<?php

namespace SoftminalCache\Framework\Support;

if (!defined('ABSPATH')) {
    exit;
}

/**
 * Typed, null-safe sanitization helpers built on WordPress' sanitizers.
 *
 * Complements Http\Sanitizer\RequestSanitizer (which sanitizes whole requests):
 * this class is for ad-hoc, per-value cleaning and rule-driven array cleaning.
 *
 * PHP 7.4 compatible.
 */
class Sanitize
{
    /**
     * Sanitize a single value by named type. Unknown types fall back to text.
     *
     * @param mixed $value
     * @return mixed
     */
    public static function value($value, string $type = 'text')
    {
        if ($value === null) {
            return null;
        }

        switch ($type) {
            case 'text':
                return sanitize_text_field((string) $value);
            case 'textarea':
                return sanitize_textarea_field((string) $value);
            case 'email':
                return sanitize_email((string) $value);
            case 'url':
                return esc_url_raw((string) $value);
            case 'int':
            case 'integer':
                return (int) $value;
            case 'absint':
                return absint($value);
            case 'float':
            case 'number':
                return (float) $value;
            case 'bool':
            case 'boolean':
                return self::boolean($value);
            case 'key':
                return sanitize_key((string) $value);
            case 'slug':
            case 'title':
                return sanitize_title((string) $value);
            case 'filename':
                return sanitize_file_name((string) $value);
            case 'html':
            case 'post':
                return wp_kses_post((string) $value);
            case 'html_strip':
            case 'strip':
                return wp_strip_all_tags((string) $value);
            case 'hex_color':
                // sanitize_hex_color() is only loaded with the Customizer on
                // older WP; fall back to an equivalent check.
                if (function_exists('sanitize_hex_color')) {
                    return sanitize_hex_color((string) $value);
                }
                return preg_match('/^#([A-Fa-f0-9]{3}){1,2}$/', (string) $value) ? (string) $value : '';
            case 'json':
                return self::json($value);
            case 'raw':
                return $value;
            default:
                return sanitize_text_field((string) $value);
        }
    }

    public static function text($value): ?string
    {
        return $value === null ? null : sanitize_text_field((string) $value);
    }

    public static function email($value): string
    {
        return sanitize_email((string) $value);
    }

    public static function url($value): string
    {
        return esc_url_raw((string) $value);
    }

    public static function int($value): int
    {
        return (int) $value;
    }

    public static function absint($value): int
    {
        return absint($value);
    }

    public static function float($value): float
    {
        return (float) $value;
    }

    public static function key($value): string
    {
        return sanitize_key((string) $value);
    }

    public static function slug($value): string
    {
        return sanitize_title((string) $value);
    }

    public static function html($value): string
    {
        return wp_kses_post((string) $value);
    }

    public static function stripTags($value): string
    {
        return wp_strip_all_tags((string) $value);
    }

    /**
     * Coerce common truthy/falsey representations to a real bool.
     *
     * @param mixed $value
     */
    public static function boolean($value): bool
    {
        if (is_bool($value)) {
            return $value;
        }
        return in_array(
            is_string($value) ? strtolower(trim($value)) : $value,
            [true, 1, '1', 'true', 'yes', 'on'],
            true
        );
    }

    /**
     * Decode a JSON string (or pass through an array) to a sanitized array.
     *
     * @param mixed $value
     * @return array|null
     */
    public static function json($value): ?array
    {
        if (is_array($value)) {
            return self::deep($value);
        }
        if (!is_string($value) || $value === '') {
            return null;
        }
        $decoded = json_decode($value, true);
        if (json_last_error() !== JSON_ERROR_NONE || !is_array($decoded)) {
            return null;
        }
        return self::deep($decoded);
    }

    /**
     * Recursively sanitize every scalar in an array as text (keys as keys).
     *
     * @param array<mixed> $data
     * @return array<mixed>
     */
    public static function deep(array $data): array
    {
        $clean = [];
        foreach ($data as $key => $value) {
            $key = is_string($key) ? sanitize_text_field($key) : $key;
            if (is_array($value)) {
                $clean[$key] = self::deep($value);
            } elseif (is_scalar($value) || $value === null) {
                $clean[$key] = $value === null ? null : sanitize_text_field((string) $value);
            }
            // Objects/resources are dropped — never trust them from input.
        }
        return $clean;
    }

    /**
     * Sanitize an array against a map of field => type rules.
     * Fields absent from $rules default to text; fields in $rules but absent
     * from $data are skipped.
     *
     * @param array<string, mixed>  $data
     * @param array<string, string> $rules
     * @return array<string, mixed>
     */
    public static function fields(array $data, array $rules = []): array
    {
        $clean = [];
        foreach ($data as $key => $value) {
            $type = $rules[$key] ?? 'text';
            if (is_array($value)) {
                $clean[$key] = self::deep($value);
            } else {
                $clean[$key] = self::value($value, $type);
            }
        }
        return $clean;
    }
}