<?php
/**
 * SVG Upload Support
 *
 * Enables SVG file uploads with proper sanitization and security.
 *
 * @since      1.0.0
 * @package    Acumenpopup
 * @subpackage Acumenpopup/includes/Core
 */

namespace Acumenpopup\Core;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Class SVG_Support
 *
 * Manages SVG upload support for the plugin (Singleton).
 *
 * @since   1.0.0
 * @package Acumenpopup
 */
class SVG_Support {

	/**
	 * The single instance of the class.
	 *
	 * @since  1.0.0
	 * @access private
	 * @var    SVG_Support|null
	 */
	private static $instance = null;

	/**
	 * Private constructor to prevent direct instantiation.
	 *
	 * @since  1.0.0
	 * @access private
	 */
	private function __construct() {
		$this->init_hooks();
	}

	/**
	 * Get the single instance of the SVG_Support class.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @return SVG_Support The single instance.
	 */
	public static function get_instance() {
		if ( is_null( self::$instance ) ) {
			self::$instance = new self();
		}

		return self::$instance;
	}

	/**
	 * Initialize WordPress hooks.
	 *
	 * @since  1.0.0
	 * @access private
	 *
	 * @return void
	 */
	private function init_hooks() {
		add_filter( 'wp_check_filetype_and_ext', array( $this, 'check_svg_filetype' ), 10, 4 );
		add_filter( 'upload_mimes', array( $this, 'add_svg_mime_type' ) );
		add_filter( 'user_has_cap', array( $this, 'grant_svg_upload_capability' ), 10, 3 );
		add_action( 'admin_enqueue_scripts', array( $this, 'add_svg_admin_styles' ) );
	}

	/**
	 * Check and validate SVG file type during upload.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @param array  $data     File data containing ext and type.
	 * @param string $file     Full path to the file.
	 * @param string $filename The name of the file.
	 * @param array  $mimes    Array of allowed mime types.
	 *
	 * @return array Modified file data.
	 */
	public function check_svg_filetype( $data, $file, $filename, $mimes ) {
		// Check if user has capability to upload SVG.
		if ( ! current_user_can( 'upload_svg' ) ) {
			return $data;
		}

		// Check file extension.
		$filetype = wp_check_filetype( $filename, $mimes );

		if ( 'svg' !== $filetype['ext'] ) {
			return $data;
		}

		// Validate SVG content.
		if ( ! $this->validate_svg_file( $file ) ) {
			$data['error'] = esc_html__( 'SVG file contains potentially unsafe content.', 'acumen-popup' );
			return $data;
		}

		// Set correct file type.
		$data['ext']  = 'svg';
		$data['type'] = 'image/svg+xml';

		return $data;
	}

	/**
	 * Validate SVG file content for security.
	 *
	 * @since  1.0.0
	 * @access private
	 *
	 * @param string $file Path to the SVG file.
	 *
	 * @return bool True if valid, false otherwise.
	 */
	private function validate_svg_file( $file ) {
		// Initialize filesystem.
		global $wp_filesystem;

		if ( empty( $wp_filesystem ) ) {
			require_once ABSPATH . '/wp-admin/includes/file.php';
			WP_Filesystem();
		}

		if ( ! $wp_filesystem || ! file_exists( $file ) ) {
			return false;
		}

		$content = $wp_filesystem->get_contents( $file );

		if ( empty( $content ) ) {
			return false;
		}

		// Check for potentially dangerous content.
		$dangerous_patterns = array(
			'/<script/i',
			'/javascript:/i',
			'/onclick/i',
			'/onload/i',
			'/onerror/i',
			'/onmouseover/i',
			'/onfocus/i',
			'/onblur/i',
			'/<foreignObject/i',
			'/data:/i',
		);

		foreach ( $dangerous_patterns as $pattern ) {
			if ( preg_match( $pattern, $content ) ) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Add SVG mime type to allowed uploads.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @param array $mimes Array of allowed mime types.
	 *
	 * @return array Modified array with SVG added.
	 */
	public function add_svg_mime_type( $mimes ) {
		$mimes['svg'] = 'image/svg+xml';
		return $mimes;
	}

	/**
	 * Grant SVG upload capability to users who can upload files.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @param array $allcaps All capabilities for the user.
	 * @param array $cap     Required capability.
	 * @param array $args    Additional arguments.
	 *
	 * @return array Modified capabilities array.
	 */
	public function grant_svg_upload_capability( $allcaps, $cap, $args ) {
		if ( empty( $args[0] ) ) {
			return $allcaps;
		}

		// Grant upload_svg capability if user can upload files.
		if (
			'upload_files' === $args[0] &&
			isset( $allcaps['upload_files'] ) &&
			$allcaps['upload_files'] &&
			! isset( $allcaps['upload_svg'] )
		) {
			$allcaps['upload_svg'] = true;
		}

		return $allcaps;
	}

	/**
	 * Add CSS styles for SVG display in media library.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @return void
	 */
	public function add_svg_admin_styles() {
		$css = '
			.media-modal-content ul.attachments li.attachment img[src$=".svg"],
			.media-frame ul.attachments li.attachment img[src$=".svg"],
			table.media img[src$=".svg"] {
				width: 100% !important;
				height: auto !important;
			}
		';
		
		wp_register_style( 'acumen-popup-svg-admin', false, array(), ACUMENPOPUP_VERSION, 'all' );
		wp_enqueue_style( 'acumen-popup-svg-admin', false, array(), ACUMENPOPUP_VERSION, 'all' );
		wp_add_inline_style( 'acumen-popup-svg-admin', preg_replace('/[ \t]+/', ' ', $css) );
	}

	/**
	 * Sanitize SVG content.
	 *
	 * Removes potentially dangerous elements and attributes.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @param string $content SVG content to sanitize.
	 *
	 * @return string Sanitized SVG content.
	 */
	public function sanitize_svg_content( $content ) {
		if ( empty( $content ) ) {
			return '';
		}

		// Remove XML processing instructions.
		$content = preg_replace( '/<\?xml.*?\?>/i', '', $content );

		// Remove script tags.
		$content = preg_replace( '/<script[^>]*>.*?<\/script>/is', '', $content );

		// Remove event handlers.
		$content = preg_replace( '/\s+on\w+\s*=\s*["\'][^"\']*["\']/i', '', $content );

		// Remove javascript: URLs.
		$content = preg_replace( '/javascript\s*:/i', '', $content );

		return $content;
	}

	/**
	 * Prevent cloning of the instance.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @return void
	 */
	public function __clone() {
		_doing_it_wrong(
			__FUNCTION__,
			esc_html__( 'Cloning is forbidden.', 'acumen-popup' ),
			'1.0.0'
		);
	}

	/**
	 * Prevent unserializing of the instance.
	 *
	 * @since  1.0.0
	 * @access public
	 *
	 * @return void
	 */
	public function __wakeup() {
		_doing_it_wrong(
			__FUNCTION__,
			esc_html__( 'Unserializing is forbidden.', 'acumen-popup' ),
			'1.0.0'
		);
	}
}