<?php
/**
 * Accessibility Statement: saved data, HTML builder and the [accessiq_statement] shortcode.
 *
 * @package AccessIQ
 */

defined( 'ABSPATH' ) || exit;

class AccessIQ_Statement {

	const OPTION = 'accessiq_statement_data';

	/**
	 * Register the shortcode.
	 */
	public static function init() {
		add_shortcode( 'accessiq_statement', array( __CLASS__, 'shortcode' ) );
	}

	/**
	 * Date of the latest scan (Y-m-d), or today.
	 *
	 * @return string
	 */
	public static function latest_audit_date() {
		$latest = get_posts(
			array(
				'post_type'      => ACCESSIQ_SCAN_CPT,
				'posts_per_page' => 1,
				'orderby'        => 'date',
				'order'          => 'DESC',
				'fields'         => 'ids',
				'no_found_rows'  => true,
			)
		);
		return ! empty( $latest ) ? get_the_date( 'Y-m-d', $latest[0] ) : gmdate( 'Y-m-d' );
	}

	/**
	 * Defaults used before anything has been saved.
	 *
	 * @return array
	 */
	public static function defaults() {
		$settings = AccessIQ_Settings::instance();
		return array(
			'site_name'      => get_bloginfo( 'name' ),
			'version'        => (string) $settings->get( 'scan_wcag_version', '2.2' ),
			'level'          => (string) $settings->get( 'scan_level', 'AA' ),
			'audit_date'     => self::latest_audit_date(),
			'email'          => (string) get_option( 'admin_email' ),
			'contact_method' => 'email',
			'limitations'    => '',
		);
	}

	/**
	 * Saved statement data merged over the defaults.
	 *
	 * @return array
	 */
	public static function get_saved() {
		$saved = get_option( self::OPTION, array() );
		return wp_parse_args( is_array( $saved ) ? $saved : array(), self::defaults() );
	}

	/**
	 * Whether the user has saved statement data before.
	 *
	 * @return bool
	 */
	public static function has_saved() {
		$saved = get_option( self::OPTION, array() );
		return is_array( $saved ) && ! empty( $saved );
	}

	/**
	 * Validate raw (already unslashed) input into a clean data array.
	 *
	 * @param array $raw Raw values (site_name, version, level, audit_date, email, contact_method, limitations).
	 * @return array
	 */
	public static function sanitize( array $raw ) {
		$def     = self::defaults();
		$version = isset( $raw['version'] ) ? sanitize_text_field( $raw['version'] ) : $def['version'];
		$level   = isset( $raw['level'] ) ? sanitize_text_field( $raw['level'] ) : $def['level'];
		$method  = isset( $raw['contact_method'] ) ? sanitize_key( $raw['contact_method'] ) : 'email';
		$date    = isset( $raw['audit_date'] ) ? sanitize_text_field( $raw['audit_date'] ) : '';
		$name    = isset( $raw['site_name'] ) ? sanitize_text_field( $raw['site_name'] ) : '';

		return array(
			'site_name'      => '' !== $name ? $name : $def['site_name'],
			'version'        => in_array( $version, array( '2.1', '2.2' ), true ) ? $version : '2.2',
			'level'          => in_array( $level, array( 'A', 'AA', 'AAA' ), true ) ? $level : 'AA',
			'audit_date'     => preg_match( '/^\d{4}-\d{2}-\d{2}$/', $date ) ? $date : gmdate( 'Y-m-d' ),
			'email'          => isset( $raw['email'] ) ? sanitize_email( $raw['email'] ) : '',
			'contact_method' => in_array( $method, array( 'email', 'form', 'phone' ), true ) ? $method : 'email',
			'limitations'    => isset( $raw['limitations'] ) ? sanitize_textarea_field( $raw['limitations'] ) : '',
		);
	}

	/**
	 * Persist statement data (so the shortcode and the form reuse it).
	 *
	 * @param array $data Output of sanitize().
	 */
	public static function save( array $data ) {
		update_option( self::OPTION, $data, false );
	}

	/**
	 * URL of the published statement page, or ''.
	 *
	 * @return string
	 */
	public static function page_url() {
		$id = (int) get_option( 'accessiq_statement_page_id', 0 );
		if ( $id && 'publish' === get_post_status( $id ) ) {
			return (string) get_permalink( $id );
		}
		return (string) get_option( 'accessiq_statement_url', '' );
	}

	/**
	 * Build the statement HTML from sanitised data (everything is escaped here).
	 *
	 * @param array $d Output of sanitize() / get_saved().
	 * @return string
	 */
	public static function build_html( array $d ) {
		$site    = esc_html( $d['site_name'] );
		$level   = esc_html( $d['level'] );
		$version = esc_html( $d['version'] );

		$reviewed = date_i18n( get_option( 'date_format' ), strtotime( $d['audit_date'] . ' 12:00:00' ) );

		$limits = array_filter( array_map( 'trim', preg_split( '/\R/', (string) $d['limitations'] ) ) );
		if ( $limits ) {
			$limit_html = '<ul>';
			foreach ( $limits as $line ) {
				$limit_html .= '<li>' . esc_html( $line ) . '</li>';
			}
			$limit_html .= '</ul>';
		} else {
			$limit_html = '<p>' . esc_html__( 'No known limitations at this time.', 'accessiq' ) . '</p>';
		}

		if ( 'email' === $d['contact_method'] && is_email( $d['email'] ) ) {
			$contact = sprintf(
				/* translators: %s: mailto link */
				esc_html__( 'Please contact us by email at %s.', 'accessiq' ),
				'<a href="mailto:' . esc_attr( antispambot( $d['email'] ) ) . '">' . esc_html( antispambot( $d['email'] ) ) . '</a>'
			);
		} elseif ( 'phone' === $d['contact_method'] ) {
			$contact = esc_html__( 'Please contact us by phone using the number on our contact page.', 'accessiq' );
		} else {
			$contact = esc_html__( 'Please contact us using the contact form on our website.', 'accessiq' );
		}

		$html  = '<p>' . esc_html__( 'We are committed to ensuring digital accessibility for people with disabilities. We continually improve the user experience for everyone and apply relevant accessibility standards.', 'accessiq' ) . '</p>';
		$html .= '<h2>' . esc_html__( 'Conformance Status', 'accessiq' ) . '</h2>';
		/* translators: 1: site name, 2: WCAG version (2.1 or 2.2), 3: WCAG level */
		$html .= '<p>' . sprintf( esc_html__( '%1$s aims to conform to the Web Content Accessibility Guidelines (WCAG) %2$s Level %3$s. These guidelines explain how to make web content more accessible to people with disabilities.', 'accessiq' ), $site, $version, $level ) . '</p>';
		$html .= '<h2>' . esc_html__( 'Technical Specifications', 'accessiq' ) . '</h2>';
		/* translators: %s: site name */
		$html .= '<p>' . sprintf( esc_html__( 'Accessibility of %s relies on the following technologies: HTML, CSS, JavaScript.', 'accessiq' ), $site ) . '</p>';
		$html .= '<h2>' . esc_html__( 'Last Reviewed', 'accessiq' ) . '</h2>';
		/* translators: %s: date */
		$html .= '<p>' . sprintf( esc_html__( 'This statement was last reviewed on %s.', 'accessiq' ), esc_html( $reviewed ) ) . '</p>';
		$html .= '<h2>' . esc_html__( 'Known Limitations', 'accessiq' ) . '</h2>';
		$html .= '<p>' . esc_html__( 'Despite our best efforts, some areas may not be fully accessible:', 'accessiq' ) . '</p>' . $limit_html;
		$html .= '<h2>' . esc_html__( 'Feedback', 'accessiq' ) . '</h2>';
		/* translators: %s: site name */
		$html .= '<p>' . sprintf( esc_html__( 'We welcome your feedback on the accessibility of %s.', 'accessiq' ), $site ) . ' ' . $contact . '</p>';
		$html .= '<h2>' . esc_html__( 'Enforcement', 'accessiq' ) . '</h2>';
		$html .= '<p>' . esc_html__( 'If you are not satisfied with our response, please contact your local or national accessibility enforcement authority.', 'accessiq' ) . '</p>';

		return wp_kses_post( $html );
	}

	/**
	 * [accessiq_statement] — outputs the saved statement.
	 * [accessiq_statement link="1"] — outputs only a link to the published statement page.
	 *
	 * @param array|string $atts Shortcode attributes.
	 * @return string
	 */
	public static function shortcode( $atts ) {
		$atts = shortcode_atts(
			array(
				'link' => '',
				'text' => '',
			),
			$atts,
			'accessiq_statement'
		);

		if ( '' !== $atts['link'] && 'false' !== $atts['link'] && '0' !== $atts['link'] ) {
			$url = self::page_url();
			if ( '' === $url ) {
				return '';
			}
			$text = '' !== $atts['text'] ? $atts['text'] : __( 'Accessibility Statement', 'accessiq' );
			return '<a class="accessiq-statement-link" href="' . esc_url( $url ) . '">' . esc_html( $text ) . '</a>';
		}

		return '<div class="accessiq-statement">' . self::build_html( self::get_saved() ) . '</div>';
	}
}