<?php
/**
 * Links that carry a nonce.
 *
 * @package HostKhata
 */

namespace HostKhata\Support;

defined( 'ABSPATH' ) || exit;

/**
 * Builds a URL with a nonce that is safe to hand to JavaScript.
 *
 * `wp_nonce_url()` returns HTML (`&amp;` between the parameters), which is right
 * inside an `href` written by PHP but wrong in JSON: a browser that follows
 * `?action=x&amp;id=5` sends a parameter called `amp;id`, so the target page
 * never sees the id or the nonce ("The link you followed has expired").
 *
 * @since 0.1.0
 */
final class NonceUrl {

	/**
	 * A plain URL with the nonce for an action added.
	 *
	 * @since 0.1.0
	 *
	 * @param string               $base   Base URL, such as the admin-post address.
	 * @param array<string, mixed> $args   Query arguments.
	 * @param string               $action Nonce action.
	 * @return string URL with `&` between the parameters.
	 */
	public static function make( string $base, array $args, string $action ): string {
		$args['_wpnonce'] = wp_create_nonce( $action );

		return add_query_arg( $args, $base );
	}
}