<?php
/**
 * Shared allowlist for builder-rendered HTML emitted into <main> and into
 * header/footer templates, on both the canvas template (page.php) and the
 * standalone clone template (page-standalone.php).
 *
 * The save-time gate (`sanitize_builder_html_value()`) already runs
 * `wp_kses_post()` for users without `unfiltered_html`; this is a
 * defense-in-depth pass at render time and exists so the static analyzer
 * sees a visible sanitization gate at output.
 *
 * Built on `wp_kses_allowed_html( 'post' )` and extended with SVG, iframe,
 * and form-control tags that builder layouts routinely use. Site owners can
 * extend further via the `ambld_rendered_html_allowed_tags` filter.
 *
 * @package Antimanual_Builder
 * @return array Tag/attribute map in the shape expected by wp_kses().
 */

if ( ! defined( 'ABSPATH' ) ) {
\texit;
}

	$tags = wp_kses_allowed_html( 'post' );

	$svg_global = array(
		'class'               => true,
		'id'                  => true,
		'style'               => true,
		'fill'                => true,
		'stroke'              => true,
		'stroke-width'        => true,
		'stroke-linecap'      => true,
		'stroke-linejoin'     => true,
		'opacity'             => true,
		'transform'           => true,
		'aria-hidden'         => true,
		'aria-label'          => true,
		'role'                => true,
	);

	$svg_tags = array(
		'svg'      => array_merge( $svg_global, array(
			'xmlns'               => true,
			'xmlns:xlink'         => true,
			'viewbox'             => true,
			'width'               => true,
			'height'              => true,
			'preserveaspectratio' => true,
			'focusable'           => true,
		) ),
		'g'        => array_merge( $svg_global, array( 'clip-path' => true, 'mask' => true ) ),
		'path'     => array_merge( $svg_global, array( 'd' => true, 'fill-rule' => true, 'clip-rule' => true ) ),
		'circle'   => array_merge( $svg_global, array( 'cx' => true, 'cy' => true, 'r' => true ) ),
		'rect'     => array_merge( $svg_global, array( 'x' => true, 'y' => true, 'width' => true, 'height' => true, 'rx' => true, 'ry' => true ) ),
		'line'     => array_merge( $svg_global, array( 'x1' => true, 'y1' => true, 'x2' => true, 'y2' => true ) ),
		'polyline' => array_merge( $svg_global, array( 'points' => true ) ),
		'polygon'  => array_merge( $svg_global, array( 'points' => true, 'fill-rule' => true ) ),
		'ellipse'  => array_merge( $svg_global, array( 'cx' => true, 'cy' => true, 'rx' => true, 'ry' => true ) ),
		'text'     => array_merge( $svg_global, array( 'x' => true, 'y' => true, 'dx' => true, 'dy' => true, 'text-anchor' => true, 'font-size' => true, 'font-family' => true ) ),
		'tspan'    => $svg_global,
		'defs'     => $svg_global,
		'use'      => array_merge( $svg_global, array( 'href' => true, 'xlink:href' => true, 'x' => true, 'y' => true, 'width' => true, 'height' => true ) ),
		'symbol'   => array_merge( $svg_global, array( 'viewbox' => true ) ),
		'clippath' => $svg_global,
		'mask'     => array_merge( $svg_global, array( 'maskunits' => true ) ),
		'lineargradient' => array_merge( $svg_global, array( 'x1' => true, 'y1' => true, 'x2' => true, 'y2' => true, 'gradientunits' => true, 'gradienttransform' => true ) ),
		'radialgradient' => array_merge( $svg_global, array( 'cx' => true, 'cy' => true, 'r' => true, 'fx' => true, 'fy' => true, 'gradientunits' => true ) ),
		'stop'     => array_merge( $svg_global, array( 'offset' => true, 'stop-color' => true, 'stop-opacity' => true ) ),
		'title'    => array(),
		'desc'     => array(),
	);

	// Note: `srcdoc` is deliberately absent — kses cannot sanitize the
	// document inside it, so it would be an arbitrary-HTML/JS surface.
	$iframe_tag = array(
		'iframe' => array(
			'src'             => true,
			'width'           => true,
			'height'          => true,
			'name'            => true,
			'title'           => true,
			'class'           => true,
			'id'              => true,
			'style'           => true,
			'frameborder'     => true,
			'allow'           => true,
			'allowfullscreen' => true,
			'loading'         => true,
			'referrerpolicy'  => true,
			'sandbox'         => true,
		),
	);

	$form_tags = array(
		'form'     => array(
			'action'         => true,
			'method'         => true,
			'enctype'        => true,
			'accept-charset' => true,
			'autocomplete'   => true,
			'name'           => true,
			'novalidate'     => true,
			'target'         => true,
			'class'          => true,
			'id'             => true,
			'style'          => true,
			'role'           => true,
		),
		'input'    => array(
			'type'         => true,
			'name'         => true,
			'value'        => true,
			'placeholder'  => true,
			'required'     => true,
			'readonly'     => true,
			'disabled'     => true,
			'checked'      => true,
			'min'          => true,
			'max'          => true,
			'step'         => true,
			'minlength'    => true,
			'maxlength'    => true,
			'pattern'      => true,
			'autocomplete' => true,
			'autofocus'    => true,
			'multiple'     => true,
			'accept'       => true,
			'list'         => true,
			'size'         => true,
			'class'        => true,
			'id'           => true,
			'style'        => true,
			'aria-label'   => true,
			'aria-describedby' => true,
		),
		'textarea' => array(
			'name'        => true,
			'rows'        => true,
			'cols'        => true,
			'placeholder' => true,
			'required'    => true,
			'readonly'    => true,
			'disabled'    => true,
			'minlength'   => true,
			'maxlength'   => true,
			'wrap'        => true,
			'autocomplete' => true,
			'class'       => true,
			'id'          => true,
			'style'       => true,
			'aria-label'  => true,
		),
		'select'   => array(
			'name'        => true,
			'multiple'    => true,
			'size'        => true,
			'required'    => true,
			'disabled'    => true,
			'autocomplete' => true,
			'class'       => true,
			'id'          => true,
			'style'       => true,
			'aria-label'  => true,
		),
		'option'   => array(
			'value'    => true,
			'selected' => true,
			'disabled' => true,
			'label'    => true,
			'class'    => true,
			'id'       => true,
			'style'    => true,
		),
		'optgroup' => array(
			'label'    => true,
			'disabled' => true,
			'class'    => true,
			'id'       => true,
			'style'    => true,
		),
		'label'    => array(
			'for'   => true,
			'class' => true,
			'id'    => true,
			'style' => true,
		),
		'fieldset' => array(
			'name'     => true,
			'disabled' => true,
			'form'     => true,
			'class'    => true,
			'id'       => true,
			'style'    => true,
		),
		'legend'   => array(
			'class' => true,
			'id'    => true,
			'style' => true,
		),
		'datalist' => array(
			'id'    => true,
			'class' => true,
		),
		'output'   => array(
			'for'   => true,
			'name'  => true,
			'form'  => true,
			'class' => true,
			'id'    => true,
			'style' => true,
		),
		'progress' => array(
			'value' => true,
			'max'   => true,
			'class' => true,
			'id'    => true,
			'style' => true,
		),
		'meter'    => array(
			'value' => true,
			'min'   => true,
			'max'   => true,
			'low'   => true,
			'high'  => true,
			'optimum' => true,
			'class' => true,
			'id'    => true,
			'style' => true,
		),
	);

	$html5_extra_tags = array(
		'link'     => array(
			'rel'         => true,
			'href'        => true,
			'type'        => true,
			'media'       => true,
			'sizes'       => true,
			'as'          => true,
			'crossorigin' => true,
			'integrity'   => true,
			'hreflang'    => true,
			'class'       => true,
			'id'          => true,
		),
		'dialog'   => array( 'open' => true, 'class' => true, 'id' => true, 'style' => true, 'role' => true, 'aria-label' => true, 'aria-describedby' => true, 'aria-hidden' => true, 'tabindex' => true ),
		'picture'  => array( 'class' => true, 'id' => true, 'style' => true ),
		'canvas'   => array( 'width' => true, 'height' => true, 'class' => true, 'id' => true, 'style' => true, 'role' => true, 'aria-label' => true ),
		'template' => array( 'class' => true, 'id' => true ),
		'slot'     => array( 'name' => true, 'class' => true, 'id' => true ),
		'data'     => array( 'value' => true, 'class' => true, 'id' => true, 'style' => true ),
		'bdi'      => array( 'class' => true, 'id' => true, 'style' => true, 'dir' => true ),
		'wbr'      => array(),
		'ruby'     => array( 'class' => true, 'id' => true, 'style' => true ),
		'rt'       => array( 'class' => true, 'id' => true, 'style' => true ),
		'rp'       => array( 'class' => true, 'id' => true, 'style' => true ),
		'menu'     => array( 'type' => true, 'class' => true, 'id' => true, 'style' => true, 'role' => true ),
		'noscript' => array( 'class' => true, 'id' => true ),
	);

	$tags = array_merge( $tags, $svg_tags, $iframe_tag, $form_tags, $html5_extra_tags );

	/**
	 * Filter the allowlist applied to builder-rendered HTML at output time.
	 *
	 * @param array $tags Tag/attribute map in the shape expected by wp_kses().
	 */
	return apply_filters( 'ambld_rendered_html_allowed_tags', $tags );
