<?php
namespace Strikewise\Admin;

defined( 'ABSPATH' ) || exit;

/**
 * Allowlist for wp_kses() when admin markup is echoed: text, links, tables, the
 * form fields of the product box and the SVG of the price chart and the icons.
 * Everything else, including event handler attributes and scripts, is removed.
 */
final class Html {

	/** @var array<string, array<string, bool>>|null */
	private static $allowed = null;

	/**
	 * @return array<string, array<string, bool>>
	 */
	public static function allowed(): array {
		if ( null !== self::$allowed ) {
			return self::$allowed;
		}

		$common = array(
			'class'       => true,
			'id'          => true,
			'title'       => true,
			'role'        => true,
			'style'       => true,
			'aria-hidden' => true,
			'aria-label'  => true,
			'data-*'      => true,
		);
		$tags   = array(
			'div'      => array(),
			'span'     => array(),
			'p'        => array(),
			'strong'   => array(),
			'b'        => array(),
			'em'       => array(),
			'i'        => array(),
			'br'       => array(),
			'del'      => array(),
			'ins'      => array(),
			'small'    => array(),
			'code'     => array(),
			'h2'       => array(),
			'h3'       => array(),
			'h4'       => array(),
			'ul'       => array(),
			'ol'       => array(),
			'li'       => array(),
			'hr'       => array(),
			'details'  => array( 'open' => true ),
			'summary'  => array(),
			'time'     => array( 'datetime' => true ),
			'table'    => array(),
			'thead'    => array(),
			'tbody'    => array(),
			'tr'       => array(),
			'th'       => array(
				'scope'   => true,
				'colspan' => true,
			),
			'td'       => array( 'colspan' => true ),
			'a'        => array(
				'href'   => true,
				'target' => true,
				'rel'    => true,
			),
			'img'      => array(
				'src'    => true,
				'alt'    => true,
				'width'  => true,
				'height' => true,
			),
			'label'    => array( 'for' => true ),
			'input'    => array(
				'type'        => true,
				'name'        => true,
				'value'       => true,
				'step'        => true,
				'min'         => true,
				'max'         => true,
				'size'        => true,
				'placeholder' => true,
				'inputmode'   => true,
				'checked'     => true,
				'disabled'    => true,
				'readonly'    => true,
			),
			'button'   => array(
				'type'     => true,
				'name'     => true,
				'value'    => true,
				'disabled' => true,
			),
			'svg'      => array(
				'viewbox'         => true,
				'xmlns'           => true,
				'width'           => true,
				'height'          => true,
				'fill'            => true,
				'stroke'          => true,
				'stroke-width'    => true,
				'stroke-linecap'  => true,
				'stroke-linejoin' => true,
				'focusable'       => true,
			),
			'g'        => array( 'transform' => true ),
			'title'    => array(),
			'path'     => array(
				'd'                => true,
				'fill'             => true,
				'stroke'           => true,
				'stroke-dasharray' => true,
			),
			'circle'   => array(
				'cx' => true,
				'cy' => true,
				'r'  => true,
			),
			'line'     => array(
				'x1'               => true,
				'y1'               => true,
				'x2'               => true,
				'y2'               => true,
				'stroke-dasharray' => true,
			),
			'rect'     => array(
				'x'      => true,
				'y'      => true,
				'width'  => true,
				'height' => true,
				'rx'     => true,
			),
			'polyline' => array( 'points' => true ),
			'text'     => array(
				'x'           => true,
				'y'           => true,
				'text-anchor' => true,
			),
		);

		self::$allowed = array();
		foreach ( $tags as $tag => $attributes ) {
			self::$allowed[ $tag ] = array_merge( $common, $attributes );
		}
		return self::$allowed;
	}
}