<?php
/**
 * Social Login Buttons Partial
 *
 * Rendered on the WordPress login form when social login is enabled.
 *
 * @package GuardDog
 * @since 1.9.30
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
// These are local variables in a template file, not global variables
// The Plugin Checker incorrectly flags local template variables as globals
$providers = $providers ?? [];
$callback_base = $callback_base ?? admin_url( 'admin-ajax.php' );
$redirect_to = $redirect_to ?? '';
$error_redirect_to = $error_redirect_to ?? '';
// phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound

if ( empty( $providers ) ) {
    return;
}
?>

<div class="guard-dog-social-login">
    <div class="guard-dog-social-login__buttons">
        <?php foreach ( $providers as $id => $provider ) : ?>
            <?php
            $query_args = [
                'action'   => 'guard_dog_oauth_init',
                'provider' => $id,
            ];

            if ( '' !== $redirect_to ) {
                $query_args['redirect_to'] = $redirect_to;
            }

            if ( '' !== $error_redirect_to ) {
                $query_args['error_redirect_to'] = $error_redirect_to;
            }
            ?>
            <a href="<?php echo esc_url( add_query_arg( $query_args, $callback_base ) ); ?>"
               class="guard-dog-social-login__btn guard-dog-social-login__btn--<?php echo esc_attr( $id ); ?>">
                <span class="guard-dog-social-login__icon">
                    <?php
                    // SVG icons are static brand marks, not user content
                    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
                    echo $provider->get_icon_svg();
                    ?>
                </span>
                <span class="guard-dog-social-login__label">
                    <?php
                    echo esc_html(
                        sprintf(
                            /* translators: %s: provider name (e.g., Google, Microsoft, Facebook) */
                            __( 'Sign in with %s', 'guard-dog' ),
                            $provider->get_name()
                        )
                    );
                    ?>
                </span>
            </a>
        <?php endforeach; ?>
    </div>

    <?php
    // phpcs:disable WordPress.Security.NonceVerification.Recommended
    // 1. Context: Display-only - showing error messages from OAuth redirect
    // 2. No data modification or privileged actions
    // 3. Input sanitized before display
    $social_error = isset( $_GET['social_login_error'] ) ? sanitize_text_field( wp_unslash( $_GET['social_login_error'] ) ) : '';
    // phpcs:enable WordPress.Security.NonceVerification.Recommended

    if ( $social_error ) :
        $error_messages = [
            'provider_denied'      => __( 'You denied access. Please try again.', 'guard-dog' ),
            'missing_params'       => __( 'Authentication failed. Missing parameters.', 'guard-dog' ),
            'invalid_state'        => __( 'Authentication expired. Please try again.', 'guard-dog' ),
            'invalid_provider'     => __( 'Invalid login provider.', 'guard-dog' ),
            'provider_config'      => __( 'Authentication provider configuration error. Please contact your administrator.', 'guard-dog' ),
            'oauth_error'          => __( 'Authentication error. Please try again.', 'guard-dog' ),
            'no_matching_user'     => __( 'No account found for this email. Contact your administrator.', 'guard-dog' ),
            'already_linked_other' => __( 'This social account is already linked to another user.', 'guard-dog' ),
        ];
        $message = $error_messages[ $social_error ] ?? __( 'Social login failed. Please try again.', 'guard-dog' );
    ?>
        <div class="guard-dog-social-login__error">
            <?php echo esc_html( $message ); ?>
        </div>
    <?php endif; ?>
</div>
