<?php
/**
 * Allowed-HTML lists for escaping Dashbread's own markup at output with wp_kses().
 *
 * @package Dashbread
 */

declare( strict_types=1 );

namespace Dashbread\Core;

defined( 'ABSPATH' ) || exit;

/**
 * The shell's helpers (icons, the sidebar, header buttons, profile fields, island mounts) build
 * markup that wp_kses_post() would strip (SVG, buttons, form controls, data attributes). Templates
 * escape that markup where they print it with wp_kses( $html, Kses::ui() ).
 */
final class Kses {

	/** Attributes every allowed element may carry. */
	private const GLOBAL_ATTRS = array(
		'class'            => true,
		'id'               => true,
		'title'            => true,
		'role'             => true,
		'hidden'           => true,
		'style'            => true,
		'tabindex'         => true,
		'data-*'           => true,
		'aria-label'       => true,
		'aria-hidden'      => true,
		'aria-expanded'    => true,
		'aria-controls'    => true,
		'aria-current'     => true,
		'aria-describedby' => true,
		'aria-labelledby'  => true,
		'aria-selected'    => true,
	);

	/** Lucide's SVG elements and attributes (assets/icons/lucide.php). @return array<string,array<string,bool>> */
	public static function svg(): array {
		$shape = array( 'd' => true, 'cx' => true, 'cy' => true, 'r' => true, 'rx' => true, 'ry' => true, 'x' => true, 'y' => true, 'x1' => true, 'y1' => true, 'x2' => true, 'y2' => true, 'width' => true, 'height' => true, 'points' => true, 'fill' => true, 'stroke' => true, 'stroke-width' => true, 'transform' => true );
		return array(
			'svg'      => array( 'class' => true, 'viewbox' => true, 'width' => true, 'height' => true, 'fill' => true, 'stroke' => true, 'stroke-width' => true, 'stroke-linecap' => true, 'stroke-linejoin' => true, 'aria-hidden' => true, 'focusable' => true, 'role' => true, 'xmlns' => true ),
			'g'        => $shape,
			'path'     => $shape,
			'circle'   => $shape,
			'ellipse'  => $shape,
			'line'     => $shape,
			'rect'     => $shape,
			'polyline' => $shape,
			'polygon'  => $shape,
		);
	}

	/** Post HTML plus the SVG, buttons, form controls and data attributes the app's UI uses. @return array<string,array<string,bool>> */
	public static function ui(): array {
		static $allowed = null;
		if ( null !== $allowed ) {
			return $allowed;
		}
		$form = array(
			'form'     => array( 'action' => true, 'method' => true, 'enctype' => true, 'novalidate' => true, 'autocomplete' => true, 'name' => true ),
			'input'    => array( 'type' => true, 'name' => true, 'value' => true, 'checked' => true, 'disabled' => true, 'readonly' => true, 'required' => true, 'placeholder' => true, 'autocomplete' => true, 'accept' => true, 'min' => true, 'max' => true, 'step' => true, 'minlength' => true, 'maxlength' => true, 'size' => true, 'pattern' => true, 'multiple' => true, 'spellcheck' => true, 'autofocus' => true, 'inputmode' => true ),
			'select'   => array( 'name' => true, 'required' => true, 'disabled' => true, 'multiple' => true, 'autocomplete' => true ),
			'option'   => array( 'value' => true, 'selected' => true, 'disabled' => true ),
			'optgroup' => array( 'label' => true ),
			'textarea' => array( 'name' => true, 'rows' => true, 'cols' => true, 'required' => true, 'disabled' => true, 'readonly' => true, 'placeholder' => true, 'maxlength' => true ),
			'button'   => array( 'type' => true, 'name' => true, 'value' => true, 'disabled' => true, 'formnovalidate' => true ),
			'label'    => array( 'for' => true ),
			'img'      => array( 'src' => true, 'srcset' => true, 'sizes' => true, 'alt' => true, 'width' => true, 'height' => true, 'loading' => true, 'decoding' => true, 'fetchpriority' => true ),
			'a'        => array( 'href' => true, 'target' => true, 'rel' => true, 'download' => true ),
			'small'    => array(),
			'b'        => array(),
		);
		$allowed = array_merge( wp_kses_allowed_html( 'post' ), self::svg() );
		foreach ( $form as $tag => $attrs ) {
			$allowed[ $tag ] = array_merge( $allowed[ $tag ] ?? array(), $attrs );
		}
		foreach ( $allowed as $tag => $attrs ) {
			$allowed[ $tag ] = array_merge( is_array( $attrs ) ? $attrs : array(), self::GLOBAL_ATTRS );
		}
		return $allowed;
	}
}