<?php
/**
 * Code an AI assistant would add to a post or a custom field.
 *
 * @package GripMCP
 */

declare( strict_types=1 );

namespace GripMCP\Support;

defined( 'ABSPATH' ) || exit;

/**
 * Content saved through the post and custom-field tools reaches visitors, and
 * WordPress filters markup only for accounts without unfiltered_html. An
 * administrator's assistant could otherwise put a script, an embedded frame,
 * an event handler, a javascript: link or a block's own custom CSS on a page,
 * on its own initiative or because a web page or email it read told it to.
 *
 * So the plugin from WordPress.org lets the tools save content but never add
 * code: a change is compared with what is stored, and refused when it brings
 * in a piece of code the stored value does not already have. Code people put
 * there stays, and a change that keeps it as it is saves. Nothing is removed
 * without a word, as filtering would do: the assistant is told why, and the
 * person can add the code themselves in the editor. The paid version lets
 * its CSS-editing plans (Creator and up) add code, holding the call for
 * approval under "Ask me first" with the code on the approval page.
 *
 * What counts as code is what WordPress's post filter (wp_kses_post()) never
 * lets through for an author: script-like elements, embedded frames and
 * objects, inline event handlers, script and data URLs, and WordPress 7.0's
 * per-block custom CSS ("style": {"css": …} in a block's attributes).
 * JSON text (an Elementor layout, a site's saved styles) is read value by
 * value, so a change elsewhere in the document never counts as new code.
 */
final class Added_Code {

	/**
	 * Elements read whole, up to their closing tag: their content runs or
	 * draws, so a change inside them is new code too.
	 */
	private const WHOLE_ELEMENTS = 'script|style|noscript|xmp|svg|math|template';

	/**
	 * Elements read by their opening tag: they load or run something from
	 * the tag itself.
	 */
	private const TAG_ELEMENTS = 'iframe|frame|frameset|object|embed|applet|base|link|meta|portal|input';

	/**
	 * What follows a tag's name up to its ">": anything but ">" and quotes,
	 * or a quoted value, which may hold ">" (unclosed, it runs to the end).
	 * A browser does not end a tag at a ">" inside a quoted value.
	 */
	private const TAG_BODY = '(?:[^>"\']|"[^"]*(?:"|\z)|\'[^\']*(?:\'|\z))*';

	/**
	 * Attributes that take a URL a browser follows or loads.
	 */
	private const URL_ATTRIBUTES = 'href|src|action|formaction|xlink:href|data|poster|background|srcdoc';

	/**
	 * How deep a value is read (nested arrays, JSON in JSON, blocks in
	 * blocks), so a crafted value cannot exhaust the stack.
	 */
	private const MAX_DEPTH = 32;

	/**
	 * Characters of a piece of code quoted in a refusal or an approval.
	 */
	private const QUOTE = 120;

	/**
	 * Whether this site's plan lets the tools add code: the paid version's
	 * CSS-editing plans, Creator and up. Never in the plugin from
	 * WordPress.org.
	 */
	public static function allowed(): bool {
		return class_exists( \GripMCP\Premium\Paid_Writes::class ) && \GripMCP\Premium\Paid_Writes::code();
	}

	/**
	 * The pieces of code a change adds: those in the new value that the
	 * stored one does not have as often. Empty when it adds none.
	 *
	 * @param mixed $before The value stored now ('' for a new one).
	 * @param mixed $after  The value that would be stored.
	 * @return array<int, array{label:string, code:string}>
	 */
	public static function added( $before, $after ): array {
		$new = self::pieces( $after );

		if ( empty( $new ) ) {
			return array();
		}

		$old   = self::pieces( $before );
		$added = array();

		foreach ( $new as $key => $piece ) {
			$extra = $piece['count'] - ( isset( $old[ $key ] ) ? $old[ $key ]['count'] : 0 );

			for ( $i = 0; $i < $extra; $i++ ) {
				$added[] = array(
					'label' => $piece['label'],
					'code'  => $piece['code'],
				);
			}
		}

		return $added;
	}

	/**
	 * The code a change to a post's own fields adds: title, content and
	 * excerpt, each compared with what the post has now.
	 *
	 * @param \WP_Post|null        $post   The post as stored, or null for a new one.
	 * @param array<string, mixed> $fields Columns that would be written, with their new values.
	 * @return array<int, array{label:string, code:string}>
	 */
	public static function in_post( ?\WP_Post $post, array $fields ): array {
		$added = array();

		foreach ( array( 'post_title', 'post_content', 'post_excerpt' ) as $column ) {
			if ( ! array_key_exists( $column, $fields ) ) {
				continue;
			}

			$before = $post instanceof \WP_Post ? (string) $post->{$column} : '';
			$added  = array_merge( $added, self::added( $before, (string) $fields[ $column ] ) );
		}

		return $added;
	}

	/**
	 * The sentence a tool description adds about code, with a leading space.
	 */
	public static function description_note(): string {
		return ' ' . ( self::allowed()
			? __( 'A change that adds code (a script, an embedded frame or object, an event handler, a javascript: link or a block\'s custom CSS) waits for the person\'s approval when approvals are on.', 'gripmcp' )
			: __( 'It cannot add code (a script, an embedded frame or object, an event handler, a javascript: link or a block\'s custom CSS); code already saved is kept when sent back unchanged.', 'gripmcp' ) );
	}

	/**
	 * A fingerprint of a post's own fields, for a held change that adds code:
	 * if the post changes before anyone approves, the code on the approval
	 * page may no longer be all the change adds, so the approved call stops.
	 *
	 * @param int $post_id Post id.
	 */
	public static function post_state( int $post_id ): string {
		$post = $post_id > 0 ? get_post( $post_id ) : null;

		if ( ! $post instanceof \WP_Post ) {
			return '';
		}

		return md5( (string) wp_json_encode( array( $post->post_title, $post->post_content, $post->post_excerpt ) ) );
	}

	/**
	 * Why the change cannot be saved on this plan, or '' when it adds no code
	 * or the plan allows it.
	 *
	 * @param array<int, array{label:string, code:string}> $added What added() found.
	 */
	public static function refusal( array $added ): string {
		if ( empty( $added ) || self::allowed() ) {
			return '';
		}

		$text = sprintf(
			/* translators: %s: what the code is, e.g. "a <script> element (<script src="https://example.com/a.js">)". */
			__( 'This change adds code: %s. GripMCP does not let an AI assistant add code to the site (scripts, embedded frames or objects, event handlers, javascript: links or a block\'s custom CSS), so nothing was changed. Code already saved is kept: send it back exactly as stored, or make the change with wp_posts_edit. If the person wants this code, they can add it themselves in the WordPress editor, for example with a Custom HTML block; tell them so instead of trying another way.', 'gripmcp' ),
			self::describe( $added )
		);

		// The paid copy on a plan below Creator says which plan adds code.
		if ( class_exists( \GripMCP\Premium\Paid_Writes::class ) ) {
			$text .= ' ' . \GripMCP\Premium\Paid_Writes::code_plan_note();
		}

		return $text;
	}

	/**
	 * What "Destructive actions: Off" says about a change that adds code on
	 * a plan that allows it: it is held like a delete, so with the switch
	 * off it is refused like one.
	 *
	 * @param array<int, array{label:string, code:string}> $added What added() found.
	 */
	public static function off_message( array $added ): string {
		return sprintf(
			/* translators: %s: what the code is, e.g. "a <script> element (<script src="https://example.com/a.js">)". */
			__( 'This change adds code: %s. Adding code to the site is treated like a delete, and "Destructive actions" is off on this site, so nothing was changed. The person can add the code in the WordPress editor, or turn "Destructive actions" to "Ask me first" in GripMCP\'s settings.', 'gripmcp' ),
			self::describe( $added )
		);
	}

	/**
	 * The pieces of code, for a sentence: what each is and how it starts,
	 * the first three, then how many more.
	 *
	 * @param array<int, array{label:string, code:string}> $added What added() found.
	 */
	public static function describe( array $added ): string {
		$parts = array();

		foreach ( array_slice( $added, 0, 3 ) as $piece ) {
			$parts[] = sprintf(
				/* translators: 1: what the code is, e.g. "a <script> element", 2: the code, shortened. */
				__( '%1$s (%2$s)', 'gripmcp' ),
				$piece['label'],
				self::clip( $piece['code'] )
			);
		}

		$more = count( $added ) - count( $parts );
		if ( $more > 0 ) {
			$parts[] = sprintf(
				/* translators: %d: number of further pieces of code. */
				_n( '%d more', '%d more', $more, 'gripmcp' ),
				$more
			);
		}

		return implode( '; ', $parts );
	}

	/**
	 * Every piece of code in a value, counted, keyed by its normalised text.
	 *
	 * @param mixed $value Text (HTML, block markup or JSON) or a list of values.
	 * @return array<string, array{label:string, code:string, count:int}>
	 */
	public static function pieces( $value ): array {
		$found = array();
		self::collect( $value, $found, 0 );

		return $found;
	}

	/**
	 * Add the pieces of code in a value to $found.
	 *
	 * @param mixed                                                    $value Value.
	 * @param array<string, array{label:string, code:string, count:int}> $found Pieces so far.
	 * @param int                                                      $depth How deep this value sits.
	 */
	private static function collect( $value, array &$found, int $depth ): void {
		if ( $depth > self::MAX_DEPTH ) {
			return;
		}

		if ( is_object( $value ) ) {
			$value = get_object_vars( $value );
		}

		if ( is_array( $value ) ) {
			foreach ( $value as $item ) {
				self::collect( $item, $found, $depth + 1 );
			}

			return;
		}

		if ( ! is_string( $value ) || '' === $value ) {
			return;
		}

		// A JSON document (an Elementor layout, a site's saved styles) is read
		// value by value: its text escapes markup, and a change anywhere in it
		// would otherwise make an element in it look new.
		$trimmed = ltrim( $value );
		if ( '' !== $trimmed && ( '{' === $trimmed[0] || '[' === $trimmed[0] ) ) {
			$decoded = json_decode( $value, true );

			if ( is_array( $decoded ) ) {
				self::collect( $decoded, $found, $depth + 1 );
				return;
			}
		}

		self::markup( $value, $found );

		// Block attributes are JSON inside an HTML comment, where WordPress
		// writes "<" as a Unicode escape, so they are read decoded: a
		// block's custom CSS, and markup in any attribute.
		if ( false !== strpos( $value, '<!-- wp:' ) && function_exists( 'parse_blocks' ) ) {
			self::blocks( parse_blocks( $value ), $found, $depth + 1 );
		}
	}

	/**
	 * Add the pieces of code in HTML to $found.
	 *
	 * @param string                                                   $html  HTML.
	 * @param array<string, array{label:string, code:string, count:int}> $found Pieces so far.
	 */
	private static function markup( string $html, array &$found ): void {
		if ( false === strpos( $html, '<' ) ) {
			return;
		}

		// Elements read whole. An unclosed one runs to the end, as a browser
		// reads it.
		$rest = (string) preg_replace_callback(
			'#<(' . self::WHOLE_ELEMENTS . ')\b' . self::TAG_BODY . '(?:>|\z).*?(?:</\1\s*>|\z)#is',
			static function ( array $m ) use ( &$found ): string {
				self::add( $found, self::element_label( strtolower( $m[1] ) ), $m[0] );
				return ' ';
			},
			$html
		);

		// Every other tag is read twice: by WordPress's HTML Tag Processor,
		// which splits tags and attributes as a browser does, and by a
		// pattern that does the same for quoted values (a ">" inside one
		// does not end the tag). Both write a piece of code the same way, and
		// each piece counts as often as the reader that saw it more often
		// found it, so a gap in either (an older WordPress's processor, a
		// corner the pattern misreads) is covered by the other.
		$by_pattern   = array();
		$by_processor = array();
		self::read_by_pattern( $rest, $by_pattern );
		self::read_by_processor( $rest, $by_processor );

		foreach ( $by_processor as $key => $piece ) {
			if ( ! isset( $by_pattern[ $key ] ) || $by_pattern[ $key ]['count'] < $piece['count'] ) {
				$by_pattern[ $key ] = $piece;
			}
		}

		foreach ( $by_pattern as $key => $piece ) {
			if ( isset( $found[ $key ] ) ) {
				$found[ $key ]['count'] += $piece['count'];
			} else {
				$found[ $key ] = $piece;
			}
		}
	}

	/**
	 * Add the code in the tags of HTML to $found, reading each tag with a
	 * pattern that skips quoted attribute values.
	 *
	 * @param string                                                   $html  HTML without the elements read whole.
	 * @param array<string, array{label:string, code:string, count:int}> $found Pieces so far.
	 */
	private static function read_by_pattern( string $html, array &$found ): void {
		if ( ! preg_match_all( '#<([a-zA-Z][^\s/>"\']*)(' . self::TAG_BODY . ')>?#', $html, $tags, PREG_SET_ORDER ) ) {
			return;
		}

		foreach ( $tags as $tag ) {
			self::tag( strtolower( $tag[1] ), self::attributes( $tag[2] ), $found );
		}
	}

	/**
	 * Add the code in the tags of HTML to $found, reading each tag with
	 * WordPress's HTML Tag Processor (WordPress 6.2 and later).
	 *
	 * @param string                                                   $html  HTML without the elements read whole.
	 * @param array<string, array{label:string, code:string, count:int}> $found Pieces so far.
	 */
	private static function read_by_processor( string $html, array &$found ): void {
		if ( ! class_exists( '\WP_HTML_Tag_Processor' ) ) {
			return;
		}

		try {
			$processor = new \WP_HTML_Tag_Processor( $html );

			while ( $processor->next_tag() ) {
				$attributes = array();

				foreach ( (array) $processor->get_attribute_names_with_prefix( '' ) as $name ) {
					$value        = $processor->get_attribute( (string) $name );
					$attributes[] = array( strtolower( (string) $name ), is_string( $value ) ? $value : true );
				}

				self::tag( strtolower( (string) $processor->get_tag() ), $attributes, $found );
			}
		} catch ( \Throwable $e ) {
			// The pattern's reading stands alone.
			return;
		}
	}

	/**
	 * Add the code one opening tag holds to $found: the element itself when
	 * it loads or runs something, its event handlers and its script links.
	 * Each piece is written from the tag's name and its attributes' decoded
	 * values, so both readers write the same text for the same code.
	 *
	 * @param string                                                   $name       Tag name, lower case.
	 * @param array<int, array{0:string, 1:string|true}>               $attributes Name in lower case and decoded value (true for a name alone), in the order written.
	 * @param array<string, array{label:string, code:string, count:int}> $found      Pieces so far.
	 */
	private static function tag( string $name, array $attributes, array &$found ): void {
		if ( 1 === preg_match( '#^(?:' . self::TAG_ELEMENTS . ')$#', $name ) ) {
			$written = array_map(
				static function ( array $attribute ): string {
					return self::written( $attribute[0], $attribute[1] );
				},
				$attributes
			);

			self::add( $found, self::element_label( $name ), '<' . $name . ( empty( $written ) ? '' : ' ' . implode( ' ', $written ) ) . '>' );
		}

		foreach ( $attributes as $attribute ) {
			list( $attribute_name, $value ) = $attribute;

			if ( 1 === preg_match( '#^on[a-z]+$#', $attribute_name ) ) {
				self::add(
					$found,
					sprintf(
						/* translators: %s: attribute name, e.g. "onclick". */
						__( 'an %s event handler', 'gripmcp' ),
						$attribute_name
					),
					self::written( $attribute_name, $value )
				);
				continue;
			}

			if ( ! is_string( $value ) || 1 !== preg_match( '#^(?:' . self::URL_ATTRIBUTES . ')$#', $attribute_name ) ) {
				continue;
			}

			$scheme = self::script_scheme( $value );

			if ( '' !== $scheme ) {
				self::add(
					$found,
					sprintf(
						/* translators: %s: URL scheme, e.g. "javascript:". */
						__( 'a %s link', 'gripmcp' ),
						$scheme
					),
					self::written( $attribute_name, $value )
				);
			}
		}
	}

	/**
	 * An attribute as one piece of text: its name, and its decoded value in
	 * double quotes when it has one.
	 *
	 * @param string      $name  Name, lower case.
	 * @param string|true $value Decoded value, or true for a name alone.
	 */
	private static function written( string $name, $value ): string {
		return true === $value || '' === $value ? $name : $name . '="' . $value . '"';
	}

	/**
	 * A tag's attributes, read as a browser splits them: text inside a
	 * quoted value ("go online=1", "a>b") is never taken for an attribute or
	 * the end of the tag, and a name given twice keeps its first value, as
	 * a browser keeps it.
	 *
	 * @param string $inside What follows the tag name, up to the tag's ">".
	 * @return array<int, array{0:string, 1:string|true}> Name in lower case and decoded value (true for a name alone).
	 */
	private static function attributes( string $inside ): array {
		if ( ! preg_match_all( '#([^\s"\'>/=]+)(?:\s*=\s*("[^"]*"?|\'[^\']*\'?|[^\s>]+))?#', $inside, $matches, PREG_SET_ORDER ) ) {
			return array();
		}

		$list = array();
		foreach ( $matches as $match ) {
			$name = strtolower( $match[1] );

			if ( isset( $list[ $name ] ) ) {
				continue;
			}

			$list[ $name ] = array(
				$name,
				isset( $match[2] ) ? html_entity_decode( self::unquote( $match[2] ), ENT_QUOTES | ENT_HTML5, 'UTF-8' ) : true,
			);
		}

		return array_values( $list );
	}

	/**
	 * An attribute value without the quotes around it.
	 *
	 * @param string $value Value as written.
	 */
	private static function unquote( string $value ): string {
		$first = '' !== $value ? $value[0] : '';

		if ( '"' === $first || "'" === $first ) {
			$value = substr( $value, 1 );

			if ( '' !== $value && substr( $value, -1 ) === $first ) {
				$value = substr( $value, 0, -1 );
			}
		}

		return $value;
	}

	/**
	 * Add the code in parsed blocks' attributes to $found.
	 *
	 * @param array<int, mixed>                                        $blocks Parsed blocks.
	 * @param array<string, array{label:string, code:string, count:int}> $found  Pieces so far.
	 * @param int                                                      $depth  How deep these blocks sit.
	 */
	private static function blocks( array $blocks, array &$found, int $depth ): void {
		if ( $depth > self::MAX_DEPTH ) {
			return;
		}

		foreach ( $blocks as $block ) {
			if ( ! is_array( $block ) ) {
				continue;
			}

			$attrs = isset( $block['attrs'] ) && is_array( $block['attrs'] ) ? $block['attrs'] : array();

			if ( isset( $attrs['style'] ) && is_array( $attrs['style'] ) && array_key_exists( 'css', $attrs['style'] ) ) {
				$css = $attrs['style']['css'];

				if ( ! is_string( $css ) || '' !== trim( $css ) ) {
					self::add( $found, __( 'custom CSS on a block', 'gripmcp' ), is_string( $css ) ? $css : (string) wp_json_encode( $css ) );
				}
			}

			if ( isset( $attrs['style'] ) && is_array( $attrs['style'] ) ) {
				unset( $attrs['style']['css'] );
			}
			self::collect_attributes( $attrs, $found, $depth + 1 );

			if ( ! empty( $block['innerBlocks'] ) && is_array( $block['innerBlocks'] ) ) {
				self::blocks( $block['innerBlocks'], $found, $depth + 1 );
			}
		}
	}

	/**
	 * Add the code in block attribute values that hold markup to $found.
	 *
	 * @param mixed                                                    $value Attribute value.
	 * @param array<string, array{label:string, code:string, count:int}> $found Pieces so far.
	 * @param int                                                      $depth How deep it sits.
	 */
	private static function collect_attributes( $value, array &$found, int $depth ): void {
		if ( $depth > self::MAX_DEPTH ) {
			return;
		}

		if ( is_array( $value ) ) {
			foreach ( $value as $item ) {
				self::collect_attributes( $item, $found, $depth + 1 );
			}

			return;
		}

		if ( is_string( $value ) ) {
			self::markup( $value, $found );
		}
	}

	/**
	 * The scheme of a URL a browser would run rather than visit, or ''.
	 * The value comes decoded, once, as a browser decodes it (decoding it
	 * again would read "&amp;#106;" as "j"); the spaces and control
	 * characters browsers skip are taken out, as WordPress's own filter
	 * does. An inline picture (data:image/png and the like) is not code.
	 *
	 * @param string $value Decoded attribute value.
	 */
	private static function script_scheme( string $value ): string {
		$value = strtolower( (string) preg_replace( '#[\x00-\x20\x7f]+#', '', $value ) );

		if ( 0 === strpos( $value, 'javascript:' ) ) {
			return 'javascript:';
		}

		if ( 0 === strpos( $value, 'vbscript:' ) ) {
			return 'vbscript:';
		}

		if ( 0 === strpos( $value, 'data:' ) && 1 !== preg_match( '#^data:image/(?:png|jpe?g|gif|webp|avif|bmp)[;,]#', $value ) ) {
			return 'data:';
		}

		return '';
	}

	/**
	 * What an element is, for a sentence.
	 *
	 * @param string $name Element name, lower case.
	 */
	private static function element_label( string $name ): string {
		if ( 'style' === $name ) {
			return __( 'a <style> element (CSS)', 'gripmcp' );
		}

		$article = in_array( $name[0], array( 'a', 'e', 'i', 'o', 'u' ), true ) ? 'an' : 'a';

		return sprintf(
			/* translators: 1: "a" or "an", 2: element name, e.g. "script". */
			__( '%1$s <%2$s> element', 'gripmcp' ),
			$article,
			$name
		);
	}

	/**
	 * Count one piece of code, keyed by its text with case and runs of
	 * white space evened out, so the same code saved again matches.
	 *
	 * @param array<string, array{label:string, code:string, count:int}> $found Pieces so far.
	 * @param string                                                   $label What it is.
	 * @param string                                                   $code  The code.
	 */
	private static function add( array &$found, string $label, string $code ): void {
		$key = md5( strtolower( trim( (string) preg_replace( '#\s+#', ' ', $code ) ) ) );

		if ( isset( $found[ $key ] ) ) {
			++$found[ $key ]['count'];
			return;
		}

		$found[ $key ] = array(
			'label' => $label,
			'code'  => $code,
			'count' => 1,
		);
	}

	/**
	 * Code shortened for a sentence, on one line.
	 *
	 * @param string $code Code.
	 */
	private static function clip( string $code ): string {
		$code = trim( (string) preg_replace( '#\s+#', ' ', $code ) );

		if ( function_exists( 'mb_strlen' ) && mb_strlen( $code ) > self::QUOTE ) {
			return mb_substr( $code, 0, self::QUOTE - 3 ) . '...';
		}

		if ( strlen( $code ) > self::QUOTE ) {
			return substr( $code, 0, self::QUOTE - 3 ) . '...';
		}

		return $code;
	}
}