class-insert-rule-data.php

<?php
/**
 * Inserts rule data about a post to the database
 *
 * @since 1.10.0
 *
 * @package Accessibility_Checker
 */

namespace EDAC\Admin;

/**
 * Class for inserting rule data into the database
 *
 * The unique identifier for issues changed in version 1.0.5 of the database schema.
 * Previously, issues were identified by: postid + rule + object + type + siteid
 * Now, issues are identified by: postid + rule + selector + type + siteid
 *
 * This change allows duplicate code objects (e.g., two empty paragraphs) to be
 * stored as separate issues when they appear in different locations on the page.
 * The selector field provides the unique location identifier for each issue.
 *
 * @since 1.10.0
 */
class Insert_Rule_Data {

	/**
	 * Insert rule data into database
	 *
	 * @since 1.10.0
	 *
	 * @param object      $post              The post object. Must have a valid ID.
	 * @param string      $rule              The rule.
	 * @param string      $ruletype          The rule type.
	 * @param string      $rule_obj          The object.
	 * @param string|null $landmark          The landmark type (main, header, footer, nav), optional.
	 * @param string|null $landmark_selector The landmark selector, optional.
	 * @param array       $selectors         An array of selectors that point to the object, optional.
	 * @param array|null  $extra_data        Optional arbitrary metadata to store as JSON (e.g. color contrast values).
	 *
	 * @return void|int|\WP_Error The ID of the inserted record, void if no
	 * record was inserted or a WP_Error if the insert failed.
	 */
	public function insert( object $post, string $rule, string $ruletype, string $rule_obj, ?string $landmark = null, ?string $landmark_selector = null, array $selectors = [], ?array $extra_data = null ) {

		if ( ! isset( $post->ID, $post->post_type )
			|| empty( $rule )
			|| empty( $ruletype )
			|| empty( $rule_obj )
		) {
			return;
		}

		global $wpdb;
		$table_name = $wpdb->prefix . 'accessibility_checker';

		// set up rule data array.
		$rule_data = [
			'postid'            => $post->ID,
			'siteid'            => get_current_blog_id(),
			'type'              => $post->post_type,
			'landmark'          => $landmark,
			'landmark_selector' => $landmark_selector,
			'selector'          => $selectors['selector'][0] ?? null,
			'ancestry'          => $selectors['ancestry'][0] ?? null,
			'xpath'             => $selectors['xpath'][0] ?? null,
			'rule'              => $rule,
			'ruletype'          => $ruletype,
			'object'            => esc_attr( $rule_obj ),
			'extra_data'        => $extra_data,
			'source'            => 'automated',
			'recordcheck'       => 1,
			'user'              => get_current_user_id(),
			'ignre'             => 0,
			'ignre_user'        => null,
			'ignre_date'        => null,
			'ignre_comment'     => null,
			'ignre_global'      => 0,
		];

		// return if revision.
		if ( 'revision' === $rule_data['type'] ) {
			return;
		}

		// Check if exists.
		// Use selector as the unique identifier instead of object to allow duplicate code objects
		// with different selectors (e.g., two empty paragraphs in different locations).
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Using direct query for adding data to database, caching not required for one time operation.
		$results = $wpdb->get_results(
			$wpdb->prepare(
				"SELECT postid, ignre FROM %i WHERE type = %s AND postid = %d AND rule = %s AND selector = %s AND siteid = %d AND (source = 'automated' OR source IS NULL)",
				$table_name,
				$rule_data['type'],
				$rule_data['postid'],
				$rule_data['rule'],
				$rule_data['selector'],
				$rule_data['siteid']
			),
			ARRAY_A
		);

		// Loop existing records.
		if ( $results ) {
			foreach ( $results as $row ) {

				// if being ignored, don't overwrite value.
				if ( true === (bool) $row['ignre'] ) {
					$rule_data['ignre'] = 1;
				}

				// update existing record.
				// Use selector for WHERE clause instead of object to match on unique identifier.
				// Using wpdb->update() (not raw prepare/query) so that null extra_data is emitted
				// as SQL NULL rather than '' — wpdb->prepare('%s', null) coerces null to ''.
				// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Direct update; caching not required for a write operation.
				$wpdb->update(
					$table_name,
					[
						'recordcheck'       => 1,
						'landmark'          => $rule_data['landmark'],
						'landmark_selector' => $rule_data['landmark_selector'],
						'object'            => $rule_data['object'],
						'ancestry'          => $rule_data['ancestry'],
						'xpath'             => $rule_data['xpath'],
						'ignre'             => $rule_data['ignre'],
						'extra_data'        => self::encode_extra_data( is_array( $rule_data['extra_data'] ) ? $rule_data['extra_data'] : null ),
						'source'            => 'automated',
					],
					[
						'siteid'   => $rule_data['siteid'],
						'postid'   => $rule_data['postid'],
						'rule'     => $rule_data['rule'],
						'selector' => $rule_data['selector'],
						'type'     => $rule_data['type'],
					]
				);

			}
		}

		// Insert new records.
		if ( ! $results ) {

			/**
			 * Filter the rule data before inserting it into the database.
			 *
			 * This data will be sanitized after the filter is applied.
			 *
			 * @since 1.4.0
			 *
			 * @param array $rule_data The rule data.
			 */
			$rule_data = apply_filters( 'edac_filter_insert_rule_data', $rule_data );

			// Resolve extra_data: keep raw array from this method, but a filter may have set it
			// to a JSON string — decode in that case before re-encoding through encode_extra_data().
			$extra_data_raw = $rule_data['extra_data'] ?? null;
			if ( is_string( $extra_data_raw ) ) {
				$extra_data_raw = json_decode( $extra_data_raw, true );
			}

			// Sanitize rule data since it is filtered, and we can't be sure
			// the data is still as valid as it was when it was first set.
			// Sanitize the filtered data.
			$rule_data_sanitized = [
				'postid'            => absint( $rule_data['postid'] ),
				'siteid'            => absint( $rule_data['siteid'] ),
				'type'              => sanitize_text_field( $rule_data['type'] ),
				'landmark'          => isset( $rule_data['landmark'] ) ? sanitize_text_field( $rule_data['landmark'] ) : null,
				'landmark_selector' => isset( $rule_data['landmark_selector'] ) ? sanitize_text_field( $rule_data['landmark_selector'] ) : null,
				'selector'          => sanitize_text_field( $rule_data['selector'] ?? '' ),
				'ancestry'          => sanitize_text_field( $rule_data['ancestry'] ?? '' ),
				'xpath'             => sanitize_text_field( $rule_data['xpath'] ?? '' ),
				'rule'              => sanitize_text_field( $rule_data['rule'] ),
				'ruletype'          => sanitize_text_field( $rule_data['ruletype'] ),
				'object'            => esc_attr( $rule_data['object'] ),
				'extra_data'        => self::encode_extra_data( is_array( $extra_data_raw ) ? $extra_data_raw : null ),
				'source'            => 'automated',
				'recordcheck'       => absint( $rule_data['recordcheck'] ),
				'user'              => absint( $rule_data['user'] ),
				'ignre'             => absint( $rule_data['ignre'] ),
				'ignre_user'        => isset( $rule_data['ignre_user'] ) ? absint( $rule_data['ignre_user'] ) : null,
				'ignre_date'        => isset( $rule_data['ignre_date'] ) ? sanitize_text_field( $rule_data['ignre_date'] ) : null,
				'ignre_comment'     => isset( $rule_data['ignre_comment'] ) ? null : null,
				'ignre_global'      => absint( $rule_data['ignre_global'] ),
			];

			if ( isset( $rule_data['ignre_comment'] ) ) {
				$allowed_html = [
					'strong' => [],
					'b'      => [],
					'em'     => [],
					'i'      => [],
					'a'      => [
						'href'   => true,
						'target' => true,
						'rel'    => true,
					],
				];
				
				$rule_data_sanitized['ignre_comment'] = esc_html( wp_kses( $rule_data['ignre_comment'], $allowed_html ) );
			}

			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- Using direct query for adding data to database.
			$wpdb->insert( $table_name, $rule_data_sanitized );

			// Return insert id or error.
			return $wpdb->insert_id;
		}
	}

	/**
	 * Recursively sanitizes an array and returns it as a JSON string.
	 *
	 * String values are passed through sanitize_text_field(); numeric and boolean
	 * values are left as-is so they round-trip cleanly through JSON.
	 *
	 * @param array|null $data The extra data array to encode.
	 * @return string|null JSON-encoded sanitized data, or null if input is empty or encoding fails.
	 */
	private static function encode_extra_data( ?array $data ): ?string {
		if ( ! $data ) {
			return null;
		}
		array_walk_recursive(
			$data,
			function ( &$value ) {
				if ( is_string( $value ) ) {
					$value = sanitize_text_field( $value );
				}
			}
		);
		$encoded = wp_json_encode( $data );
		return false !== $encoded ? $encoded : null;
	}
}