<?php

/**
 * Shortcode [slidemind_embed] — embeds a same-origin e-learning module
 * inside a WordPress page through a sandboxed iframe.
 *
 * Automatically appends the current learner's WordPress user id to the
 * iframe URL so authoring tools can identify the learner without exposing
 * an email or other PII.
 *
 * @package SlideMind\Frontend
 * @since 2.2.0
 */
namespace SlideMind\Frontend;

if ( !defined( 'ABSPATH' ) ) {
    exit;
}
class EmbedShortcode {
    /**
     * Constructor — registers the shortcode handler.
     */
    public function __construct() {
        add_shortcode( 'slidemind_embed', [$this, 'render'] );
    }

    /**
     * Render the [slidemind_embed] shortcode.
     *
     * Usage: [slidemind_embed url="https://example.com/story.html" width="100%" height="600px"]
     *
     * @param array|string $atts Shortcode attributes.
     * @return string Iframe HTML, or an empty string when the URL is invalid.
     */
    public function render( $atts ) {
        $atts = shortcode_atts( [
            'url'    => '',
            'width'  => '100%',
            'height' => '600px',
        ], $atts, 'slidemind_embed' );
        $url = trim( $atts['url'] );
        // URL required
        if ( empty( $url ) ) {
            if ( current_user_can( 'edit_posts' ) ) {
                $message = sprintf( 
                    /* translators: %s: attribute name wrapped in <code> tag */
                    __( '[slidemind_embed] Error: the %s attribute is required.', 'slidemind' ),
                    '<code>url</code>'
                 );
                return '<p style="color:#d63638;font-weight:bold;">' . wp_kses( $message, [
                    'code' => [],
                ] ) . '</p>';
            }
            return '';
        }
        // URL format validation
        if ( !filter_var( $url, FILTER_VALIDATE_URL ) ) {
            if ( current_user_can( 'edit_posts' ) ) {
                return '<p style="color:#d63638;font-weight:bold;">' . esc_html__( '[slidemind_embed] Error: invalid URL.', 'slidemind' ) . '</p>';
            }
            return '';
        }
        $site_host = strtolower( (string) wp_parse_url( site_url(), PHP_URL_HOST ) );
        $raw_host = wp_parse_url( $url, PHP_URL_HOST );
        $url_host = ( $raw_host !== null ? strtolower( trim( $raw_host, '[]' ) ) : null );
        $url_scheme = wp_parse_url( $url, PHP_URL_SCHEME );
        // Extracted booleans avoid the Freemius preprocessor collapsing
        // the parenthesized groups on the free-build output (which would
        // produce a boolean-precedence warning under PHPCS).
        $local_dev_enabled = defined( 'SLIDEMIND_LOCAL_DEV' ) && SLIDEMIND_LOCAL_DEV;
        $loopback_host = in_array( $url_host, ['localhost', '127.0.0.1', '::1'], true );
        $file_scheme = 'file' === $url_scheme;
        $is_local_dev = $local_dev_enabled && ($loopback_host || $file_scheme);
        $is_remote_host = $url_host !== null && $url_host !== $site_host;
        $is_cross_origin = $is_remote_host || $file_scheme;
        if ( $is_cross_origin && !$is_local_dev ) {
            if ( current_user_can( 'edit_posts' ) ) {
                return '<p style="color:#d63638;font-weight:bold;">' . esc_html__( '[slidemind_embed] Error: the URL must point to this WordPress site (same origin).', 'slidemind' ) . '</p>';
            }
            return '';
        }
        // Inject slidemind_user if logged in
        if ( is_user_logged_in() ) {
            $user_id = get_current_user_id();
            $separator = ( strpos( $url, '?' ) !== false ? '&' : '?' );
            $url = $url . $separator . 'slidemind_user=' . intval( $user_id );
        }
        // Sanitize dimensions
        $width = esc_attr( $atts['width'] );
        $height = esc_attr( $atts['height'] );
        return sprintf(
            '<iframe src="%s" width="%s" height="%s" style="border:none;" allowfullscreen allow="autoplay; microphone"></iframe>',
            esc_url( $url ),
            $width,
            $height
        );
    }

}
