<?php
/**
 * Sanitization at native admin request boundaries.
 *
 * @package LoggedAI
 */

namespace LoggedAI;

defined( 'ABSPATH' ) || exit;

/** Keep input sanitation separate from each operation's authorization and typed validation. */
final class AdminInput {
	/**
	 * Read the HTTP method as an exact uppercase protocol token.
	 *
	 * @param string $default Method assumed only when the server supplied none.
	 * @return string The unchanged method, or an empty string for malformed input.
	 */
	public static function method( string $default = '' ): string {
		if ( ! isset( $_SERVER['REQUEST_METHOD'] ) ) {
			return $default;
		}
		if ( ! is_string( $_SERVER['REQUEST_METHOD'] ) ) {
			return '';
		}
		$method = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) );
		return preg_match( '/\A[A-Z]{1,16}\z/D', $method ) && hash_equals( $method, wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) ? $method : '';
	}

	/**
	 * Read an unslashed, sanitized query without repairing identifiers or cursors.
	 *
	 * @return array Sanitized values; individual screens still reject unknown fields.
	 */
	public static function query(): array {
		if ( ! self::nonce_shape() ) {
			self::invalid();
		}
		// Read-only selections do not authorize mutations; handlers check their own capabilities.
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Sanitize read-only selection data; no operation or database access occurs here.
		return self::sanitize( wp_unslash( $_GET ) );
	}

	/**
	 * Read a sanitized form, with explicit types for its exceptional text fields.
	 *
	 * @param array $types Top-level field names mapped to text, textarea, url or json.
	 * @return array Sanitized values; handlers retain their nonce and complete grammar checks.
	 */
	public static function form( array $types = array() ): array {
		if ( ! self::nonce_shape() ) {
			self::invalid();
		}
		// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Sanitation only; each submitting handler retains its action-specific nonce and capability checks before any operation.
		return self::sanitize( wp_unslash( $_POST ), $types );
	}

	/**
	 * Reject array-shaped native nonce input before WordPress casts it to text.
	 *
	 * WordPress checks the combined request, so inspect that same source even
	 * when the surrounding handler consumes only POST or GET fields. Absence
	 * remains a normal failed nonce; this shape check never authorizes a request.
	 *
	 * @param string $key Fixed nonce field used by the native verifier.
	 * @return bool Whether the supplied nonce can be checked without a type warning.
	 */
	public static function nonce_shape( string $key = '_wpnonce' ): bool {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Shape-only input validation; each caller still requires native nonce verification before its operation.
		return ! isset( $_REQUEST[ $key ] ) || is_string( $_REQUEST[ $key ] );
	}

	/**
	 * Sanitize bounded form fields without silently changing their meaning.
	 *
	 * JSON is a data format, not HTML: decode and re-encode it, then let the
	 * operation's existing typed compiler validate every field and supported value.
	 * This preserves legitimate rule literals instead of stripping their content.
	 *
	 * @param array $input Unslashed fields.
	 * @param array $types Explicit exceptional top-level field types.
	 * @return array Sanitized fields, preserving keys for unknown-field rejection.
	 */
	public static function sanitize( array $input, array $types = array() ): array {
		if ( count( $input ) > 100 ) {
			self::invalid();
		}
		$result = array();
		foreach ( $input as $key => $value ) {
			if ( ! is_string( $key ) || sanitize_key( $key ) !== $key ) {
				self::invalid();
			}
			$type = '_wp_http_referer' === $key ? 'url' : ( $types[ $key ] ?? 'text' );
			$result[ $key ] = self::value( $value, $type, 0 );
		}
		return $result;
	}

	/**
	 * Sanitize strings and bounded arrays; keep original scalar types for validation.
	 *
	 * @param mixed  $value Unslashed submitted value.
	 * @param string $type Declared field representation.
	 * @param int    $depth Current nested-array depth.
	 * @return mixed Sanitized value.
	 */
	private static function value( $value, string $type, int $depth ) {
		if ( is_array( $value ) ) {
			if ( $depth >= 5 || count( $value ) > 100 ) {
				self::invalid();
			}
			$result = array();
			foreach ( $value as $key => $item ) {
				if ( ! is_int( $key ) && ( ! is_string( $key ) || sanitize_key( $key ) !== $key ) ) {
					self::invalid();
				}
				$result[ $key ] = self::value( $item, $type, $depth + 1 );
			}
			return $result;
		}
		if ( ! is_string( $value ) || strlen( $value ) > 65536 ) {
			self::invalid();
		}
		if ( 'json' === $type ) {
			$decoded = json_decode( $value, true, 16 );
			if ( JSON_ERROR_NONE !== json_last_error() || ! is_array( $decoded ) ) {
				self::invalid();
			}
			$encoded = wp_json_encode( $decoded, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE );
			if ( ! is_string( $encoded ) ) {
				self::invalid();
			}
			return $encoded;
		}
		if ( 'textarea' === $type ) {
			// Browser textareas use CRLF. Preserve lines, allowing only their usual outer whitespace.
			$value = trim( str_replace( array( "\r\n", "\r" ), "\n", $value ) );
			$clean = sanitize_textarea_field( $value );
		} elseif ( 'url' === $type ) {
			$clean = sanitize_url( $value, array( 'http', 'https' ) );
		} else {
			$clean = sanitize_text_field( $value );
		}
		if ( $clean !== $value ) {
			self::invalid();
		}
		return $clean;
	}

	/** Reject invalid input before it can be mistaken for a different valid operation. */
	private static function invalid(): void {
		wp_die( esc_html__( 'The submitted fields contain invalid text. Reload the form and try again.', 'logged-ai' ), '', array( 'response' => 400 ) );
	}
}