<?php
/**
 * Server-side render for the playard/booking-widget block.
 * $attributes and $content are injected by WordPress.
 */
if ( ! defined( 'ABSPATH' ) ) exit;

// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound

$shortcodes    = new Playard_Shortcodes();
$playard_widget = $shortcodes->render_booking_widget( [
	'field'          => sanitize_text_field( (string) ( $attributes['fieldIds']     ?? '' ) ),
	'theme'          => sanitize_text_field( (string) ( $attributes['theme']        ?? 'light' ) ),
	'show_field_step' => (bool) ( $attributes['showFieldStep'] ?? true ),
	'compact'        => (bool) ( $attributes['compactMode']   ?? false ),
	'accent_color'   => sanitize_hex_color( (string) ( $attributes['accentColor']  ?? '' ) ),
] );

// The widget markup is a single mount <div> whose attributes are already
// escaped in public/views/booking-widget.php. Pass it through wp_kses() with
// an explicit allowlist so no raw output reaches the page.
echo wp_kses(
	$playard_widget,
	[
		'div' => [
			'id'            => [],
			'class'         => [],
			'data-field-id' => [],
			'data-config'   => [],
		],
	]
);
