<?php

// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedNamespaceFound -- APD is the established namespace shared with the Pro add-on and retained for backward compatibility.
namespace APD\Support;

defined('ABSPATH') || exit;

/**
 * Centralized access to WordPress request globals.
 *
 * Values are unslashed here and must still be authorized and normalized by the
 * controller that consumes them. File arrays intentionally remain untouched so
 * WordPress upload handlers receive the original temporary path and metadata.
 */
final class RequestData
{
    public static function query() : array
    {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reading the request does not perform an action; callers sanitize each value and verify a nonce before mutations.
        return is_array($_GET) ? wp_unslash($_GET) : [];
    }

    public static function post() : array
    {
        // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Retrieval is not authorization; mutating handlers verify their nonce and normalize each value.
        return is_array($_POST) ? wp_unslash($_POST) : [];
    }

    public static function request() : array
    {
        // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Retrieval is not authorization; mutating handlers verify their nonce and normalize each value.
        return is_array($_REQUEST) ? wp_unslash($_REQUEST) : [];
    }

    public static function files() : array
    {
        // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Upload handlers validate capability, nonce, MIME, size and file contents before storage.
        return is_array($_FILES) ? $_FILES : [];
    }

    public static function server() : array
    {
        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Server values are unslashed here and validated by the narrow caller that consumes them.
        return is_array($_SERVER) ? wp_unslash($_SERVER) : [];
    }
}
