<?php
/**
 * FormShield Sanitizer Helper Functions
 *
 * @package FormShield
 * @since 1.0.3-beta
 */

// Prevent direct access
if (!defined('ABSPATH')) {
    die('You are not allowed to call this page directly.');
}

/**
 * Get sanitized POST string value
 *
 * @param string $key     The POST key
 * @param string $default Default value if key doesn't exist
 * @return string Sanitized string value
 */
function formshield_get_post_string( $key, $default = '' ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_POST[ $key ] ) ? sanitize_text_field( wp_unslash( $_POST[ $key ] ) ) : $default;
}

/**
 * Get sanitized POST integer value
 *
 * @param string $key     The POST key
 * @param int    $default Default value if key doesn't exist
 * @return int Sanitized integer value
 */
function formshield_get_post_int( $key, $default = 0 ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_POST[ $key ] ) ? absint( wp_unslash( $_POST[ $key ] ) ) : $default;
}

/**
 * Get sanitized POST float value with bounds
 *
 * @param string $key     The POST key
 * @param float  $min     Minimum allowed value
 * @param float  $max     Maximum allowed value
 * @param float  $default Default value if key doesn't exist
 * @return float Sanitized float value within bounds
 */
function formshield_get_post_float( $key, $min = 0.0, $max = 1.0, $default = 0.0 ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
    $v = isset( $_POST[ $key ] ) ? floatval( wp_unslash( $_POST[ $key ] ) ) : $default;
    return max( $min, min( $max, $v ) );
}

/**
 * Get sanitized POST email value
 *
 * @param string $key     The POST key
 * @param string $default Default value if key doesn't exist
 * @return string Sanitized email value
 */
function formshield_get_post_email( $key, $default = '' ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_POST[ $key ] ) ? sanitize_email( wp_unslash( $_POST[ $key ] ) ) : $default;
}

/**
 * Get sanitized POST boolean value
 *
 * @param string $key     The POST key
 * @param bool   $default Default value if key doesn't exist
 * @return bool Sanitized boolean value
 */
function formshield_get_post_bool( $key, $default = false ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_POST[ $key ] ) ? (bool) absint( wp_unslash( $_POST[ $key ] ) ) : $default;
}

/**
 * Get sanitized GET string value
 *
 * @param string $key     The GET key
 * @param string $default Default value if key doesn't exist
 * @return string Sanitized string value
 */
function formshield_get_get_string( $key, $default = '' ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_GET[ $key ] ) ? sanitize_text_field( wp_unslash( $_GET[ $key ] ) ) : $default;
}

/**
 * Get sanitized GET integer value
 *
 * @param string $key     The GET key
 * @param int    $default Default value if key doesn't exist
 * @return int Sanitized integer value
 */
function formshield_get_get_int( $key, $default = 0 ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_GET[ $key ] ) ? absint( wp_unslash( $_GET[ $key ] ) ) : $default;
}

/**
 * Get sanitized COOKIE string value
 *
 * @param string $key     The COOKIE key
 * @param string $default Default value if key doesn't exist
 * @return string Sanitized string value
 */
function formshield_get_cookie_string( $key, $default = '' ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_COOKIE[ $key ] ) ? sanitize_text_field( wp_unslash( $_COOKIE[ $key ] ) ) : $default;
}

/**
 * Get sanitized SERVER string value
 *
 * @param string $key     The SERVER key
 * @param string $default Default value if key doesn't exist
 * @return string Sanitized string value
 */
function formshield_get_server_string( $key, $default = '' ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
    return isset( $_SERVER[ $key ] ) ? sanitize_text_field( wp_unslash( $_SERVER[ $key ] ) ) : $default;
}

/**
 * Get validated IP address from SERVER
 *
 * @param string $default Default value if no valid IP found
 * @return string Validated IP address
 */
function formshield_get_validated_ip( $default = '' ) {
    // Санитизирай при самото четене, после валидирай като IP
    $ip_raw = isset( $_SERVER['REMOTE_ADDR'] ) // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This is a helper function; nonce verification should be done in the calling code
        ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) )
        : '';

    $ip = filter_var( $ip_raw, FILTER_VALIDATE_IP );
    return $ip ? $ip : $default;
}

/**
 * Verify nonce and bail if invalid
 *
 * @param string $action The nonce action
 * @return void
 */
function formshield_verify_nonce_or_bail( $action = 'formshield_action' ) {
    // phpcs:ignore WordPress.Security.NonceVerification.Missing - This is the nonce verification function itself
    $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
    if ( ! wp_verify_nonce( $nonce, $action ) ) {
        wp_send_json_error( array( 'message' => __( 'Invalid request.', 'formshield' ) ), 400 );
    }
}

/**
 * Verify nonce for GET requests
 *
 * @param string $action The nonce action
 * @return void
 */
function formshield_verify_get_nonce_or_bail( $action = 'formshield_action' ) {
    $nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
    if ( ! wp_verify_nonce( $nonce, $action ) ) {
        wp_send_json_error( array( 'message' => __( 'Invalid request.', 'formshield' ) ), 400 );
    }
}
