<?php
/**
 * Redact and normalize component metadata for Finding evidence.
 *
 * @package Px320\SiteAudit
 */

declare(strict_types=1);

namespace Px320\SiteAudit\Checks\Components;

final class ComponentEvidenceSanitizer {
	private string $hash_key;

	public function __construct( string $hash_key ) {
		$this->hash_key = $hash_key;
	}

	public function reference( string $identifier ): string {
		return hash_hmac( 'sha256', str_replace( '\\', '/', strtolower( $identifier ) ), $this->hash_key );
	}

	public function text( string $value ): string {
		if ( 1 !== preg_match( '//u', $value ) ) {
			return '[invalid-text]';
		}

		// Unit-safe equivalent is followed by stricter control/credential redaction.
		// phpcs:ignore WordPress.WP.AlternativeFunctions.strip_tags_strip_tags
		$value = strip_tags( $value );
		$value = (string) preg_replace( '/[\x00-\x1F\x7F]+/u', ' ', $value );
		$value = (string) preg_replace( '/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/iu', '[redacted-email]', $value );
		$value = (string) preg_replace( '~\b(?:https?://|www\.)\S+~iu', '[redacted-url]', $value );
		$value = (string) preg_replace( '/\b[A-Za-z0-9_+\/-]{32,}={0,2}\b/u', '[redacted-value]', $value );
		$value = trim( (string) preg_replace( '/\s+/u', ' ', $value ) );

		if ( '' === $value ) {
			return '[unnamed-component]';
		}

		$short = preg_replace( '/\A(.{0,120}).*\z/us', '$1', $value );

		return is_string( $short ) && '' !== $short ? $short : '[unnamed-component]';
	}

	public function version( string $value ): string {
		$value = trim( $value );
		if ( 1 !== preg_match( '/^[0-9A-Za-z][0-9A-Za-z._+~-]{0,63}$/', $value ) ) {
			return 'unknown';
		}

		return $value;
	}
}