<?php
declare(strict_types=1);

namespace Gatecraft;

use WP_User, WP_Error, WP_Session_Tokens, WP_CLI, RuntimeException, Throwable, Exception, DateTime, DateTimeImmutable, ZipArchive;

if (!defined('ABSPATH')) exit;


/*
 * Templates print their own markup and escape every value where it is printed (esc_html(), esc_attr(), esc_url(),
 * wp_kses()). A page is a template included directly, inside an output buffer whose callback only rewrites our
 * internal paths to WordPress URLs and applies the visitor's language (gatecraft_map_html()). Where a template
 * prints a block of HTML built elsewhere (a page body, a partial kept in a variable), it goes through wp_kses()
 * with allowed_html().
 */
function render(string $tpl, array $vars = [], ?string $layout = null): void
{
    $layout ??= str_starts_with($tpl, 'admin/') ? 'admin' : 'public';
    if ($layout === 'none') { stream_template($tpl, $vars); return; }
    $content = render_partial($tpl, $vars);
    if ($layout === 'public') {
        gatecraft_output_in_theme(gatecraft_map_html(render_partial('layout_public', $vars + ['content' => $content])), (string)($vars['title'] ?? ''));
        return;
    }
    stream_template('layout_' . $layout, $vars + ['content' => $content]);
}

/** The file of a template, from this plugin or an add-on (template_dirs()). */
function template_file(string $tpl): string
{
    if (!preg_match('#^[a-z0-9_/]+$#', $tpl)) throw new RuntimeException(esc_html('Bad template name: ' . $tpl));
    foreach (template_dirs() as $dir) if (is_file($dir . $tpl . '.php')) return $dir . $tpl . '.php';
    throw new RuntimeException(esc_html('Template not found: ' . $tpl));
}

/** Print a template in place (like get_template_part()). The template escapes what it prints. */
function include_template(string $__tpl, array $__vars = []): void
{
    $__file = template_file($__tpl);
    // The template's variables, by name. Only plain variable names; names starting with "__" and $this are never set.
    foreach ($__vars as $__name => $__value) {
        if (!is_string($__name) || $__name === 'this' || str_starts_with($__name, '__') || !preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', $__name)) continue;
        ${$__name} = $__value;
    }
    unset($__name, $__value, $__vars);
    include $__file;
}

/** A template's markup as a string, for emails and for blocks a page places later (printed with wp_kses()). */
function render_partial(string $tpl, array $vars = []): string
{
    ob_start();
    include_template($tpl, $vars);
    return (string)ob_get_clean();
}

/** Print a whole page or document from a template, with internal paths mapped to WordPress URLs. */
function stream_template(string $tpl, array $vars = []): void
{
    ob_start(fn(string $buffer): string => gatecraft_map_html($buffer));
    include_template($tpl, $vars);
    ob_end_flush();
}

/** Rewrite internal paths in our HTML ("/e/x", "/admin/...", "/uploads/...") to real WordPress URLs. */
function gatecraft_map_html(string $html): string
{
    $html = i18n_html($html);
    $html = preg_replace_callback('/\b(href|action|formaction|src|data-bg|data-endpoint|data-quote-url)="(\/(?!\/)[^"]*)"/', function ($m) {
        return $m[1] . '="' . esc_attr(map_url(html_entity_decode($m[2], ENT_QUOTES, 'UTF-8'))) . '"';
    }, $html);
    // GET forms (filters, search): the browser replaces the action's query string with the form fields,
    // which would drop page=... in wp-admin. Move those parameters into hidden inputs.
    $html = preg_replace_callback('/<form\b([^>]*)>/i', function ($m) {
        $attrs = $m[1];
        if (!preg_match('/\bmethod="get"/i', $attrs)) return $m[0];
        $action = preg_match('/\baction="([^"]*)"/i', $attrs, $a) ? html_entity_decode($a[1], ENT_QUOTES, 'UTF-8') : map_url(gatecraft_current_path());
        if ($action === '' || $action[0] === '?') $action = map_url(gatecraft_current_path());
        $qs = (string)wp_parse_url($action, PHP_URL_QUERY);
        if ($qs === '') return $m[0];
        parse_str($qs, $params);
        $base = strtok($action, '?');
        $attrs = preg_replace('/\s*\baction="[^"]*"/i', '', $attrs);
        $hidden = '';
        foreach ($params as $k => $v) if (is_string($v)) $hidden .= '<input type="hidden" name="' . esc_attr($k) . '" value="' . esc_attr($v) . '">';
        return '<form action="' . esc_attr($base) . '"' . $attrs . '>' . $hidden;
    }, $html);
    // Query-only links ("?edit=5#cat5") are relative to the current page. Inside wp-admin they would drop
    // page=... and land on an empty screen, so resolve them against the current route first.
    return preg_replace_callback('/\b(href|action|formaction)="(\?[^"]*)"/', function ($m) {
        return $m[1] . '="' . esc_attr(map_url(gatecraft_current_path() . html_entity_decode($m[2], ENT_QUOTES, 'UTF-8'))) . '"';
    }, $html);
}

function nonce_attr(): string
{
    return csp_nonce() ? ' nonce="' . e(csp_nonce()) . '"' : '';
}

/*
 * CSS output. WordPress has no esc_css(), so every dynamic value that goes into a style sheet passes through these.
 * Colours must be strict hex (sanitize_hex_color()); anything else falls back to a fixed default.
 */

/** A colour for CSS: #rgb or #rrggbb only, otherwise $fallback. */
function css_hex($color, string $fallback = '#000000'): string
{
    $hex = sanitize_hex_color(is_string($color) ? trim($color) : '');
    return $hex ? strtolower($hex) : $fallback;
}

/**
 * One custom property value: a colour, a theme variable, color-mix() of those, or a font stack. Only letters, digits,
 * spaces and # % ( ) , . - ' " / are allowed; anything that could end the declaration or the style element, a comment,
 * url(), expression() or @-rules returns ''.
 */
function css_value(string $value): string
{
    $value = trim($value);
    if ($value === '' || strlen($value) > 300) return '';
    if (preg_match('#/\*|\*/|url\s*\(|expression\s*\(|javascript\s*:#i', $value)) return '';
    return preg_match('#^[a-zA-Z0-9 \#%(),.\'"/-]+$#', $value) ? $value : '';
}

/** A rule of custom properties: "selector{--name:value;...}". Names must be --custom-properties; each value goes through css_value(). */
function css_vars(string $selector, array $vars): string
{
    if (!preg_match('/^[a-zA-Z0-9 .#:()_,>-]+$/', $selector)) return '';
    $out = '';
    foreach ($vars as $name => $value) {
        if (!is_string($name) || !preg_match('/^--[a-z0-9-]{1,40}$/', $name)) continue;
        $value = css_value((string)$value);
        if ($value !== '') $out .= $name . ':' . $value . ';';
    }
    return $out === '' ? '' : $selector . '{' . $out . '}';
}

/**
 * Last guard on a whole generated style sheet before it is queued: removes anything that could close the style element,
 * open a comment, import or execute code. The rules themselves are built from values checked with css_hex() and css_value().
 */
function css_clean(string $css): string
{
    $css = str_replace(['<', '>', '\\', '@', '/*', '*/'], '', $css);
    return (string)preg_replace('#expression\s*\(|javascript\s*:|behavior\s*:|-moz-binding#i', '', $css);
}

/**
 * Page-specific CSS (brand colours, category colours, layout sizes) through the WordPress style queue. Each call adds a
 * style handle with no file and the CSS attached with wp_add_inline_style(). Pages in the theme and in wp-admin print it
 * in the head, or with the late styles in the footer when the head was already sent (shortcodes, admin screens).
 * Standalone pages print it with print_page_styles(). Returns the handle, or '' when there is nothing to add.
 */
function inline_css(string $css, array $deps = []): string
{
    $css = css_clean($css);
    if (trim($css) === '') return '';
    static $n = 0;
    $handle = 'gatecraft-inline-' . (++$n);
    wp_register_style($handle, false, $deps, GATECRAFT_VERSION);
    wp_add_inline_style($handle, $css);
    wp_enqueue_style($handle);
    return $handle;
}

/**
 * Print queued styles in the <head> of a standalone page (door scanner, ticket sheet, invoice). The door scanner sends
 * a strict Content-Security-Policy and so uses no inline styles: its brand colours are set by app.js from data-brand.
 */
function print_page_styles(array $handles): void
{
    $handles = array_values(array_filter($handles));
    if ($handles) wp_print_styles($handles);
}

function asset(string $path): string
{
    return GATECRAFT_URL . 'assets/' . $path . '?ver=' . GATECRAFT_VERSION;
}

function upload_url(?string $name): string
{
    return $name && preg_match('/^[a-f0-9]{32}\.(jpg|png|webp)$/', $name) ? '/uploads/' . $name : '';
}

function badge(string $status, ?string $label = null): string
{
    return '<span class="badge badge-' . status_tone($status) . '">' . e($label ?? status_label($status)) . '</span>';
}

function icon(string $name): string
{
    $p = [
        'calendar' => '<rect x="3" y="4" width="18" height="18" rx="2"/><path d="M16 2v4M8 2v4M3 10h18"/>',
        'pin' => '<path d="M12 22s7-6.2 7-12a7 7 0 0 0-14 0c0 5.8 7 12 7 12z"/><circle cx="12" cy="10" r="2.5"/>',
        'clock' => '<circle cx="12" cy="12" r="9"/><path d="M12 7v5l3 2"/>',
        'ticket' => '<path d="M3 8a2 2 0 0 0 2-2h14a2 2 0 0 0 2 2v2a2 2 0 0 0 0 4v2a2 2 0 0 0-2 2H5a2 2 0 0 0-2-2v-2a2 2 0 0 0 0-4z"/><path d="M13 6v12" stroke-dasharray="2 2"/>',
        'home' => '<path d="M3 11l9-7 9 7v9a1 1 0 0 1-1 1h-5v-6H9v6H4a1 1 0 0 1-1-1z"/>',
        'building' => '<rect x="4" y="3" width="16" height="18" rx="1"/><path d="M9 7h1M14 7h1M9 11h1M14 11h1M9 15h1M14 15h1"/>',
        'cart' => '<circle cx="9" cy="20" r="1.5"/><circle cx="18" cy="20" r="1.5"/><path d="M2 3h3l2.5 12h11.5l2-8H6.2"/>',
        'check' => '<path d="M20 6L9 17l-5-5"/>',
        'scan' => '<path d="M3 7V4h3M18 4h3v3M21 17v3h-3M6 20H3v-3M7 12h10"/>',
        'chart' => '<path d="M4 20V10M10 20V4M16 20v-7M22 20H2"/>',
        'tag' => '<path d="M20.6 13.4 13.4 20.6a2 2 0 0 1-2.8 0L3 13V3h10l7.6 7.6a2 2 0 0 1 0 2.8z"/><circle cx="7.5" cy="7.5" r="1.5"/>',
        'users' => '<circle cx="9" cy="8" r="3.5"/><path d="M2.5 20a6.5 6.5 0 0 1 13 0M16 4.5a3.5 3.5 0 0 1 0 7M21.5 20a6.5 6.5 0 0 0-4-6"/>',
        'settings' => '<circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.7 1.7 0 0 0 .3 1.8l.1.1a2 2 0 1 1-2.8 2.8l-.1-.1a1.7 1.7 0 0 0-1.8-.3 1.7 1.7 0 0 0-1 1.5V21a2 2 0 1 1-4 0v-.1a1.7 1.7 0 0 0-1.1-1.5 1.7 1.7 0 0 0-1.8.3l-.1.1a2 2 0 1 1-2.8-2.8l.1-.1a1.7 1.7 0 0 0 .3-1.8 1.7 1.7 0 0 0-1.5-1H3a2 2 0 1 1 0-4h.1a1.7 1.7 0 0 0 1.5-1.1 1.7 1.7 0 0 0-.3-1.8l-.1-.1a2 2 0 1 1 2.8-2.8l.1.1a1.7 1.7 0 0 0 1.8.3H9a1.7 1.7 0 0 0 1-1.5V3a2 2 0 1 1 4 0v.1a1.7 1.7 0 0 0 1 1.5 1.7 1.7 0 0 0 1.8-.3l.1-.1a2 2 0 1 1 2.8 2.8l-.1.1a1.7 1.7 0 0 0-.3 1.8V9a1.7 1.7 0 0 0 1.5 1H21a2 2 0 1 1 0 4h-.1a1.7 1.7 0 0 0-1.5 1z"/>',
        'shield' => '<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/>',
        'bell' => '<path d="M18 8a6 6 0 0 0-12 0c0 7-3 9-3 9h18s-3-2-3-9M13.7 21a2 2 0 0 1-3.4 0"/>',
        'inbox' => '<path d="M22 12h-6l-2 3h-4l-2-3H2"/><path d="M5.5 5h13L22 12v6a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2v-6z"/>',
        'download' => '<path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4M7 10l5 5 5-5M12 15V3"/>',
        'plus' => '<path d="M12 5v14M5 12h14"/>',
        'menu' => '<path d="M3 6h18M3 12h18M3 18h18"/>',
        'logout' => '<path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4M16 17l5-5-5-5M21 12H9"/>',
        'list' => '<path d="M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01"/>',
        'mail' => '<rect x="2" y="4" width="20" height="16" rx="2"/><path d="m22 6-10 7L2 6"/>',
        'arrow-left' => '<path d="M19 12H5M12 19l-7-7 7-7"/>',
        'megaphone' => '<path d="M3 11v2a1 1 0 0 0 1 1h3l8 4V6L7 10H4a1 1 0 0 0-1 1z"/><path d="M19 8a5 5 0 0 1 0 8"/>',
        'star' => '<path d="M12 3l2.7 5.6 6.1.9-4.4 4.3 1 6.1L12 17l-5.4 2.9 1-6.1L3.2 9.5l6.1-.9z"/>',
        'alert' => '<path d="M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"/><path d="M12 9v4M12 17h.01"/>',
        'info' => '<circle cx="12" cy="12" r="9"/><path d="M12 11v5M12 8h.01"/>',
        'external' => '<path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6M15 3h6v6M10 14 21 3"/>',
    ][$name] ?? '';
    return '<svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' . $p . '</svg>';
}

/**
 * Form field helper. $o keys: required, help, placeholder, maxlength, min, max, step, rows,
 * options (value => label), class, id, autocomplete, inputmode, readonly.
 */
function field(string $type, string $name, string $label, $value = '', array $o = []): string
{
    $id = $o['id'] ?? 'f_' . preg_replace('/[^a-z0-9_]/i', '_', $name);
    $attrs = ' id="' . e($id) . '" name="' . e($name) . '"';
    // Browsers let the year part of a date take up to six digits unless a range is set.
    if ($type === 'date') $o += ['min' => '2000-01-01', 'max' => '2099-12-31'];
    if ($type === 'datetime-local') $o += ['min' => '2000-01-01T00:00', 'max' => '2099-12-31T23:59'];
    foreach (['placeholder', 'maxlength', 'min', 'max', 'step', 'autocomplete', 'inputmode', 'pattern'] as $a) {
        if (isset($o[$a])) $attrs .= ' ' . $a . '="' . e($o[$a]) . '"';
    }
    foreach ((array)($o['data'] ?? []) as $dk => $dv) if (preg_match('/^[a-z-]+$/', (string)$dk)) $attrs .= ' data-' . $dk . '="' . e($dv) . '"';
    if (!empty($o['required'])) $attrs .= ' required';
    if (!empty($o['readonly'])) $attrs .= ' readonly';
    if (!empty($o['autofocus'])) $attrs .= ' autofocus';
    $help = isset($o['help']) ? '<small class="help">' . e($o['help']) . '</small>' : '';
    $req = !empty($o['required']) ? ' <span class="req" aria-hidden="true">*</span>' : '';
    $cls = 'field' . (isset($o['class']) ? ' ' . $o['class'] : '');

    if ($type === 'checkbox') {
        return '<label class="' . $cls . ' field-check"><input type="checkbox" value="1"' . $attrs . ($value ? ' checked' : '') . '><span>' . e($label) . $help . '</span></label>';
    }
    $html = '<div class="' . $cls . '"><label for="' . e($id) . '">' . e($label) . $req . '</label>';
    if ($type === 'textarea') {
        $html .= '<textarea' . $attrs . ' rows="' . (int)($o['rows'] ?? 4) . '">' . e($value) . '</textarea>';
    } elseif ($type === 'select') {
        $html .= '<select' . $attrs . '>';
        foreach ($o['options'] ?? [] as $v => $l) {
            $html .= '<option value="' . e($v) . '"' . ((string)$v === (string)$value ? ' selected' : '') . '>' . e($l) . '</option>';
        }
        $html .= '</select>';
    } elseif ($type === 'money') {
        $html .= '<div class="input-affix"><span>' . e(cfg('currency')) . '</span><input type="text" inputmode="decimal"' . $attrs . ' value="' . e($value) . '"></div>';
    } else {
        $html .= '<input type="' . e($type) . '"' . $attrs . ' value="' . e($value) . '">';
    }
    return $html . $help . '</div>';
}

/** Small POST button form (for actions like approve, delete). */
function action_button(string $action, string $label, string $class = 'btn', array $hidden = [], ?string $confirm = null): string
{
    $h = '<form method="post" action="' . e($action) . '" class="inline-form"' . ($confirm ? ' data-confirm="' . e($confirm) . '"' : '') . '>' . csrf_field();
    foreach ($hidden as $k => $v) $h .= '<input type="hidden" name="' . e($k) . '" value="' . e($v) . '">';
    return $h . '<button type="submit" class="' . e($class) . '">' . e($label) . '</button></form>';
}

/** A row of filter chips: [value => [label, count]]. The chosen one is marked; links keep the other filters. */
function filter_chips(string $param, string $current, array $chips, array $query, string $label = 'Filter'): string
{
    $h = '<nav class="chips" aria-label="' . e($label) . '">';
    foreach ($chips as $v => [$text, $n]) {
        $q = $query; unset($q[$param], $q['page']);
        if ($v !== '') $q[$param] = $v;
        $on = (string)$v === $current;
        $h .= '<a class="chip' . ($on ? ' on' : '') . '" href="?' . e(http_build_query($q)) . '"' . ($on ? ' aria-current="true"' : '') . '>' . e($text)
            . ($n !== null ? ' <span class="chip-n">' . e(number_format((int)$n)) . '</span>' : '') . '</a>';
    }
    return $h . '</nav>';
}

function paginate(int $total, int $perPage, int $page, array $query): string
{
    $pages = (int)ceil($total / $perPage);
    if ($pages <= 1) return '';
    $h = '<nav class="pager" aria-label="Pages">';
    foreach ([['Previous', $page - 1], ['Next', $page + 1]] as [$l, $p]) {
        if ($p < 1 || $p > $pages) { $h .= '<span class="btn btn-ghost btn-sm disabled">' . $l . '</span>'; continue; }
        $h .= '<a class="btn btn-ghost btn-sm" href="?' . e(http_build_query($query + ['page' => $p])) . '">' . $l . '</a>';
    }
    return $h . '<span class="muted small">Page ' . $page . ' of ' . $pages . '</span></nav>';
}

/**
 * The tags and attributes the plugin's own HTML helpers produce (form fields, icons, badges, charts, QR codes).
 * Helper output is passed through wp_kses() with this list before it is printed.
 */
function allowed_html(): array
{
    static $a = null;
    if ($a !== null) return $a;
    $global = ['class', 'id', 'title', 'role', 'hidden', 'tabindex', 'lang', 'dir', 'translate', 'data-*', 'aria-label', 'aria-hidden', 'aria-current',
        'aria-expanded', 'aria-pressed', 'aria-describedby', 'aria-live', 'aria-controls', 'aria-labelledby', 'aria-invalid', 'aria-required',
        'aria-selected', 'aria-haspopup', 'aria-disabled', 'aria-modal', 'aria-atomic', 'aria-busy', 'aria-valuemin', 'aria-valuemax', 'aria-valuenow'];
    $tags = [
        'a' => ['href', 'target', 'rel', 'download', 'hreflang'], 'abbr' => [], 'article' => [], 'aside' => [], 'b' => [], 'br' => [], 'code' => [], 'em' => [], 'i' => [],
        'button' => ['type', 'name', 'value', 'disabled', 'formaction', 'formnovalidate', 'form', 'autofocus'],
        'details' => ['open'], 'summary' => [], 'div' => [], 'span' => [], 'p' => [], 'pre' => [], 'section' => [], 'header' => [], 'footer' => [], 'nav' => [], 'main' => [],
        'strong' => [], 'small' => [], 'mark' => [], 'kbd' => [], 'sup' => [], 'sub' => [], 'hr' => [], 'time' => ['datetime'],
        'h1' => [], 'h2' => [], 'h3' => [], 'h4' => [], 'h5' => [], 'h6' => [], 'ul' => [], 'ol' => ['start', 'reversed'], 'li' => ['value'],
        'dl' => [], 'dt' => [], 'dd' => [], 'blockquote' => ['cite'], 'figure' => [], 'figcaption' => [], 'noscript' => [],
        'table' => [], 'caption' => [], 'colgroup' => ['span'], 'col' => ['span'], 'thead' => [], 'tbody' => [], 'tfoot' => [], 'tr' => [],
        'th' => ['scope', 'colspan', 'rowspan'], 'td' => ['colspan', 'rowspan'],
        'img' => ['src', 'srcset', 'sizes', 'alt', 'width', 'height', 'loading', 'decoding'],
        'iframe' => ['src', 'name', 'width', 'height', 'allow', 'allowfullscreen', 'frameborder', 'loading', 'referrerpolicy'],
        'video' => ['src', 'poster', 'width', 'height', 'controls', 'muted', 'playsinline', 'autoplay', 'loop', 'preload'],
        'audio' => ['src', 'controls', 'preload', 'loop'], 'source' => ['src', 'srcset', 'type', 'media', 'sizes'], 'track' => ['src', 'kind', 'srclang', 'label', 'default'],
        'form' => ['method', 'action', 'enctype', 'novalidate', 'autocomplete', 'target'], 'fieldset' => ['disabled'], 'legend' => [], 'label' => ['for'],
        'input' => ['type', 'name', 'value', 'checked', 'disabled', 'readonly', 'required', 'placeholder', 'maxlength', 'minlength', 'min', 'max', 'step',
            'pattern', 'autocomplete', 'inputmode', 'accept', 'capture', 'autofocus', 'autocapitalize', 'spellcheck', 'size', 'multiple', 'list', 'form', 'formnovalidate'],
        'select' => ['name', 'required', 'disabled', 'multiple', 'autocomplete', 'size'], 'option' => ['value', 'selected', 'disabled', 'label'], 'optgroup' => ['label', 'disabled'],
        'textarea' => ['name', 'rows', 'cols', 'required', 'placeholder', 'maxlength', 'disabled', 'readonly', 'spellcheck', 'autocomplete'],
        'datalist' => [], 'output' => ['for', 'name'], 'template' => [], 'progress' => ['value', 'max'], 'meter' => ['value', 'min', 'max', 'low', 'high', 'optimum'],
        'svg' => ['xmlns', 'viewbox', 'width', 'height', 'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin', 'focusable', 'preserveaspectratio', 'shape-rendering'],
        'g' => ['fill', 'stroke', 'transform', 'opacity'], 'title' => [], 'defs' => [],
        'path' => ['d', 'fill', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin', 'stroke-dasharray', 'stroke-dashoffset', 'fill-rule', 'clip-rule', 'transform', 'opacity'],
        'rect' => ['x', 'y', 'width', 'height', 'rx', 'ry', 'fill', 'stroke', 'stroke-width', 'transform', 'opacity'],
        'circle' => ['cx', 'cy', 'r', 'fill', 'fill-opacity', 'opacity', 'stroke', 'stroke-width', 'stroke-dasharray', 'stroke-dashoffset', 'clip-path', 'transform'],
        'clippath' => [], 'line' => ['x1', 'y1', 'x2', 'y2', 'stroke', 'stroke-width', 'stroke-linecap'],
        'polyline' => ['points', 'fill', 'stroke', 'stroke-width'], 'polygon' => ['points', 'fill', 'stroke'],
        'text' => ['x', 'y', 'text-anchor', 'dominant-baseline', 'font-size', 'fill'],
    ];
    $a = [];
    foreach ($tags as $t => $attrs) $a[$t] = array_fill_keys(array_merge($global, $attrs), true);
    // Rich text written in the editor (event descriptions, announcements) keeps what rich_clean() allowed when it was saved.
    foreach (rich_allowed_html() as $t => $attrs) $a[$t] = ($a[$t] ?? []) + (is_array($attrs) ? $attrs : []);
    return $a;
}

/** How the list of events is laid out on the home page and in the events shortcode: value => label. */
function event_list_views(): array
{
    return ['small' => 'Small', 'medium' => 'Medium', 'wide' => 'Wide', 'full' => 'Full width', 'list' => 'List'];
}

function event_list_view(?string $v = null): string
{
    $v ??= setting('event_list_view');
    return isset(event_list_views()[$v]) ? $v : 'medium';
}

/** Colour picker with a hex box and a few presets. Empty means "use the default". Used for ticket category colours. */
function color_field(string $id, ?string $value, string $label = 'Colour', string $help = 'Pick a colour or type a hex code. Leave empty to use the event colour.'): string
{
    $v = $value && preg_match('/^#[0-9a-f]{6}$/i', $value) ? strtolower($value) : '';
    $presets = ['#b8860b' => 'Gold', '#8b939c' => 'Silver', '#a0522d' => 'Bronze', '#dc2626' => 'Red', '#ea580c' => 'Orange', '#16a34a' => 'Green', '#0d9488' => 'Teal', '#2563eb' => 'Blue', '#7c3aed' => 'Violet', '#db2777' => 'Pink', '#0f172a' => 'Black'];
    $h = '<div class="field"><label for="' . e($id) . '">' . e($label) . '</label><div class="color-field" data-color-field>';
    $h .= '<input type="color" value="' . e($v ?: '#c2410c') . '" aria-label="Pick a colour" tabindex="-1">';
    $h .= '<input type="text" id="' . e($id) . '" name="color" value="' . e($v) . '" placeholder="Event colour" maxlength="7" pattern="#?[0-9a-fA-F]{6}" autocomplete="off" spellcheck="false">';
    $h .= '<button type="button" class="btn btn-sm" data-clear>Reset</button></div><div class="color-presets">';
    foreach ($presets as $hex => $name) $h .= '<button type="button" class="color-dot" data-hex="' . e($hex) . '" title="' . e($name) . '" aria-label="' . e($name) . '"><i class="cd-' . e(substr($hex, 1)) . '"></i></button>';
    return $h . '</div><small class="help">' . e($help) . '</small></div>';
}

/** CSS for the .cd-<hex> colour dots on a page, added with inline_css() (inline style attributes are blocked by the CSP). */
function color_dots_css(array $hexes): void
{
    $hexes = array_merge(['#b8860b', '#8b939c', '#a0522d', '#dc2626', '#ea580c', '#16a34a', '#0d9488', '#2563eb', '#7c3aed', '#db2777', '#0f172a'], $hexes);
    $css = '';
    foreach (array_unique(array_map('strtolower', $hexes)) as $h) if (preg_match('/^#[0-9a-f]{6}$/', $h)) $css .= '.cd-' . substr($h, 1) . '{background:' . $h . '}';
    inline_css($css);
}