<?php
/**
 * Addifect REST Utilities - Sanitization Functions
 *
 * Contains helper functions for sanitizing data used in REST API endpoints.
 *
 * @package Addifect
 * @version 1.0.3
 */

defined( 'ABSPATH' ) || exit;

/**
 * Recursively sanitize Addifect block data.
 *
 * Design goals:
 * - Ensure data integrity while preventing Cross-Site Scripting (XSS).
 * - Preserve multiline content and complex DSL structures for the engine.
 * - Use context-specific sanitizers (wp_kses for HTML/DSL, wp_strip_all_tags for CSS).
 * - Maintain the hierarchical structure of the template data during processing.
 *
 * @param mixed $data The data array or object to be sanitized.
 * @return mixed The sanitized data.
 */
function addifect_recursive_sanitize_array( $data ) {
	if ( ! is_array( $data ) ) {
		return $data;
	}

	// 1. Setup allowed tags ONCE outside the loop for performance.
	$allowed_tags = wp_kses_allowed_html( 'post' );

	// Add accessibility and engine-specific attributes.
	foreach ( array( 'div', 'section', 'nav' ) as $tag ) {
		if ( isset( $allowed_tags[ $tag ] ) ) {
			$allowed_tags[ $tag ]['tabindex'] = true;
		}
	}

	if ( isset( $allowed_tags['a'] ) ) {
		$allowed_tags['a'] = array_merge(
			$allowed_tags['a'],
			array(
				'href'     => true,
				'target'   => true,
				'rel'      => true,
				'download' => true,
			)
		);
	}

	foreach ( $data as $key => $value ) {
		if ( is_array( $value ) ) {
			$data[ $key ] = addifect_recursive_sanitize_array( $value );
			continue;
		}

		if ( ! is_string( $value ) ) {
			continue;
		}

		/**
		 * We use specific sanitization logic based on the key type.
		 * 'html' use wp_kses to preserve safe HTML/DSL structure.
		 * 'css' and 'd' are stripped of tags to prevent script injection.
		 */
		switch ( $key ) {
			case 'html':
				$data[ $key ] = wp_kses( $value, $allowed_tags );
				break;
			case 'css':
				$data[ $key ] = wp_strip_all_tags( $value );
				break;

			case 'fontURL':
				$data[ $key ] = esc_url_raw( $value );
				break;

			default:
				$data[ $key ] = sanitize_text_field( $value );
				break;
		}
	}

	return $data;
}

/**
 * Custom sanitizer for Addifect Template IDs.
 * Allows alphanumeric, dashes, underscores, AND the @ symbol for system routes.
 *
 * @param string $param The parameter to sanitize.
 * @return string
 */
function addifect_sanitize_template_id( $param ) {
	// Strip everything EXCEPT a-z, A-Z, 0-9, -, _, and @.
	return preg_replace( '/[^a-zA-Z0-9_\-@]/', '', $param );
}