<?php

namespace Vizyt\Support;

defined( 'ABSPATH' ) || exit;

/**
 * The wp_kses() allowlist for markup the plugin builds itself (admin UI
 * builders, notices, the manage-booking card): everything
 * wp_kses_allowed_html( 'post' ) allows, plus the form controls, inline SVG
 * icons and attributes our markup uses. Every element gets the global
 * attributes (class, id, style, hidden, role, tabindex, title, aria-*,
 * data-*), so data-* works on each of them.
 *
 * Use it at the point of output: echo wp_kses( UI::page_header( … ), Kses::allowed_html() );
 * tests/Integration/KsesTest.php checks that every builder survives it unchanged.
 */
class Kses {

    /** On every element. data-* is wp_kses()'s own wildcard; aria-* has none, so the ones we use are listed. */
    const GLOBAL_ATTRIBUTES = [
        'class', 'id', 'style', 'hidden', 'role', 'tabindex', 'title', 'lang', 'dir', 'data-*',
        'aria-label', 'aria-labelledby', 'aria-describedby', 'aria-details', 'aria-hidden', 'aria-current',
        'aria-expanded', 'aria-controls', 'aria-pressed', 'aria-selected', 'aria-checked', 'aria-disabled',
        'aria-haspopup', 'aria-invalid', 'aria-required', 'aria-readonly', 'aria-live', 'aria-atomic',
        'aria-busy', 'aria-relevant', 'aria-modal', 'aria-owns', 'aria-sort', 'aria-orientation',
        'aria-valuenow', 'aria-valuemin', 'aria-valuemax', 'aria-valuetext', 'aria-level', 'aria-posinset',
        'aria-setsize', 'aria-errormessage', 'aria-autocomplete', 'aria-multiselectable', 'aria-placeholder',
        'aria-roledescription', 'aria-keyshortcuts',
    ];

    /** SVG presentation and geometry attributes (lowercase: wp_kses() compares lowercased names, so viewBox matches "viewbox"). */
    const SVG_ATTRIBUTES = [
        'xmlns', 'xmlns:xlink', 'version', 'viewbox', 'preserveaspectratio', 'width', 'height', 'x', 'y',
        'x1', 'y1', 'x2', 'y2', 'cx', 'cy', 'r', 'rx', 'ry', 'd', 'points', 'transform', 'fill', 'fill-rule',
        'fill-opacity', 'clip-rule', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin',
        'stroke-dasharray', 'stroke-dashoffset', 'stroke-miterlimit', 'stroke-opacity', 'opacity',
        'focusable', 'href', 'xlink:href',
    ];

    /** Elements and attributes beyond (or merged into) the 'post' allowlist. */
    const ELEMENTS = [
        'a'        => [ 'href', 'target', 'rel', 'download', 'hreflang', 'type', 'name' ],
        'img'      => [ 'src', 'alt', 'width', 'height', 'loading', 'decoding', 'srcset', 'sizes' ],
        'form'     => [ 'action', 'method', 'enctype', 'name', 'target', 'novalidate', 'autocomplete', 'accept-charset' ],
        'input'    => [
            'type', 'name', 'value', 'checked', 'disabled', 'readonly', 'required', 'placeholder', 'min', 'max',
            'step', 'minlength', 'maxlength', 'size', 'pattern', 'autocomplete', 'inputmode', 'form', 'list',
            'multiple', 'accept', 'alt', 'src', 'spellcheck',
        ],
        'select'   => [ 'name', 'multiple', 'size', 'disabled', 'required', 'form', 'autocomplete' ],
        'option'   => [ 'value', 'selected', 'disabled', 'label' ],
        'optgroup' => [ 'label', 'disabled' ],
        'textarea' => [ 'name', 'rows', 'cols', 'placeholder', 'minlength', 'maxlength', 'disabled', 'readonly', 'required', 'form', 'autocomplete', 'wrap', 'spellcheck' ],
        'button'   => [ 'type', 'name', 'value', 'disabled', 'form', 'formaction', 'formmethod', 'formnovalidate', 'formtarget' ],
        'label'    => [ 'for', 'form' ],
        'fieldset' => [ 'disabled', 'form', 'name' ],
        'legend'   => [],
        'output'   => [ 'for', 'form', 'name' ],
        'details'  => [ 'open' ],
        'summary'  => [],
        'time'     => [ 'datetime' ],
        'noscript' => [],
        'td'       => [ 'colspan', 'rowspan', 'headers' ],
        'th'       => [ 'colspan', 'rowspan', 'headers', 'scope', 'abbr' ],
        'svg'      => self::SVG_ATTRIBUTES,
        'g'        => self::SVG_ATTRIBUTES,
        'path'     => self::SVG_ATTRIBUTES,
        'circle'   => self::SVG_ATTRIBUTES,
        'rect'     => self::SVG_ATTRIBUTES,
        'line'     => self::SVG_ATTRIBUTES,
        'polyline' => self::SVG_ATTRIBUTES,
        'polygon'  => self::SVG_ATTRIBUTES,
        'ellipse'  => self::SVG_ATTRIBUTES,
        'use'      => self::SVG_ATTRIBUTES,
        'title'    => [],
    ];

    /**
     * @return array<string, array<string, bool>>
     */
    public static function allowed_html(): array {
        $allowed = wp_kses_allowed_html( 'post' );

        foreach ( self::ELEMENTS as $tag => $attributes ) {
            $current         = isset( $allowed[ $tag ] ) && is_array( $allowed[ $tag ] ) ? $allowed[ $tag ] : [];
            $allowed[ $tag ] = array_merge( $current, array_fill_keys( $attributes, true ) );
        }

        // An element without an attributes array would lose data-* and aria-* (wp_kses() needs the array).
        $global = array_fill_keys( self::GLOBAL_ATTRIBUTES, true );
        foreach ( $allowed as $tag => $attributes ) {
            $allowed[ $tag ] = array_merge( is_array( $attributes ) ? $attributes : [], $global );
        }

        return $allowed;
    }
}