<?php

namespace GriffinForms\Admin\Secure;

class Message extends \GriffinForms\Admin\Secure\Format
{
    protected function secureContent($value)
    {
        if (!is_string($value)) {
            return '';
        }

        $allowed_html = $this->getAllowedMessageHtml();
        $allowed_protocols = wp_allowed_protocols();

        return wp_kses($value, $allowed_html, $allowed_protocols);
    }

    /**
     * Allowlist for message HTML content used in outgoing emails.
     *
     * Intentionally scoped to common email-safe tags/attributes.
     */
    protected function getAllowedMessageHtml()
    {
        $allowed = array(
            'a' => array(
                'href' => true,
                'target' => true,
                'rel' => true,
                'title' => true,
                'class' => true,
                'style' => true,
            ),
            'strong' => array(),
            'em' => array(),
            'b' => array(),
            'i' => array(),
            'u' => array(),
            'h1' => array(
                'class' => true,
                'style' => true,
            ),
            'h2' => array(
                'class' => true,
                'style' => true,
            ),
            'h3' => array(
                'class' => true,
                'style' => true,
            ),
            'h4' => array(
                'class' => true,
                'style' => true,
            ),
            'h5' => array(
                'class' => true,
                'style' => true,
            ),
            'h6' => array(
                'class' => true,
                'style' => true,
            ),
            'p' => array(
                'class' => true,
                'style' => true,
            ),
            'br' => array(),
            'ul' => array(
                'class' => true,
                'style' => true,
            ),
            'ol' => array(
                'class' => true,
                'style' => true,
            ),
            'li' => array(
                'class' => true,
                'style' => true,
            ),
            'table' => array(
                'class' => true,
                'style' => true,
                'border' => true,
                'cellpadding' => true,
                'cellspacing' => true,
                'width' => true,
            ),
            'thead' => array(
                'class' => true,
                'style' => true,
            ),
            'tbody' => array(
                'class' => true,
                'style' => true,
            ),
            'tr' => array(
                'class' => true,
                'style' => true,
            ),
            'th' => array(
                'class' => true,
                'style' => true,
                'colspan' => true,
                'rowspan' => true,
                'width' => true,
                'align' => true,
                'valign' => true,
            ),
            'td' => array(
                'class' => true,
                'style' => true,
                'colspan' => true,
                'rowspan' => true,
                'width' => true,
                'align' => true,
                'valign' => true,
            ),
            'span' => array(
                'class' => true,
                'style' => true,
            ),
            'div' => array(
                'class' => true,
                'style' => true,
            ),
        );

        return apply_filters('griffinforms_message_allowed_html', $allowed);
    }
}
