<?php
namespace FrontGlut\Support;

defined( 'ABSPATH' ) || exit;

/**
 * The only place the plugin reads the query string ($_GET) for screens.
 *
 * Nothing read here changes data. Every data change goes through an AJAX or admin-post
 * handler that checks a nonce and a capability.
 *
 * - filter(): search terms, status/date filters, sort order and page numbers. These are only read when
 *   the request carries a valid "frontglut_view" nonce. The plugin's own filter forms, pagers and links
 *   add it (see field(), args() and Dashboard::url()). Without it the defaults are used.
 * - route(): a short, fixed list of keys that pick which screen or record to open (e.g. section, "a", "id").
 *   They are used in menu links, bookmarks and notification emails sent to other users, so they cannot
 *   carry a per-user nonce. Each screen checks the user's capability and ownership of the record itself,
 *   so these values never grant access. Public catalogue search on vendor stores and the knowledge base
 *   is read here too, like WordPress' own ?s= search, because those pages are public and often cached.
 */
class Request {
	const ARG    = '_fgv';
	const ACTION = 'frontglut_view';

	/** Keys route() may read. Anything else must come through filter(). */
	const ROUTE_KEYS = array(
		'frontglut', 'page_id', 'a', 'id', 'tab', 'to', 'vendor', // dashboard section, action, record, sub-tab, message recipient
		'page', 'sec', 'edit', 'cpt', 'tax', // wp-admin settings screens (manage_options/plugin capability required)
		'frontglut_edit', 'frontglut_embed', 'post', 'post_type', // front-end editor and wp-admin → dashboard redirect
		'redirect_to', 'frontglut_social_err', 'frontglut_pending', // login form display
		'q', 'fs', 'fo', 'sp', 'kq', 'kc', // public store / knowledge-base search, sort and page
	);

	/** True when the request carries a valid view nonce. */
	public static function verified() {
		if ( ! isset( $_GET[ self::ARG ] ) || ! is_string( $_GET[ self::ARG ] ) ) {
			return false;
		}
		return false !== wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET[ self::ARG ] ) ), self::ACTION );
	}

	/**
	 * A filter value (search, status, dates, sort, page number), only when the view nonce is valid.
	 *
	 * @param string $key     Query key.
	 * @param string $type    key|int|text|date|url|bool.
	 * @param mixed  $default Returned when missing, invalid or not verified.
	 */
	public static function filter( $key, $type = 'key', $default = '' ) {
		if ( ! isset( $_GET[ self::ARG ], $_GET[ $key ] ) || ! is_string( $_GET[ self::ARG ] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET[ self::ARG ] ) ), self::ACTION ) ) {
			return $default;
		}
		return self::clean( wp_unslash( $_GET[ $key ] ), $type, $default ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- sanitised by clean() per $type.
	}

	/** Current page number for paginated lists (nonce-verified, at least 1). */
	public static function page( $key = 'pg' ) {
		return max( 1, (int) self::filter( $key, 'int', 1 ) );
	}

	/**
	 * A navigation value from ROUTE_KEYS (which screen/record to show). See the class comment.
	 *
	 * @param string $key     One of ROUTE_KEYS.
	 * @param string $type    key|int|text|date|url|bool.
	 * @param mixed  $default Returned when missing or invalid.
	 */
	public static function route( $key, $type = 'key', $default = '' ) {
		if ( ! in_array( $key, self::ROUTE_KEYS, true ) || ! isset( $_GET[ $key ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- navigation only; see class comment.
			return $default;
		}
		return self::clean( wp_unslash( $_GET[ $key ] ), $type, $default ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- navigation only; sanitised by clean().
	}

	/** All navigation values present in the request, as sanitised text. */
	public static function routes() {
		$out = array();
		foreach ( self::ROUTE_KEYS as $k ) {
			if ( self::has_route( $k ) ) {
				$out[ $k ] = self::route( $k, 'text' );
			}
		}
		return $out;
	}

	/** True when a navigation key is present. */
	public static function has_route( $key ) {
		return '' !== self::route( $key, 'text', '' );
	}

	/** Query args that carry the view nonce, for links to filtered/paged lists. */
	public static function args() {
		return array( self::ARG => wp_create_nonce( self::ACTION ) );
	}

	/** Hidden inputs for a GET filter form: the view nonce, plus the current section and page id when not using pretty URLs. */
	public static function fields( $section = '' ) {
		$h = '<input type="hidden" name="' . esc_attr( self::ARG ) . '" value="' . esc_attr( wp_create_nonce( self::ACTION ) ) . '">';
		if ( self::has_route( 'frontglut' ) ) {
			$h .= '<input type="hidden" name="frontglut" value="' . esc_attr( $section ? $section : self::route( 'frontglut' ) ) . '">';
		}
		if ( self::has_route( 'page_id' ) ) {
			$h .= '<input type="hidden" name="page_id" value="' . esc_attr( (string) self::route( 'page_id', 'int', 0 ) ) . '">';
		}
		return $h;
	}

	private static function clean( $v, $type, $default ) {
		if ( ! is_scalar( $v ) ) {
			return $default;
		}
		$v = (string) $v;
		switch ( $type ) {
			case 'int':
				return is_numeric( $v ) ? (int) $v : $default;
			case 'text':
				return sanitize_text_field( $v );
			case 'date':
				return preg_match( '/^\d{4}-\d{2}-\d{2}$/', $v ) && strtotime( $v ) ? $v : $default;
			case 'url':
				return esc_url_raw( $v );
			case 'bool':
				return '' !== $v && '0' !== $v;
			default:
				return sanitize_key( $v );
		}
	}
}