<?php
/**
 * Shortcode handler — partial content protection.
 *
 * Usage: [ppmstr_protect password="secret"]Hidden content[/ppmstr_protect]
 *
 * @package PrivexPasswordProtect
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Class PPMSTR_Shortcodes
 */
class PPMSTR_Shortcodes {

	/**
	 * Register hooks.
	 */
	public function init() {
		add_shortcode( 'ppmstr_protect', array( $this, 'protect_shortcode' ) );
	}

	/**
	 * Render the [ppmstr_protect] shortcode.
	 *
	 * @param array  $atts    Shortcode attributes.
	 * @param string $content Enclosed content.
	 * @return string HTML output.
	 */
	public function protect_shortcode( $atts, $content = '' ) {
		$atts = shortcode_atts(
			array(
				'password' => '',
				'headline' => __( 'Protected Content', 'privex-password-protect' ),
			),
			$atts,
			'ppmstr_protect'
		);

		if ( empty( $atts['password'] ) ) {
			return wp_kses_post( do_shortcode( $content ) );
		}

		// Build a unique instance ID from the password + a portion of the content.
		$instance_id = substr( md5( $atts['password'] . mb_substr( $content, 0, 50 ) ), 0, 12 );

		// Check cookie.
		$cookie_name = 'ppmstr_access_sc_' . $instance_id;
		$expected    = wp_hash( 'ppmstr_sc_granted_' . $instance_id . '_' . $atts['password'] );

		if ( isset( $_COOKIE[ $cookie_name ] ) && hash_equals( $expected, sanitize_text_field( wp_unslash( $_COOKIE[ $cookie_name ] ) ) ) ) {
			return wp_kses_post( do_shortcode( $content ) );
		}

		// Admin bypass.
		$settings = get_option( 'ppmstr_settings', array() );
		if ( ! empty( $settings['admin_bypass'] ) && current_user_can( 'manage_options' ) ) {
			return wp_kses_post( do_shortcode( $content ) );
		}

		// Check for form error on this instance.
		$error = false;
		// phpcs:disable WordPress.Security.NonceVerification.Recommended
		if (
			isset( $_GET['ppmstr_sc_error'] ) &&
			sanitize_key( wp_unslash( $_GET['ppmstr_sc_error'] ) ) === $instance_id
		) {
			$error = true;
		}
		// phpcs:enable WordPress.Security.NonceVerification.Recommended

		$password_hash = wp_hash_password( $atts['password'] );
		$nonce         = wp_create_nonce( 'ppmstr_password_sc_' . $instance_id );
		$error_msg     = isset( $settings['form_error_message'] ) ? $settings['form_error_message'] : __( 'Incorrect password. Please try again.', 'privex-password-protect' );
		$placeholder   = isset( $settings['form_placeholder'] ) ? $settings['form_placeholder'] : __( 'Enter password…', 'privex-password-protect' );
		$button_text   = isset( $settings['form_button_text'] ) ? $settings['form_button_text'] : __( 'Unlock', 'privex-password-protect' );

		ob_start();
		?>
		<div class="ppmstr-form-wrap ppmstr-shortcode-form">
			<div class="ppmstr-form-card ppmstr-form-card--inline">
				<div class="ppmstr-form-icon">
					<svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
						<rect x="3" y="11" width="18" height="11" rx="2"/>
						<path d="M7 11V7a5 5 0 0 1 10 0v4"/>
					</svg>
				</div>

				<h3 class="ppmstr-form-headline"><?php echo esc_html( $atts['headline'] ); ?></h3>

				<?php if ( $error ) : ?>
					<div class="ppmstr-form-error" role="alert"><?php echo esc_html( $error_msg ); ?></div>
				<?php endif; ?>

				<form method="post" action="" class="ppmstr-password-form">
					<input type="hidden" name="ppmstr_nonce" value="<?php echo esc_attr( $nonce ); ?>" />
					<input type="hidden" name="ppmstr_type" value="shortcode" />
					<input type="hidden" name="ppmstr_instance" value="<?php echo esc_attr( $instance_id ); ?>" />
					<input type="hidden" name="ppmstr_hash" value="<?php echo esc_attr( $password_hash ); ?>" />
					<input type="hidden" name="ppmstr_post_id" value="0" />

					<div class="ppmstr-form-input-wrap">
						<input type="password" name="ppmstr_password" class="ppmstr-form-input"
							placeholder="<?php echo esc_attr( $placeholder ); ?>" required autocomplete="off" />
						<button type="button" class="ppmstr-eye-toggle" aria-label="<?php esc_attr_e( 'Show password', 'privex-password-protect' ); ?>">
							<svg class="ppmstr-eye-open" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/></svg>
							<svg class="ppmstr-eye-closed" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="display:none"><path d="M17.94 17.94A10.07 10.07 0 0 1 12 20c-7 0-11-8-11-8a18.45 18.45 0 0 1 5.06-5.94M9.9 4.24A9.12 9.12 0 0 1 12 4c7 0 11 8 11 8a18.5 18.5 0 0 1-2.16 3.19m-6.72-1.07a3 3 0 1 1-4.24-4.24"/><line x1="1" y1="1" x2="23" y2="23"/></svg>
						</button>
					</div>

					<button type="submit" class="ppmstr-form-submit"><?php echo esc_html( $button_text ); ?></button>
				</form>
			</div>
		</div>
		<?php
		return ob_get_clean();
	}
}
