<?php
/**
 * The visitor-facing side: applies fixes to every public page as it is served,
 * adds the small fix stylesheet, and handles scan requests from the scanner.
 *
 * Nothing here loads a script for visitors. Scripts load only on scan requests,
 * which need a secret token that only the site's administrators get.
 *
 * @package Fixlight
 */

namespace Fixlight;

defined( 'ABSPATH' ) || exit;

/**
 * Front-end hooks.
 */
class Front {

	/**
	 * Hooks.
	 */
	public static function init() {
		add_action( 'template_redirect', array( __CLASS__, 'start' ), -1000 );
		add_action( 'wp_enqueue_scripts', array( __CLASS__, 'enqueue' ) );
		add_filter( 'show_admin_bar', array( __CLASS__, 'admin_bar' ), 1000 );
	}

	/**
	 * Whether this request comes from Fixlight's scanner.
	 *
	 * @return bool
	 */
	public static function is_scan_request() {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only switch checked against a secret token.
		$token = isset( $_GET['fixlight_scan'] ) ? sanitize_text_field( wp_unslash( $_GET['fixlight_scan'] ) ) : '';
		return '' !== $token && Scan_Token::verify( $token );
	}

	/**
	 * Whether fixes are switched off for this request ("before" scans and previews).
	 *
	 * @return bool
	 */
	public static function fixes_off() {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only preview switch, limited to scans and administrators.
		if ( empty( $_GET['fixlight_off'] ) ) {
			return false;
		}
		return self::is_scan_request() || current_user_can( 'manage_options' );
	}

	/**
	 * Whether this request should be skipped entirely.
	 *
	 * @return bool
	 */
	private static function excluded() {
		if ( is_admin() || wp_doing_ajax() || wp_doing_cron() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
			return true;
		}
		if ( is_feed() || is_robots() || is_trackback() || is_embed() || is_customize_preview() ) {
			return true;
		}
		if ( function_exists( 'wp_is_json_request' ) && wp_is_json_request() ) {
			return true;
		}
		if ( function_exists( 'wp_is_xml_request' ) && wp_is_xml_request() ) {
			return true;
		}
		if ( function_exists( 'amp_is_request' ) && amp_is_request() ) {
			return true;
		}
		// Page builders' editing screens: never change markup while someone is designing.
		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- Only checks for the presence of builder flags.
		foreach ( array( 'elementor-preview', 'et_fb', 'fl_builder', 'ct_builder', 'brizy-edit', 'brizy-edit-iframe', 'vc_editable', 'tve', 'bricks' ) as $flag ) {
			if ( isset( $_GET[ $flag ] ) ) {
				return true;
			}
		}
		// phpcs:enable
		/**
		 * Filters whether Fixlight skips the current front-end request.
		 *
		 * @param bool $skip Default false.
		 */
		return (bool) apply_filters( 'fixlight_skip_request', false );
	}

	/**
	 * Starts the output buffer that applies the fixes.
	 */
	public static function start() {
		if ( self::is_scan_request() || ( self::fixes_off() ) ) {
			if ( ! defined( 'DONOTCACHEPAGE' ) ) {
				define( 'DONOTCACHEPAGE', true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- Standard constant read by caching plugins.
			}
			nocache_headers();
		}
		/**
		 * Filters whether Fixlight rewrites this page at all. By default it does
		 * when at least one fix is on; Fixlight Pro also turns it on for fix rules.
		 *
		 * @param bool $buffer Whether to start the output buffer.
		 */
		$buffer = (bool) apply_filters( 'fixlight_buffer_output', (bool) array_filter( Settings::fixes() ) );
		if ( self::excluded() || self::fixes_off() || ! $buffer ) {
			return;
		}
		ob_start( array( __CLASS__, 'filter_output' ) );
	}

	/**
	 * Output buffer callback.
	 *
	 * The page is returned with attribute changes only; it is not run through
	 * wp_kses because it is the site's own complete HTML document.
	 *
	 * @param string $html Buffered page.
	 * @return string
	 */
	public static function filter_output( $html ) {
		if ( ! is_string( $html ) || '' === $html || strlen( $html ) > 2 * MB_IN_BYTES ) {
			return $html;
		}
		foreach ( headers_list() as $header ) {
			if ( 0 === stripos( $header, 'content-type:' ) && false === stripos( $header, 'html' ) ) {
				return $html;
			}
		}
		if ( false === stripos( $html, '<html' ) && false === stripos( $html, '<body' ) ) {
			return $html;
		}
		$result = Fixer::apply( $html, Settings::fixes(), self::context() );
		return $result['html'];
	}

	/**
	 * Fixer context for the current request.
	 *
	 * @param string $title Optional fixed title (used by background scans).
	 * @return array
	 */
	public static function context( $title = '' ) {
		return array(
			'language'       => get_bloginfo( 'language' ),
			'document_title' => static function () use ( $title ) {
				return '' !== $title ? $title : wp_get_document_title();
			},
			'attachment_alt' => array( __CLASS__, 'attachment_alts' ),
			'post_title'     => array( __CLASS__, 'post_title_for_url' ),
			'home_url'       => static function () {
				return home_url( '/' );
			},
			'site_name'      => static function () {
				// Stored HTML-escaped; the HTML API escapes attribute values itself.
				return wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
			},
		);
	}

	/**
	 * Alt text of attachments, false for images marked decorative.
	 *
	 * @param int[] $ids Attachment ids.
	 * @return array<int,string|false>
	 */
	public static function attachment_alts( array $ids ) {
		$ids = array_slice( array_filter( array_map( 'absint', $ids ) ), 0, 200 );
		if ( ! $ids ) {
			return array();
		}
		update_meta_cache( 'post', $ids );
		$alts = array();
		foreach ( $ids as $id ) {
			if ( get_post_meta( $id, '_fixlight_decorative', true ) ) {
				$alts[ $id ] = false;
				continue;
			}
			$alt = get_post_meta( $id, '_wp_attachment_image_alt', true );
			if ( is_string( $alt ) && '' !== trim( $alt ) ) {
				$alts[ $id ] = $alt;
			}
		}
		return $alts;
	}

	/**
	 * Title of the post a URL points to, '' when it is not a post.
	 *
	 * @param string $url Link URL.
	 * @return string
	 */
	public static function post_title_for_url( $url ) {
		static $cache = array();
		if ( isset( $cache[ $url ] ) ) {
			return $cache[ $url ];
		}
		$post_id = 0;
		if ( preg_match( '/#more-(\d+)$/', $url, $matches ) ) {
			$post_id = (int) $matches[1];
		} else {
			$host = wp_parse_url( $url, PHP_URL_HOST );
			if ( ! $host || wp_parse_url( home_url(), PHP_URL_HOST ) === $host ) {
				$post_id = url_to_postid( $url );
			}
		}
		$title = '';
		if ( $post_id && 'publish' === get_post_status( $post_id ) ) {
			$title = trim( wp_strip_all_tags( html_entity_decode( get_the_title( $post_id ), ENT_QUOTES, get_bloginfo( 'charset' ) ) ) );
		}
		$cache[ $url ] = $title;
		return $title;
	}

	/**
	 * Fix stylesheet, and the scanner scripts on scan requests.
	 */
	public static function enqueue() {
		if ( self::is_scan_request() && ! empty( $_GET['fixlight_frame'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Token checked in is_scan_request().
			wp_enqueue_script( 'fixlight-axe', FIXLIGHT_URL . 'assets/vendor/axe-core/axe.min.js', array(), '4.14.0', true );
			wp_enqueue_script( 'fixlight-scan-runner', FIXLIGHT_URL . 'assets/js/scan-runner.js', array( 'fixlight-axe' ), Plugin::asset_version( 'assets/js/scan-runner.js' ), true );
			wp_localize_script(
				'fixlight-scan-runner',
				'fixlightScan',
				array(
					'id'          => isset( $_GET['fixlight_id'] ) ? sanitize_key( wp_unslash( $_GET['fixlight_id'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
					'adminOrigin' => self::origin( admin_url() ),
					'sendHtml'    => self::fixes_off(),
				)
			);
		}

		if ( self::excluded() || self::fixes_off() ) {
			return;
		}
		$css = self::css( Settings::fixes() );
		if ( '' === $css ) {
			return;
		}
		wp_register_style( 'fixlight-fixes', false, array(), FIXLIGHT_VERSION );
		wp_enqueue_style( 'fixlight-fixes' );
		wp_add_inline_style( 'fixlight-fixes', $css );
	}

	/**
	 * CSS for the enabled fixes.
	 *
	 * @param array $fixes Fix id => bool.
	 * @return string
	 */
	public static function css( array $fixes ) {
		$css = '';
		if ( ! empty( $fixes['skip_link'] ) ) {
			// Above sticky headers (Divi's top bar uses 100000).
			$css .= '.fixlight-skip-link{position:absolute;left:-10000px;top:auto;width:1px;height:1px;overflow:hidden;z-index:2147483647}'
				. '.fixlight-skip-link:focus{left:8px;top:8px;width:auto;height:auto;overflow:visible;padding:12px 18px;background:#fff;color:#1d2327;border:2px solid #1d2327;border-radius:4px;font:600 16px/1.2 system-ui,-apple-system,"Segoe UI",sans-serif;text-decoration:underline}';
		}
		if ( ! empty( $fixes['focus_visible'] ) ) {
			// Dark outline with a light inner ring: visible on light and dark backgrounds.
			// Only the outline is forced (themes often remove it); a theme's own box-shadow wins over the ring.
			$css .= ':where(a,button,input,select,textarea,summary,[tabindex],[contenteditable],[role=button]):focus-visible{outline:3px solid #1d2327!important;outline-offset:2px!important;box-shadow:0 0 0 2px #fff}';
		}
		if ( ! empty( $fixes['underline_links'] ) ) {
			$css .= ':where(p,li,dd,td,blockquote,figcaption) a:where(:not([class*=button]):not([role=button]):not(.wp-element-button)){text-decoration:underline!important;text-underline-offset:.15em}';
		}
		if ( ! empty( $fixes['icon_labels'] ) || ! empty( $fixes['theme_compat'] ) ) {
			// Label text added inside links and buttons: read by screen readers, not shown.
			$css .= '.fixlight-sr{position:absolute!important;width:1px!important;height:1px!important;padding:0!important;margin:-1px!important;overflow:hidden!important;clip:rect(0,0,0,0)!important;white-space:nowrap!important;border:0!important}';
		}
		if ( ! empty( $fixes['theme_compat'] ) ) {
			$css .= Compat::css();
		}
		if ( ! empty( $fixes['reduced_motion'] ) ) {
			$css .= '@media (prefers-reduced-motion:reduce){*,*::before,*::after{animation-duration:.01ms!important;animation-iteration-count:1!important;transition-duration:.01ms!important;scroll-behavior:auto!important}}';
		}
		return $css;
	}

	/**
	 * Hides the admin bar on scan requests so it is not part of the results.
	 *
	 * @param bool $show Whether to show the admin bar.
	 * @return bool
	 */
	public static function admin_bar( $show ) {
		return self::is_scan_request() ? false : $show;
	}

	/**
	 * Scheme, host and port of a URL.
	 *
	 * @param string $url URL.
	 * @return string
	 */
	public static function origin( $url ) {
		$parts = wp_parse_url( $url );
		if ( empty( $parts['host'] ) ) {
			return '';
		}
		return ( isset( $parts['scheme'] ) ? $parts['scheme'] : 'https' ) . '://' . $parts['host'] . ( isset( $parts['port'] ) ? ':' . $parts['port'] : '' );
	}
}