLength']
			) );
		}

		if ( ! empty( $rules['regex'] ) && self::is_safe_regex_pattern( $rules['regex'] ) ) {
			$previous_limit = ini_get( 'pcre.backtrack_limit' );
			ini_set( 'pcre.backtrack_limit', '100000' ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- scoped guard for author-supplied regex.
			$matched = @preg_match( '#' . $rules['regex'] . '#u', $val ); // phpcs:ignore WordPress.PHP.NoSilencedErrors -- a malformed pattern must fail closed (treated as "does not match"), not throw a warning into the response.
			ini_set( 'pcre.backtrack_limit', $previous_limit ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- restore host setting immediately.
			if ( 1 !== $matched ) {
				return self::message( $rules, __( 'This value does not match the required format.', 'chargeforms' ) );
			}
		}

		if ( 'number' === ( $field['type'] ?? '' ) && is_numeric( $val ) ) {
			$num = (float) $val;
			if ( isset( $rules['min'] ) && '' !== $rules['min'] && $num < (float) $rules['min'] ) {
				return self::message( $rules, sprintf(
					/* translators: %s: minimum value */
					__( 'Must be at least %s.', 'chargeforms' ),
					$rules['min']
				) );
			}
			if ( isset( $rules['max'] ) && '' !== $rules['max'] && $num > (float) $rules['max'] ) {
				return self::message( $rules, sprintf(
					/* translators: %s: maximum value */
					__( 'Must be at most %s.', 'chargeforms' ),
					$rules['max']
				) );
			}
			// the reference product parity: "Digits" — an exact digit-COUNT constraint
			// (e.g. a 4-digit PIN, a 10-digit phone-as-number field), distinct
			// from min/max which constrain the numeric VALUE. `validation_msg_digits`
			// (Global Settings > Validation Messages) already existed — set up
			// alongside required/email/numeric/min/max/url when that screen was
			// built — but had zero field-level rule to actually apply it to
			// until now; every other one of that group already had a working
			// enforcement path.
			if ( ! empty( $rules['digits'] ) ) {
				$digit_count = strlen( preg_replace( '/\D/', '', $val ) );
				if ( $digit_count !== (int) $rules['digits'] ) {
					return self::message( $rules, Settings::get( 'validation_msg_digits', sprintf(
						/* translators: %d: required digit count */
						__( 'Must be exactly %d digits.', 'chargeforms' ),
						(int) $rules['digits']
					) ) );
				}
			}
		}

		return null;
	}

	private static function message( array $rules, $default ) {
		return ! empty( $rules['customMessage'] ) ? (string) $rules['customMessage'] : $default;
	}

	/** Same heuristic Form_Validator/Builtin_Operators already apply to conditional-logic regex conditions — a validation-rule regex runs against every real visitor submission just as often, so it needs the same ReDoS guard, not a weaker one just because it lives in a different settings section. */
	public static function is_safe_regex_pattern( $pattern ) {
		$pattern = (string) $pattern;
		if ( '' === $pattern || strlen( $pattern ) > self::MAX_REGEX_LENGTH ) {
			return false;
		}
		return ! preg_match( '/\([^)]*[+*][^)]*\)\s*[+*{]/', $pattern );
	}
}