<?php

declare(strict_types=1);

namespace PpPhp\Plugins;

use PpPhp\Core\EditPlugin;
use PpPhp\Core\PluginSupport;

/**
 * Masked password input. Never echoes the stored value back into the field, and
 * uses autocomplete="new-password" so browsers don't autofill the wrong secret.
 * Hashing/encryption is the field's responsibility, not the control's.
 */
class Password implements EditPlugin
{
    use PluginSupport;

    public static function id(): string { return 'Password'; }
    public static function label(): string { return 'Password'; }
    public static function version(): string { return '1.1.0'; }
    public static function description(): string { return 'A masked password input (never pre-fills the stored value).'; }

    public static function render(string $fieldName, mixed $value, array $settings): string
    {
        $name = self::e($fieldName);
        $ph   = self::e($settings['placeholder'] ?? '');
        return '<input type="password" name="' . $name . '" id="field_' . $name . '" class="form-control"'
            . ' autocomplete="new-password"' . ($ph !== '' ? ' placeholder="' . $ph . '"' : '') . '>';
    }

    public static function settingsSchema(): array
    {
        return [['key' => 'placeholder', 'type' => 'text', 'label' => 'Placeholder', 'default' => '']];
    }

    public static function assets(): array { return ['js' => [], 'css' => []]; }
}
