<?php
/**
 * URL rule.
 *
 * @package FormPilot
 * @since   1.0.0
 */

declare( strict_types = 1 );

namespace FormPilot\Validation\Rules;

use FormPilot\Contracts\ValidationRule;
use FormPilot\Fields\FieldTypes;
use FormPilot\Models\Field;
use FormPilot\Validation\ValidationError;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Checks that a URL field holds an address a browser can follow.
 *
 * Only http and https are accepted. A `javascript:` or `data:` URL stored here
 * would be rendered as a link on the entry screen, which turns a form field
 * into a way to attack whoever reads the submission.
 *
 * @since 1.0.0
 */
final class UrlRule implements ValidationRule {

	/**
	 * Schemes a submitted URL may use.
	 */
	private const SCHEMES = array( 'http', 'https' );

	/**
	 * Determines whether this rule applies to a field.
	 *
	 * @param Field $field Field being validated.
	 */
	public function supports( Field $field ): bool {
		return FieldTypes::URL === $field->type();
	}

	/**
	 * Checks the address.
	 *
	 * @param Field $field Field being validated.
	 * @param mixed $value Sanitised value.
	 *
	 * @return ValidationError|null The failure, or null when the value passes.
	 */
	public function validate( Field $field, mixed $value ): ?ValidationError {
		$url    = (string) $value;
		$scheme = wp_parse_url( $url, PHP_URL_SCHEME );
		$host   = wp_parse_url( $url, PHP_URL_HOST );

		$valid = is_string( $scheme )
			&& is_string( $host )
			&& '' !== $host
			&& in_array( strtolower( $scheme ), self::SCHEMES, true )
			&& false !== filter_var( $url, FILTER_VALIDATE_URL );

		if ( $valid ) {
			return null;
		}

		return new ValidationError(
			'',
			'invalid_url',
			__( 'Please enter a valid web address, starting with http:// or https://.', 'devplugins-custom-form-builder' )
		);
	}
}