<?php
/**
 * Shortcode handler.
 *
 * @package Vareon_Calculator_Suite_Lite
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Sanitize CSS width value for safe output.
 *
 * Validates against a whitelist of safe CSS length units.
 * Returns '100%' if the value is invalid or potentially unsafe.
 *
 * @param string $width The width value to sanitize.
 * @return string Sanitized width value.
 */
function vareoncalc_sanitize_css_width( $width ) {
	if ( empty( $width ) || ! is_string( $width ) ) {
		return '100%';
	}

	$width = trim( $width );

	// Allow safe CSS length patterns: number + unit (px, %, em, rem, vw, vh, ch, fr, pt).
	// Pattern: optional whitespace, digits (with optional decimal), unit.
	if ( preg_match( '/^(\d+(?:\.\d+)?)(px|%|em|rem|vw|vh|ch|fr|pt)$/i', $width ) ) {
		return strtolower( $width );
	}

	// Allow 'auto' and 'inherit' keywords.
	$lower = strtolower( $width );
	if ( in_array( $lower, array( 'auto', 'inherit', 'initial' ), true ) ) {
		return $lower;
	}

	// Fallback for invalid values.
	return '100%';
}

/**
 * Build a responsive inline shell style from a sanitized width value.
 *
 * Pixel widths act as responsive max caps, while percentage and keyword widths
 * preserve their original semantics.
 *
 * @param string $width Sanitized CSS width value.
 * @return string Safe inline style string.
 */
function vareoncalc_build_responsive_shell_style( $width ) {
	$width = vareoncalc_sanitize_css_width( $width );

	if ( preg_match( '/^(\d+(?:\.\d+)?)px$/i', $width ) ) {
		return 'width:100%;max-width:' . $width . ';';
	}

	return 'width:' . $width . ';';
}

$vareoncalc_shortcode_cb = function ( $atts = array(), $content = null, $tag = '' ) {
	// Silence unused variable notice.
	unset( $content );

	$atts = shortcode_atts(
		array(
			'type'     => 'bmi',
			'width'    => '100%',
			'branding' => null,
			'theme'    => null,
		),
		$atts,
		'' !== $tag ? $tag : 'vareon'
	);

	// Sanitize type: allow only lowercase letters and hyphens.
	$type = preg_replace( '/[^a-z\-]/', '', strtolower( $atts['type'] ) );
	if ( empty( $type ) ) {
		$type = 'bmi';
	}

	// Sanitize width against safe CSS length patterns.
	$width = vareoncalc_sanitize_css_width( $atts['width'] );

	// Sanitize theme: Lite only allows built-in presets.
	$theme = null;
	if ( ! empty( $atts['theme'] ) && is_string( $atts['theme'] ) ) {
		$theme_input = strtolower( trim( $atts['theme'] ) );
		if ( in_array( $theme_input, array( 'light', 'dark', 'modern' ), true ) ) {
			$theme = $theme_input;
		}
	}

	if ( ! vareoncalc_is_calculator_available( $type ) ) {
		return '';
	}

	$global_branding = vareoncalc_get_option( 'branding', vareoncalc_get_branding_enabled_default() ? 1 : 0 );
	if ( null !== $atts['branding'] ) {
		$show_branding = (bool) $atts['branding'];
	} else {
		$show_branding = ! empty( $global_branding );
	}

	// Enqueue frontend assets (base + loader + per-calculator styles) on-demand.
	vareoncalc_enqueue_frontend_assets( $type );

	$data = array(
		'type'     => $type,
		'branding' => (bool) $show_branding,
	);
	if ( $theme ) {
		$data['theme'] = $theme;
	}

	$html = '<div class="vareoncalc" style="' . esc_attr( vareoncalc_build_responsive_shell_style( $width ) ) . '" data-config="' . esc_attr( wp_json_encode( $data ) ) . '"></div>';

	return $html;
};

add_shortcode( 'vareon', $vareoncalc_shortcode_cb );       // Primary shortcode.
add_shortcode( 'vareoncalc', $vareoncalc_shortcode_cb );   // Full name alias.
