<?php
/**
 * Shapes the editor's submitted form before anything else reads it.
 *
 * @package FeedWeaver
 */

namespace FeedWeaver\Admin;

defined( 'ABSPATH' ) || exit;

/**
 * The editor posts one nested array (`fw[...]`). WordPress's text sanitizer has already been applied to
 * every value by the time it reaches this class (see Admin), so what is left to do here is structural:
 * accept only the shapes the form can produce and refuse the rest, instead of trusting whatever a request
 * carries.
 *
 * - Only arrays and strings survive. Numbers, booleans, objects and nulls are dropped.
 * - Array keys must be integers or plain lower-case identifiers (letters, digits, underscore, hyphen), which is all the form uses. An element with
 *   any other key is dropped rather than renamed, so a hostile key can never become a valid one.
 * - Depth and width are capped well above what the form needs, so a crafted request cannot make later code
 *   walk an enormous structure.
 *
 * Pure PHP: no WordPress functions, so it can be unit-tested on its own.
 */
class Form_Input {

	/** Deepest nesting the form produces is fw[mappings][n][field]; one spare level. */
	const MAX_DEPTH = 4;

	/** Widest array the form produces is the 51 mapping rows (50 allowed plus one for validation to reject). */
	const MAX_ITEMS = 200;

	/** Longest key accepted (taxonomy names are at most 32 characters). */
	const MAX_KEY = 100;

	/**
	 * Reduces a posted value to a bounded tree of arrays and strings.
	 *
	 * @param mixed $value Value read from the request, after unslashing and text sanitizing.
	 * @param int   $depth Current depth (callers leave this at 0).
	 * @return array<int|string,mixed> Always an array; empty when the input has no usable shape.
	 */
	public static function shape( $value, int $depth = 0 ): array {
		if ( ! is_array( $value ) || $depth > self::MAX_DEPTH ) {
			return array();
		}
		$out = array();
		foreach ( $value as $key => $item ) {
			if ( count( $out ) >= self::MAX_ITEMS ) {
				break;
			}
			if ( is_string( $key ) && 1 !== preg_match( '/^[a-z0-9_\-]{1,' . self::MAX_KEY . '}$/D', $key ) ) {
				continue;
			}
			if ( is_array( $item ) ) {
				$out[ $key ] = self::shape( $item, $depth + 1 );
			} elseif ( is_string( $item ) ) {
				$out[ $key ] = $item;
			}
		}
		return $out;
	}

	/**
	 * Accepts a value only if it is a plain lower-case identifier (a post type or taxonomy name).
	 *
	 * This validates; it does not repair. WordPress's sanitize_key() would turn "../post" into "post" and
	 * "POST" into "post"; here such a value is refused, so a malformed identifier can never become a valid
	 * one. (Real post type and taxonomy names are already lower case, 20 and 32 characters at most.)
	 *
	 * @param mixed $value Candidate.
	 * @return string The value, or an empty string when it is not an identifier.
	 */
	public static function identifier( $value ): string {
		return ( is_string( $value ) && 1 === preg_match( '/^[a-z0-9_\-]{1,32}$/D', $value ) ) ? $value : '';
	}

	/**
	 * Identifier check for a list. Entries that are not identifiers become empty strings (they are kept, so
	 * the caller can see that something invalid was sent and refuse the request).
	 *
	 * @param mixed $value Candidate list, already text-sanitized.
	 * @param int   $max   Most entries to look at.
	 * @return string[]
	 */
	public static function identifiers( $value, int $max ): array {
		$out = array();
		foreach ( array_slice( self::shape( $value ), 0, $max ) as $item ) {
			$out[] = self::identifier( $item );
		}
		return $out;
	}
}