<?php
/**
 * CFEP Security Helper Class
 * Provides sanitization, validation, and escaping functions
 * 
 * @package Checkout_Field_Editor_Pro
 * @since 2.0.0
 */

if (!defined('ABSPATH')) {
    exit;
}

class CFEP_Security {
    
    /**
     * Validate table name against whitelist
     * PREVENTS SQL INJECTION
     */
    public static function validate_table($table) {
        global $wpdb;
        
        $allowed_tables = array(
            $wpdb->prefix . 'cfep_fields',
            $wpdb->prefix . 'cfep_block_fields',
            $wpdb->prefix . 'cfep_templates'
        );
        
        return in_array($table, $allowed_tables);
    }
    
    /**
     * Get validated table name
     * Returns false if invalid
     */
    public static function get_validated_table($table_type) {
        global $wpdb;
        
        $tables = array(
            'classic' => $wpdb->prefix . 'cfep_fields',
            'block' => $wpdb->prefix . 'cfep_block_fields',
            'templates' => $wpdb->prefix . 'cfep_templates'
        );
        
        return isset($tables[$table_type]) ? $tables[$table_type] : false;
    }
    
    /**
     * Validate field type against whitelist
     * PREVENTS INJECTION OF INVALID FIELD TYPES
     */
    public static function validate_field_type($type) {
        $allowed_types = array(
            'text',
            'email',
            'tel',
            'number',
            'textarea',
            'select',
            'multiselect',
            'radio',
            'checkbox',
            'checkboxgroup',
            'date',
            'time',
            'datetime-local',  // FIXED: Changed from 'datetime' to 'datetime-local'
            'month',           // ADDED: Missing field type
            'week',            // ADDED: Missing field type
            'url',
            'password',
            'hidden',
            'heading',
            'paragraph'
        );
        
        return in_array($type, $allowed_types) ? $type : 'text';
    }
    
    /**
     * Validate section against whitelist
     * PREVENTS INJECTION OF INVALID SECTIONS
     */
    public static function validate_section($section) {
        $allowed_sections = array(
            'billing',
            'shipping',
            'order',
            'additional'
        );
        
        return in_array($section, $allowed_sections) ? $section : 'billing';
    }
    
    /**
     * Validate location (for Block Checkout)
     */
    public static function validate_location($location) {
        $allowed_locations = array(
            'contact',
            'address',
            'additional'
        );
        
        return in_array($location, $allowed_locations) ? $location : 'contact';
    }
    
    /**
     * Sanitize field data
     * PREVENTS XSS AND INJECTION
     */
    public static function sanitize_field_data($data, $is_existing = false) {
        $sanitized = array();
        
        // Field key - only sanitize for NEW fields (backward compatibility)
        if ($is_existing && isset($data['field_key'])) {
            // Keep existing field keys as-is for backward compatibility
            $sanitized['field_key'] = $data['field_key'];
        } elseif (isset($data['field_key'])) {
            // Sanitize new field keys
            $sanitized['field_key'] = sanitize_key($data['field_key']);
        }
        
        // Text fields
        if (isset($data['label'])) {
            $sanitized['label'] = sanitize_text_field($data['label']);
        }
        
        if (isset($data['placeholder'])) {
            $sanitized['placeholder'] = sanitize_text_field($data['placeholder']);
        }
        
        // Description - allow safe HTML
        if (isset($data['description'])) {
            $sanitized['description'] = wp_kses_post($data['description']);
        }
        
        // Field type - validate against whitelist
        if (isset($data['field_type'])) {
            $sanitized['field_type'] = self::validate_field_type($data['field_type']);
        }
        
        if (isset($data['type'])) {
            $sanitized['type'] = self::validate_field_type($data['type']);
        }
        
        // Section - validate against whitelist
        if (isset($data['section'])) {
            $sanitized['section'] = self::validate_section($data['section']);
        }
        
        // Location (Block Checkout)
        if (isset($data['location'])) {
            $sanitized['location'] = self::validate_location($data['location']);
        }
        
        // Field class
        if (isset($data['field_class'])) {
            $sanitized['field_class'] = sanitize_text_field($data['field_class']);
        }
        
        // Boolean/Integer fields
        if (isset($data['required'])) {
            $sanitized['required'] = absint($data['required']);
        }
        
        if (isset($data['enabled'])) {
            $sanitized['enabled'] = absint($data['enabled']);
        }
        
        if (isset($data['position'])) {
            $sanitized['position'] = absint($data['position']);
        }
        
        // Options (for select/radio fields)
        if (isset($data['options'])) {
            if (is_array($data['options'])) {
                $sanitized['options'] = array_map('sanitize_text_field', $data['options']);
            } else {
                $sanitized['options'] = $data['options']; // Already serialized
            }
        }
        
        // Conditional logic & validation rules
        if (isset($data['conditional_logic'])) {
            $sanitized['conditional_logic'] = $data['conditional_logic'];
        }
        
        if (isset($data['validation_rules'])) {
            $sanitized['validation_rules'] = $data['validation_rules'];
        }
        
        return $sanitized;
    }
    
    /**
     * Escape field label for output
     * PREVENTS XSS
     */
    public static function esc_field_label($label) {
        return esc_html($label);
    }
    
    /**
     * Escape field description for output
     * PREVENTS XSS but allows safe HTML
     */
    public static function esc_field_description($description) {
        return wp_kses_post($description);
    }
    
    /**
     * Escape field placeholder
     */
    public static function esc_field_placeholder($placeholder) {
        return esc_attr($placeholder);
    }
    
    /**
     * Check if user can manage fields
     */
    public static function can_manage_fields() {
        return current_user_can('manage_woocommerce') || current_user_can('manage_options');
    }
    
    /**
     * Check permission or die
     */
    public static function check_permission() {
        if (!self::can_manage_fields()) {
            wp_die(esc_html__('You do not have permission to access this page.', 'akz-checkout-fields-manager-for-woocommerce'));
        }
    }
    
    /**
     * Verify nonce
     */
    public static function verify_nonce($nonce, $action = 'cfep_action') {
        if (!wp_verify_nonce($nonce, $action)) {
            return false;
        }
        return true;
    }
}