<?php
/**
 * Fields admin page - rendering, request handlers, and helpers.
 *
 * @package ContactForms
 * @since 2.2.5
 */

defined( 'ABSPATH' ) || exit;

/**
 * Enqueue scripts for the Fields admin page.
 */
function accua_forms_fields_page_enqueue_scripts() {
	wp_enqueue_script(
		'accua-forms-fields-page',
		plugins_url( 'assets/js/admin/fields-page.js', ACCUA_FORMS_FILE ),
		array( 'jquery', 'wp-a11y' ),
		ACCUA_FORMS_JS_VERSION,
		true
	);

	wp_localize_script( 'accua-forms-fields-page', 'accuaFieldsPage', array(
		'ajaxUrl'       => admin_url( 'admin-ajax.php' ),
		'previewNonce'  => wp_create_nonce( 'accua_forms_field_preview' ),
		// For the inline slug validation while adding a field.
		'existingSlugs' => array_values( array_map( 'strval', array_keys( (array) get_option( 'accua_forms_avail_fields', array() ) ) ) ),
		'l10n' => array(
			'allowedExtensionsLabel' => __( 'Allowed extensions', 'contact-forms' ) . ':',
			'allowedExtensionsHelp'  => __( 'Enter one extension per line without dot (e.g. pdf, jpg, docx). Leave blank to use defaults.', 'contact-forms' ),
			'allowedValuesLabel'     => __( 'Allowed values', 'contact-forms' ) . ':',
			'allowedValuesHelp'      => __( 'Enter one value per line, in the format key|label. The key is the value stored in the database. The label is optional.', 'contact-forms' ),
			'queryParamsLabel'       => __( 'Additional query parameters', 'contact-forms' ) . ':',
			// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- This is example help text, not actual code.
			'queryParamsHelp'        => __( 'Optional: Filter posts using query parameters (e.g., authors=admin or meta_key=featured&meta_value=1). Add post_status=publish,private to also include private posts (their titles become visible to all visitors of this form). Leave empty for all published posts of the selected type.', 'contact-forms' ),
			'defaultValueLabel'      => __( 'Default value(s)', 'contact-forms' ) . ':',
			'defaultValueHelp'       => __( 'For multiple default values in multiple select and multiple checkboxes, use | as separator.', 'contact-forms' ),
			'customHtmlLabel'        => __( 'Custom HTML content', 'contact-forms' ) . ':',
			'customHtmlHelp'         => __( 'The HTML code that will be rendered at this position in the form.', 'contact-forms' ),
			'errorLabelRequired'     => __( 'Field label is required.', 'contact-forms' ),
			'errorSlugRequired'      => __( 'Field slug is required.', 'contact-forms' ),
			'errorAllowedValuesRequired' => __( 'Allowed values are required for this field type.', 'contact-forms' ),
			/* translators: %s is the field slug */
			'confirmDelete'          => __( 'Delete the field "%s" permanently? Forms using it will no longer show it.', 'contact-forms' ),
			// Same wording as the server-side save validation.
			'slugInvalidChars'       => __( 'Only letters, numbers, hyphens, and underscores allowed in field slug', 'contact-forms' ),
			'slugDoubleUnderscore'   => __( 'The field slug cannot start with two underscores (__)', 'contact-forms' ),
			'slugTooLong'            => __( 'The field slug cannot be longer than 70 characters', 'contact-forms' ),
			'slugExists'             => __( 'This slug is already used by another field.', 'contact-forms' ),
		),
	) );
}

/**
 * Get the available field types.
 *
 * @return array Associative array of type_id => translated label.
 */
function accua_forms_fields_get_types() {
	$types = array(
		'textfield'            => __( 'Text Field', 'contact-forms' ),
		'textarea'             => __( 'Text Area', 'contact-forms' ),
		'email'                => __( 'Email', 'contact-forms' ),
		'autoreply_email'      => __( 'Autoreply Email', 'contact-forms' ),
		'telephone'            => __( 'Telephone', 'contact-forms' ),
		'checkbox'             => __( 'Checkbox', 'contact-forms' ),
		'select'               => __( 'Select', 'contact-forms' ),
		'radio'                => __( 'Radio buttons', 'contact-forms' ),
		'multiselect'          => __( 'Multiple selections area', 'contact-forms' ),
		'multicheckbox'        => __( 'Multiple checkboxes', 'contact-forms' ),
		'post-select'          => __( 'Post select', 'contact-forms' ),
		'post-multicheckbox'   => __( 'Multiple post checkboxes', 'contact-forms' ),
		'colorpicker'          => __( 'Color picker', 'contact-forms' ),
		'hidden'               => __( 'Hidden value', 'contact-forms' ),
		'file'                 => __( 'File upload', 'contact-forms' ),
		'submit'               => __( 'Submit button', 'contact-forms' ),
		'html'                 => __( 'Custom HTML', 'contact-forms' ),
		'captcha'              => __( 'Captcha', 'contact-forms' ),
		'captcha_v3'           => __( 'Captcha (reCAPTCHA v3)', 'contact-forms' ),
		'cap'                  => __( 'Captcha (Cap)', 'contact-forms' ),
		'turnstile'            => __( 'Captcha (Turnstile)', 'contact-forms' ),
		'password'             => __( 'Password', 'contact-forms' ),
		'password-and-confirm' => __( 'Password and password confirmation', 'contact-forms' ),
		'date'                 => __( 'Date', 'contact-forms' ),
	);

	/**
	 * Filter the available field types.
	 *
	 * @param array $types Associative array of type_id => label.
	 */
	return apply_filters( 'accua_forms_field_types', $types );
}

/**
 * Validate and filter a date string (YYYY-MM-DD).
 *
 * @param string $value Date string.
 * @return string Valid date or empty string.
 */
function accua_forms_filter_date( $value ) {
	if ( ( $value !== '' ) && preg_match( '/^\d{4}-\d{2}-\d{2}$/', $value ) ) {
		try {
			$date = new DateTime( $value );
			if ( $date ) {
				return $value;
			}
		} catch ( Exception $e ) {
		}
	}
	return '';
}

/**
 * Validate and filter field data from form submission.
 *
 * @param array $post     Form POST data.
 * @param array $old_data Previous field data (for edits).
 * @return array { 'data' => array, 'valid' => bool, 'message' => string }
 */
function accua_forms_fields_filter_values( $post, $old_data = array() ) {
	$data = array(
		'version'                => 2,
		'id'                     => $post['form-field-id'],
		'name'                   => $post['form-field-name'],
		'type'                   => $post['form-field-type'],
		'description'            => $post['form-field-description'],
		'default_value'          => $post['form-field-default-value'],
		'default_date_value'     => $post['form-field-default-date-value'],
		'allowed_values'         => $post['form-field-allowed-values'],
		'allowed_extensions'     => '',
		'min_date'               => $post['form-field-min-of-date'],
		'max_date'               => $post['form-field-max-of-date'],
		'custom_required_message' => sanitize_text_field( $post['form-field-custom-required-message'] ),
		'custom_format_message'  => sanitize_text_field( $post['form-field-custom-format-message'] ),
		// Unchecked checkboxes are absent from the POST, so the key is always
		// written explicitly: a missing key means "never saved on this page"
		// (relevant for the upgrade migration in accua_forms_install()).
		'essential_column'       => empty( $post['form-field-essential-column'] ) ? 0 : 1,
	);
	$valid   = true;
	$message = '';

	if ( trim( $data['name'] ) === '' ) {
		$message .= '<p>' . __( 'Field label is required', 'contact-forms' ) . '</p>';
		$valid = false;
	}

	$types = accua_forms_fields_get_types();
	if ( ! isset( $types[ $data['type'] ] ) ) {
		// An unchanged type that is not currently registered is kept as-is:
		// the extension plugin providing it may just be deactivated (or it is
		// a legacy type). The edit form offers it as a "(currently not
		// registered)" option, so editing the field must not overwrite it.
		$keep_unregistered = ! empty( $old_data['type'] ) && $data['type'] === $old_data['type'];
		if ( ! $keep_unregistered ) {
			$message .= '<p>' . __( 'Invalid type', 'contact-forms' ) . '</p>';
			$valid = false;
			$data['type'] = 'textfield';
		}
	}

	if ( ! current_user_can( 'unfiltered_html' ) ) {
		$filter_fields = array( 'name', 'description', 'default_value', 'allowed_values' );
		foreach ( $filter_fields as $k ) {
			$data[ $k ] = wp_kses( $data[ $k ], 'post' );
		}
	}

	if ( $data['type'] == 'file' ) {
		$data['allowed_extensions'] = accua_forms_filter_extensions( $data['allowed_values'] );
	}

	// Require allowed values for types that need options
	$types_needing_options = array( 'select', 'radio', 'multiselect', 'multicheckbox' );
	if ( in_array( $data['type'], $types_needing_options ) && trim( $data['allowed_values'] ) === '' ) {
		$message .= '<p>' . __( 'Allowed values are required for this field type', 'contact-forms' ) . '</p>';
		$valid = false;
	}

	$dates = array(
		'default_date_value' => __( 'Invalid default date', 'contact-forms' ),
		'min_date'           => __( 'Invalid min date', 'contact-forms' ),
		'max_date'           => __( 'Invalid max date', 'contact-forms' ),
	);
	foreach ( $dates as $k => $errormsg ) {
		if ( $data[ $k ] !== '' ) {
			$data[ $k ] = accua_forms_filter_date( $data[ $k ] );
			if ( $data[ $k ] === '' ) {
				$message .= '<p>' . $errormsg . '</p>';
				$valid = false;
			}
		}
	}

	return array(
		'data'    => $data,
		'valid'   => $valid,
		'message' => $message,
	);
}

/**
 * Render the Fields admin page (request handling + output).
 */
function accua_forms_fields_page() {
	$message = '';

	$avail_fields = get_option( 'accua_forms_avail_fields', array() );

	$default_form_values = array(
		'version'                => 1,
		'id'                     => '',
		'name'                   => '',
		'type'                   => 'textfield',
		'description'            => '',
		'default_value'          => '',
		'default_date_value'     => '',
		'allowed_values'         => '',
		'allowed_extensions'     => '',
		'min_date'               => '',
		'max_date'               => '',
		'custom_required_message' => '',
		'custom_format_message'  => '',
		'essential_column'       => 0,
	);

	$editing      = false;
	$adding       = true;
	$message_type = '';

	if ( ! empty( $_POST['action'] ) ) {
		check_admin_referer( 'edit_form_field', '_wpnonce_edit_form_field' );
		$post = stripslashes_deep( $_POST ) + $default_form_values;
		switch ( $post['action'] ) {
			case 'edit-form-field':
				if ( empty( $avail_fields[ $post['form-field-id'] ] ) ) {
					$message .= '<p>Field "' . esc_html( sanitize_text_field( $post['form-field-id'] ) ) . '" doesn\'t exists</p>';
					$message_type = 'error';
				} else {
					if ( empty( $post['delete-field'] ) ) {
						$filtered_data = accua_forms_fields_filter_values( $post, $avail_fields[ $post['form-field-id'] ] );
						$message .= $filtered_data['message'];
						if ( $filtered_data['valid'] ) {
							$avail_fields[ $post['form-field-id'] ] = $filtered_data['data'];
							/* translators: %s is the field slug */
							$message .= '<p>' . sprintf( __( 'Field "%s" updated', 'contact-forms' ), esc_html( $post['form-field-id'] ) ) . '</p>';
							$message_type = 'success';
							update_option( 'accua_forms_avail_fields', $avail_fields );
							do_action( 'accua_forms_field_updated', $avail_fields[ $post['form-field-id'] ] );
						} else {
							$message_type = 'error';
							$editing = true;
							$adding  = false;
							$default_form_values = $filtered_data['data'];
						}
					} else {
						$deleting_field = $avail_fields[ $post['form-field-id'] ];
						unset( $avail_fields[ $post['form-field-id'] ] );
						/* translators: %s is the field slug */
						$message .= '<p>' . sprintf( __( 'Field "%s" deleted', 'contact-forms' ), esc_html( $post['form-field-id'] ) ) . '</p>';
						$message_type = 'success';
						do_action( 'accua_forms_field_deleted', $deleting_field );
						update_option( 'accua_forms_avail_fields', $avail_fields );
					}
				}
				break;
			case 'add-form-field':
				$fill_form_fields = true;
				$valid = true;
				// New slugs are lowercased. Slugs are case-sensitive everywhere
				// (PHP array keys, and the submission values column since 2.3.0),
				// so "role" and "Role" are two different fields - legal, but a
				// confusing pair to end up with by accident. Existing mixed-case
				// slugs are never touched: this runs only when adding a field.
				if ( isset( $post['form-field-id'] ) && is_string( $post['form-field-id'] ) ) {
					$post['form-field-id'] = strtolower( $post['form-field-id'] );
				}
				if ( empty( $post['form-field-id'] ) || ! preg_match( '/^[a-z0-9_-]+$/i', $post['form-field-id'] ) ) {
					$message .= '<p>' . __( 'Only letters, numbers, hyphens, and underscores allowed in field slug', 'contact-forms' ) . '</p>';
					$valid = false;
				}
				if ( substr( $post['form-field-id'], 0, 2 ) == '__' ) {
					$message .= '<p>' . __( 'The field slug cannot start with two underscores (__)', 'contact-forms' ) . '</p>';
					$valid = false;
				}
				if ( ! empty( $avail_fields[ $post['form-field-id'] ] ) ) {
					/* translators: %s is the field slug */
					$message .= sprintf( __( '<p>A field with slug "%s" already exists.</p><p>Field was not added.</p>', 'contact-forms' ), esc_html( $post['form-field-id'] ) );
					$valid = false;
				}
				if ( strlen( $post['form-field-id'] ) > 70 ) {
					$message .= '<p>' . __( 'The field slug cannot be longer than 70 characters', 'contact-forms' ) . '</p>';
					$valid = false;
				}
				$filtered_data = accua_forms_fields_filter_values( $post );
				$message .= $filtered_data['message'];
				$valid = $valid && $filtered_data['valid'];
				if ( $valid ) {
					$fill_form_fields = false;
					$avail_fields[ $post['form-field-id'] ] = $filtered_data['data'];
					update_option( 'accua_forms_avail_fields', $avail_fields );
					/* translators: %s is the field slug */
					$message .= '<p>' . sprintf( __( 'Field "%s" created', 'contact-forms' ), esc_html( $post['form-field-id'] ) ) . '</p>';
					$message_type = 'success';
					do_action( 'accua_forms_field_added', $avail_fields[ $post['form-field-id'] ] );
				} else {
					$message_type = 'error';
				}
				if ( $fill_form_fields ) {
					$editing = true;
					$default_form_values = $filtered_data['data'];
				}
				break;
		}
	} elseif ( ! empty( $_GET['edit-fid'] ) ) {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only field lookup
		$fid = sanitize_text_field( wp_unslash( $_GET['edit-fid'] ) );
		if ( empty( $avail_fields[ $fid ] ) ) {
			/* translators: %s is the field slug */
			$message .= sprintf( __( 'Field "%s" doesn\'t exists', 'contact-forms' ), esc_html( $fid ) );
		} else {
			$adding  = false;
			$editing = true;
			$default_form_values = $avail_fields[ $fid ] + $default_form_values;
		}
	} elseif ( ! empty( $_GET['delete-fid'] ) ) {
		$fid = sanitize_text_field( wp_unslash( $_GET['delete-fid'] ) );
		check_admin_referer( 'delete_form_field_' . $fid );
		if ( empty( $avail_fields[ $fid ] ) ) {
			/* translators: %s is the field slug */
			$message .= '<p>' . sprintf( __( 'Field "%s" doesn\'t exists', 'contact-forms' ), esc_html( $fid ) ) . '</p>';
			$message_type = 'error';
		} else {
			$deleting_field = $avail_fields[ $fid ];
			unset( $avail_fields[ $fid ] );
			update_option( 'accua_forms_avail_fields', $avail_fields );
			/* translators: %s is the field slug */
			$message .= '<p>' . sprintf( __( 'Field "%s" deleted', 'contact-forms' ), esc_html( $fid ) ) . '</p>';
			$message_type = 'success';
			do_action( 'accua_forms_field_deleted', $deleting_field );
		}
	} elseif ( ! empty( $_GET['fields'] ) && is_array( $_GET['fields'] ) ) {
		$bulk_action = '';
		if ( isset( $_GET['action'] ) && $_GET['action'] !== '-1' ) {
			$bulk_action = sanitize_text_field( wp_unslash( $_GET['action'] ) );
		} elseif ( isset( $_GET['action2'] ) && $_GET['action2'] !== '-1' ) {
			$bulk_action = sanitize_text_field( wp_unslash( $_GET['action2'] ) );
		}
		if ( 'delete' === $bulk_action ) {
			check_admin_referer( 'bulk-fields' );
			$fields_to_delete = array_map( 'sanitize_text_field', wp_unslash( $_GET['fields'] ) );
			$deleted_count = 0;
			foreach ( $fields_to_delete as $fid ) {
				if ( ! empty( $avail_fields[ $fid ] ) ) {
					do_action( 'accua_forms_field_deleted', $avail_fields[ $fid ] );
					unset( $avail_fields[ $fid ] );
					$deleted_count++;
				}
			}
			if ( $deleted_count > 0 ) {
				update_option( 'accua_forms_avail_fields', $avail_fields );
				/* translators: %d is the number of deleted fields */
				$message .= '<p>' . sprintf( _n( '%d field deleted.', '%d fields deleted.', $deleted_count, 'contact-forms' ), $deleted_count ) . '</p>';
				$message_type = 'success';
			}
		}
	}

	if ( $default_form_values['version'] >= 2 && $default_form_values['type'] == 'file' ) {
		// Show allowed_extensions value in allowed_values field
		$default_form_values['allowed_values'] = $default_form_values['allowed_extensions'];
	}

	?>
<div id="accua_forms_fields_page" class="accua_forms_admin_page wrap nosubsub">
<h1><?php esc_html_e( 'Contact Forms - Fields', 'contact-forms' ); ?>
<?php
	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only search parameter
	$accua_fields_search = isset( $_REQUEST['s'] ) ? trim( sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) ) : '';
	if ( ! $editing && '' !== $accua_fields_search ) {
		echo '<span class="subtitle">' . sprintf(
			/* translators: %s is the search term the user typed */
			esc_html__( 'Search results for: %s', 'contact-forms' ),
			'<strong>' . esc_html( $accua_fields_search ) . '</strong>'
			// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Format string and argument are both escaped above
		) . '</span>';
	}
	?>
</h1>
<?php if ( ! $adding ) : ?>
<p class="accua-fields-back-link"><a href="admin.php?page=accua_forms_fields">&larr; <?php esc_html_e( 'Back to the fields list', 'contact-forms' ); ?></a></p>
<?php endif; ?>
<?php if ( $message !== '' ) : ?>
<div id="ajax-response" class="notice notice-<?php echo $message_type === 'success' ? 'success' : 'error'; ?> is-dismissible"><?php echo wp_kses_post( $message ); ?></div>
<?php endif; ?>

<div id="col-container">

<div id="col-right">
<div class="col-wrap">

<div id="accua-field-preview-panel"<?php if ( trim( $default_form_values['name'] ) === '' ) { echo ' style="display:none"'; } ?>>
  <h3><?php esc_html_e( 'Live preview', 'contact-forms' ); ?></h3>
  <p class="description"><?php esc_html_e( 'How this field will look when added to a new form with the default settings. The preview updates as you edit.', 'contact-forms' ); ?>
  <?php esc_html_e( 'The field is treated as mandatory here only to demonstrate the validation messages (leave it empty and click elsewhere to see them); in your forms it is mandatory only if you enable "Required" on the field.', 'contact-forms' ); ?></p>
  <div id="accua-field-preview-wrapper" class="accua-form-preview-loading">
    <iframe id="accua-field-preview" name="accua-field-preview" title="<?php esc_attr_e( 'Field preview', 'contact-forms' ); ?>" src="about:blank"></iframe>
  </div>
</div>

<?php
if ( ! $editing ) {
	require_once __DIR__ . '/class-fields-list-table.php';
	$fields_table = new Accua_Forms_Fields_List_Table();
	$fields_table->prepare_items();
	?>
<?php
	// The search gets its own GET form, the way the categories and tags screen
	// does it. Sharing the table's form would serialize the bulk-action selects,
	// the bulk nonce and the referer into the URL on every search.
	// search_box() carries the current orderby and order across by itself.
	?>
<form class="search-form wp-clearfix" method="get">
  <input type="hidden" name="page" value="accua_forms_fields" />
  <?php $fields_table->search_box( __( 'Search fields', 'contact-forms' ), 'accua-field' ); ?>
</form>

<form method="get">
  <input type="hidden" name="page" value="accua_forms_fields" />
  <?php if ( '' !== $accua_fields_search ) : ?>
  <?php // Keeps the search when a bulk action or a page link is used. ?>
  <input type="hidden" name="s" value="<?php echo esc_attr( $accua_fields_search ); ?>" />
  <?php endif; ?>
  <?php $fields_table->display(); ?>
</form>
<?php } ?>

</div>
</div><!-- /col-right -->

<div id="col-left">
<div class="col-wrap">

<?php
$types = accua_forms_fields_get_types();
if ( ! isset( $types[ $default_form_values['type'] ] ) ) {
	// The field's type is not currently registered (deactivated extension
	// plugin or legacy type). Keep it selectable so saving the field does not
	// silently fall back to the first option and overwrite the type.
	/* translators: %s is the raw field type key */
	$types[ $default_form_values['type'] ] = esc_html( sprintf( __( '%s (currently not registered)', 'contact-forms' ), $default_form_values['type'] ) );
}
?>
<div class="form-wrap">
<h3><?php
if ( $adding ) {
	esc_html_e( 'Add new field', 'contact-forms' );
} else {
	/* translators: %s is the field slug */
	echo esc_html( sprintf( __( 'Edit field: %s', 'contact-forms' ), $default_form_values['id'] ) );
}
?></h3>
<form id="addtag" method="post" action="admin.php?page=accua_forms_fields" class="validate">
<input type="hidden" name="action" value="<?php echo $adding ? 'add' : 'edit'; ?>-form-field" />
<?php wp_nonce_field( 'edit_form_field', '_wpnonce_edit_form_field' ); ?>

<div class="form-field form-required">
  <label for="tag-name"><?php esc_html_e( 'Field label', 'contact-forms' ); ?></label>
  <input name="form-field-name" id="tag-name" type="text" value="<?php echo esc_attr( $default_form_values['name'] ); ?>" size="40" aria-required="true" aria-describedby="field-name-help" />
  <p id="field-name-help"><?php esc_html_e( 'The name is how it appears on your site.', 'contact-forms' ); ?></p>
</div>
<div class="form-field<?php echo $adding ? ' form-required' : ''; ?>">
  <label for="tag-slug"><?php esc_html_e( 'Field slug (identifier)', 'contact-forms' ); ?></label>
  <input name="form-field-id" id="tag-slug" type="text" value="<?php echo esc_attr( $default_form_values['id'] ); ?>" <?php if ( ! $adding ) { echo 'disabled="disabled"'; } ?> size="40" <?php if ( $adding ) { echo 'aria-required="true"'; } ?> aria-describedby="slug-feedback field-slug-help" />
  <?php if ( ! $adding ) { echo '<input type="hidden" name="form-field-id" value="' . esc_attr( $default_form_values['id'] ) . '" />'; } ?>
  <p id="slug-feedback" class="accua-slug-feedback" aria-live="polite" hidden></p>
  <p id="field-slug-help"><?php esc_html_e( 'The &#8220;slug&#8221; is the URL-friendly version of the name, used as the unique identifier of the field. It is lowercase, must contain only letters, numbers, hyphens and underscores, and cannot be changed once the field exists: it is the key every form and every stored submission refers to.', 'contact-forms' ); ?></p>
</div>
<div class="form-field">
  <label for="parent"><?php esc_html_e( 'Field type', 'contact-forms' ); ?></label>
  <select class="postform" id="parent" name="form-field-type">
  <?php
	foreach ( $types as $typeid => $typename ) {
		$selected = ( $default_form_values['type'] == $typeid ) ? 'selected="selected"' : '';
		// phpcs:disable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped
		echo <<<EOT
<option value="{$typeid}" class="level-0" {$selected} >{$typename}</option>
EOT;
		// phpcs:enable PluginCheck.CodeAnalysis.Heredoc.NotAllowed, WordPress.Security.EscapeOutput.HeredocOutputNotEscaped
	}
	?>
  </select>
</div>
<div class="form-field">
  <label for="tag-description"><?php esc_html_e( 'Field description', 'contact-forms' ); ?></label>
  <textarea name="form-field-description" id="tag-description" rows="5" cols="40" aria-describedby="field-description-help"><?php echo esc_textarea( $default_form_values['description'] ); ?></textarea>
  <p id="field-description-help"><?php esc_html_e( 'The description is not prominent by default; however, some themes may show it.', 'contact-forms' ); ?></p>
</div>

<div class="form-field" id="field-section-default-value">
   <label for="form-field-default-value" id="default-value-label"><?php esc_html_e( 'Default value(s)', 'contact-forms' ); ?>:</label>
   <textarea name="form-field-default-value" id="form-field-default-value" rows="5" cols="40" aria-describedby="default-value-help"><?php echo esc_textarea( $default_form_values['default_value'] ); ?></textarea>
   <p id="default-value-help"><?php esc_html_e( 'For multiple default values in multiple select and multiple checkboxes, use | as separator.', 'contact-forms' ); ?></p>
</div>

<div class="form-field" id="field-section-allowed-values">
   <label for="form-field-allowed-values" id="allowed-values-label"><?php esc_html_e( 'Allowed values', 'contact-forms' ); ?>:</label>
    <textarea rows="5" cols="40" name="form-field-allowed-values" id="form-field-allowed-values" aria-describedby="allowed-values-help"><?php echo esc_textarea( $default_form_values['allowed_values'] ); ?></textarea>
    <p id="allowed-values-help"><?php esc_html_e( 'Options used in select, radio and multiple checkboxes. Enter one value per line, in the format key|label. The key is the value that will be stored in the database. The label is optional, and the key will be used as the label if no label is specified. For file fields, this indicates allowed extensions (one per line without dot)', 'contact-forms' ); ?></p>
</div>

<div class="form-field" id="field-section-date">
<strong><?php esc_html_e( 'Settings for date fields', 'contact-forms' ); ?></strong>
<div class="form-field">
   <label for="form-field-default-date-value"><?php esc_html_e( 'Default value', 'contact-forms' ); ?>:</label>
   <input type="date" name="form-field-default-date-value" id="form-field-default-date-value" value="<?php echo esc_attr( $default_form_values['default_date_value'] ); ?>">
</div>

<label for="form-field-min-of-date"><?php esc_html_e( 'Min date', 'contact-forms' ); ?>:</label>
<input type="date" id="form-field-min-of-date" name="form-field-min-of-date" value="<?php echo esc_attr( $default_form_values['min_date'] ); ?>">

<label for="form-field-max-of-date"><?php esc_html_e( 'Max date', 'contact-forms' ); ?>:</label>
<input type="date" id="form-field-max-of-date" name="form-field-max-of-date" value="<?php echo esc_attr( $default_form_values['max_date'] ); ?>">

</div>

<div class="form-field" id="field-section-custom-required">
  <label for="form-field-custom-required-message"><?php esc_html_e( 'Custom required message', 'contact-forms' ); ?></label>
  <input name="form-field-custom-required-message" id="form-field-custom-required-message" type="text" value="<?php echo esc_attr( $default_form_values['custom_required_message'] ); ?>" aria-describedby="custom-required-help" />
  <?php // translators: %s is the field name/label placeholder ?>
  <p id="custom-required-help"><?php esc_html_e( 'Overrides the default "required" error message for this field. Use %s for the field name. Leave blank to use the default translated message.', 'contact-forms' ); ?></p>
</div>

<div class="form-field" id="field-section-custom-format">
  <label for="form-field-custom-format-message"><?php esc_html_e( 'Custom format message', 'contact-forms' ); ?></label>
  <input name="form-field-custom-format-message" id="form-field-custom-format-message" type="text" value="<?php echo esc_attr( $default_form_values['custom_format_message'] ); ?>" aria-describedby="custom-format-help" />
  <?php // translators: %s is the field name/label placeholder ?>
  <p id="custom-format-help"><?php esc_html_e( 'Overrides the default format error message for email and telephone fields. Use %s for the field name. Leave blank to use the default translated message.', 'contact-forms' ); ?></p>
</div>

<?php // Last on purpose, behind an hr: an admin-list-only setting with no effect on how the field renders in forms - kept apart from the settings above, which all shape the field itself. ?>
<div class="form-field" id="field-section-essential-column">
  <hr />
  <label for="form-field-essential-column">
    <input name="form-field-essential-column" id="form-field-essential-column" type="checkbox" value="1"<?php checked( ! empty( $default_form_values['essential_column'] ) ); ?> aria-describedby="essential-column-help" />
    <?php esc_html_e( 'Show in essential columns', 'contact-forms' ); ?>
  </label>
  <p id="essential-column-help"><?php esc_html_e( 'The "Essential Columns" button on the submissions list hides every column except the essential ones: ID, Actions, Form, Submitted, and the fields with this option enabled. Enable it for the fields you want to keep visible in that compact view.', 'contact-forms' ); ?></p>
</div>

<?php
	if ( $adding ) {
		// Primary like the core taxonomy screens (edit-tags.php uses
		// 'primary' for Add New Category / Update).
		submit_button( __( 'Add new field', 'contact-forms' ), 'primary' );
	} else {
		submit_button( __( 'Save changes', 'contact-forms' ), 'primary' );
		submit_button( __( 'Delete field', 'contact-forms' ), 'button-link-delete', 'delete-field' );
	}
	?>
</form>
</div>

</div>
</div><!-- /col-left -->

</div><!-- /col-container -->
</div><!-- /wrap -->
<?php
}

/**
 * AJAX: render the live preview for the field being added/edited on the
 * Fields page.
 *
 * The submitted (possibly unsaved) settings run through the same
 * accua_forms_fields_filter_values() used on save, and the field is rendered
 * through the real frontend pipeline (AccuaForm + accua_forms_form_generate)
 * as the only field of a synthetic form using the site's default form
 * settings - exactly how the field would look freshly added to a new form.
 * Nothing is written to the database: the definition is injected with an
 * option filter and the one-field form with a transient pre-filter.
 *
 * @since 2.2.45
 */
function accua_forms_field_preview() {
	if ( ! current_user_can( 'manage_options' ) ) {
		die( '' );
	}

	$nonce = isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '';
	if ( ! wp_verify_nonce( $nonce, 'accua_forms_field_preview' ) ) {
		wp_die( esc_html__( 'Security check failed.', 'contact-forms' ), 403 );
	}

	$post = stripslashes_deep( $_POST );
	$post += array(
		'form-field-id'                    => '',
		'form-field-name'                  => '',
		'form-field-type'                  => 'textfield',
		'form-field-description'           => '',
		'form-field-default-value'         => '',
		'form-field-default-date-value'    => '',
		'form-field-allowed-values'        => '',
		'form-field-min-of-date'           => '',
		'form-field-max-of-date'           => '',
		'form-field-custom-required-message' => '',
		'form-field-custom-format-message' => '',
		'form-field-essential-column'      => '',
	);

	// Passing the submitted type as $old_data keeps unregistered types
	// (deactivated extension plugins, legacy types) renderable in the preview
	// instead of falling back to textfield, mirroring the edit-form behavior.
	$filtered   = accua_forms_fields_filter_values( $post, array( 'type' => $post['form-field-type'] ) );
	$field_data = $filtered['data'];

	// Reserved slug: real slugs cannot start with two underscores.
	$preview_slug     = '__accua-field-preview';
	$field_data['id'] = $preview_slug;

	$inject_definition = function ( $fields ) use ( $preview_slug, $field_data ) {
		if ( ! is_array( $fields ) ) {
			$fields = array();
		}
		$fields[ $preview_slug ] = $field_data;
		return $fields;
	};
	add_filter( 'option_accua_forms_avail_fields', $inject_definition );
	add_filter( 'default_option_accua_forms_avail_fields', $inject_definition );

	// A synthetic one-field draft. The instance is marked required and the
	// form uses AJAX on purpose: that emits the client-side validation, so
	// the preview also demonstrates the validation messages (leave the field
	// empty and click elsewhere) including the custom required/format
	// messages being edited. A script printed below prevents the form from
	// ever actually submitting.
	add_filter( 'pre_transient_' . _accua_forms_get_draft_key( $preview_slug ), function () use ( $preview_slug ) {
		return array(
			'fields'   => array(
				array(
					'ref'      => $preview_slug,
					'required' => true,
				),
			),
			'use_ajax' => true,
		);
	} );

	add_filter( 'accua_forms_use_draft_for_preview', '__return_true' );
	add_filter( 'accua_forms_preview_suppress_auto_submit', '__return_true' );
	// admin-ajax is an admin context, but the preview must mirror the
	// frontend (e.g. the colorpicker renders a native color input there).
	add_filter( 'accua_forms_preview_render_as_frontend', '__return_true' );

	// Enqueue form styles before printing them
	accua_form_enqueue_scripts_and_styles();

	// Same default-layout resolution as the frontend shortcode handler.
	$default_form_data = get_option( 'accua_forms_default_form_data', array() );
	$layout            = ! empty( $default_form_data['layout'] ) ? $default_form_data['layout'] : 'sidebyside';

	$form     = AccuaForm::create( '__accua-form__' . $preview_slug, array(
		'layout' => $layout,
		'title'  => '',
	) );
	$rendered = $form->render( true );

	// Fields with no visible output (hidden inputs, captchas rendering an
	// HTML-comment placeholder when unconfigured) would show an empty box:
	// detect them and explain instead. Comments are stripped first;
	// wp_strip_all_tags() also drops script/style blocks with their content.
	// No iframe in the element list: the AJAX machinery prints its own
	// (invisible) submit-target iframe, and real captcha iframes are
	// injected client-side into markup that already carries a label.
	$stripped    = preg_replace( '/<!--.*?-->/s', '', $rendered );
	$has_visible = preg_match( '/<(?:select|textarea|button|label|legend|img|input(?![^>]*type=["\']?hidden))/i', $stripped )
		|| trim( wp_strip_all_tags( $stripped ) ) !== '';

	// The doctype matters: without it the iframe document renders in Quirks
	// Mode (jQuery is explicitly unsupported there, and layout metrics differ).
	echo '<!DOCTYPE html><html><head>
  <style>
    *, *::before, *::after { box-sizing: border-box; }
    /* The parent frame is sized to fit this document and animates height
       changes, so a scrollbar would only flash during the animation;
       fields-page.js re-enables scrolling if the content ever exceeds the
       frame height cap. */
    html { overflow: hidden; }
    body {
      font-family: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;
      margin: 0;
      padding: 16px;
      background: #fff;
      font-size: 14px;
      line-height: 1.5;
    }
    .accua-field-preview-empty { color: #50575e; margin: 0 0 12px; }
  </style>';
	accua_forms_prepare_emoji_styles_for_preview();
	wp_print_styles();
	wp_print_head_scripts();
	echo '</head><body>';
	if ( ! $has_visible ) {
		echo '<p class="accua-field-preview-empty">' . esc_html__( 'This field has no visible output on the page with the current settings (hidden fields, or captcha fields whose keys are not configured).', 'contact-forms' ) . '</p>';
	}
	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Form render manages its own escaping
	echo $rendered;
	wp_print_footer_scripts();

	// The preview validates like a real form (the field is marked required
	// for demonstration) but must never actually submit: wrap the generated
	// submit handler so a passing validation shows a note instead.
	$preview_note = wp_json_encode( '<p>' . esc_html__( 'This is a preview: the form is not actually submitted.', 'contact-forms' ) . '</p>' );
	echo '<script>
	jQuery(function() {
		var form = document.querySelector("form.accua-form");
		if (!form) { return; }
		var orig = form.onsubmit;
		form.onsubmit = function() {
			var ret = true;
			if (orig) { try { ret = orig.call(this); } catch (e) { ret = false; } }
			if (ret !== false) {
				var summary = form.querySelector(".pfbc-validation-summary");
				if (!summary) {
					summary = document.createElement("div");
					summary.className = "pfbc-validation-summary";
					form.insertBefore(summary, form.firstChild);
				}
				summary.className = "pfbc-validation-summary pfbc-validation-success";
				summary.innerHTML = ' .
				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_json_encode() of an esc_html__'d string, printed into a script context.
				$preview_note . ';
			}
			return false;
		};
	});
	</script>';
	echo '</body></html>';
	die( '' );
}
add_action( 'wp_ajax_accua_forms_field_preview', 'accua_forms_field_preview' );