<?php
/**
 * Sanitizer.
 *
 * @package HostKhata
 */

namespace HostKhata\Security;

defined( 'ABSPATH' ) || exit;

/**
 * Central place for cleaning input before it is validated or stored.
 *
 * Callers pass values that were already unslashed (`wp_unslash()`); REST
 * request data is unslashed by core.
 *
 * @since 0.1.0
 */
final class Sanitizer {

	/**
	 * Single line text.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function text( $value ): string {
		return sanitize_text_field( self::to_string( $value ) );
	}

	/**
	 * Multi line text without markup.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function textarea( $value ): string {
		return sanitize_textarea_field( self::to_string( $value ) );
	}

	/**
	 * Email address, or an empty string when invalid.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function email( $value ): string {
		return sanitize_email( self::to_string( $value ) );
	}

	/**
	 * URL safe for storage, or an empty string.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function url( $value ): string {
		return esc_url_raw( self::to_string( $value ) );
	}

	/**
	 * Lower case key made of letters, numbers, underscores and hyphens.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function key( $value ): string {
		return sanitize_key( self::to_string( $value ) );
	}

	/**
	 * Non-negative integer.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return int
	 */
	public static function absint( $value ): int {
		return abs( (int) $value );
	}

	/**
	 * Boolean from common truthy strings ("1", "true", "on", "yes").
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return bool
	 */
	public static function boolean( $value ): bool {
		return filter_var( $value, FILTER_VALIDATE_BOOLEAN );
	}

	/**
	 * Returns the value when it is in the allowed list, otherwise the default.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed    $value   Raw value.
	 * @param string[] $allowed Allowed values.
	 * @param string   $fallback Fallback.
	 * @return string
	 */
	public static function enum( $value, array $allowed, string $fallback = '' ): string {
		$value = is_scalar( $value ) ? (string) $value : '';

		return in_array( $value, $allowed, true ) ? $value : $fallback;
	}

	/**
	 * Reads a choice from input and tells apart "not sent" from "sent but invalid".
	 *
	 * Returns the default when the key is missing or empty, the value when it is
	 * allowed, and null when something else was sent, so callers can report an
	 * error instead of silently using the default.
	 *
	 * @since 0.1.0
	 *
	 * @param array<string, mixed> $raw     Input.
	 * @param string               $key     Key to read.
	 * @param string[]             $allowed Allowed values.
	 * @param string|null          $fallback Value to use when nothing was sent; null when the field is required.
	 * @return string|null
	 */
	public static function pick( array $raw, string $key, array $allowed, ?string $fallback ): ?string {
		$value = $raw[ $key ] ?? null;

		if ( null === $value || '' === $value ) {
			return $fallback;
		}

		$value = is_scalar( $value ) ? (string) $value : '';

		return in_array( $value, $allowed, true ) ? $value : null;
	}

	/**
	 * A valid Y-m-d date, or an empty string.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function date( $value ): string {
		$value = is_string( $value ) ? trim( $value ) : '';

		return \HostKhata\Support\Date::is_valid_date( $value ) ? $value : '';
	}

	/**
	 * Hex colour such as #4f46e5, or an empty string.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function hex_color( $value ): string {
		$value = is_string( $value ) ? trim( $value ) : '';

		return 1 === preg_match( '/^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i', $value ) ? strtolower( $value ) : '';
	}

	/**
	 * Lower case domain name without scheme, path or trailing dot, or an empty string when invalid.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function domain_name( $value ): string {
		$value = strtolower( trim( self::to_string( $value ) ) );
		$value = (string) preg_replace( '#^[a-z][a-z0-9+.-]*://#', '', $value );
		$value = explode( '/', $value )[0];
		$value = rtrim( $value, '.' );

		return Validator::is_domain( $value ) ? $value : '';
	}

	/**
	 * A plain non-negative decimal such as "12.50", or an empty string.
	 *
	 * @since 0.1.0
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	public static function decimal( $value ): string {
		$value = trim( self::to_string( $value ) );

		return 1 === preg_match( '/^\d+(?:\.\d{1,4})?$/', $value ) ? $value : '';
	}

	/**
	 * Casts scalars to string and anything else to an empty string.
	 *
	 * @param mixed $value Raw value.
	 * @return string
	 */
	private static function to_string( $value ): string {
		return is_scalar( $value ) ? (string) $value : '';
	}
}