<?php

declare(strict_types=1);

namespace PpPhp\Plugins;

use PpPhp\Core\Html\Sanitizer;
use PpPhp\Core\ViewPlugin;

/**
 * Renders a field's stored HTML — SANITISED through the allowlist Sanitizer, so
 * common formatting (bold, links, lists, tables…) survives but scripts, event
 * handlers, styles and javascript:/data: URLs are stripped. Field values can come
 * from end users, so raw output would be a stored-XSS vector.
 */
class HTML implements ViewPlugin
{
    public static function id(): string { return 'HTML'; }
    public static function label(): string { return 'HTML'; }
    public static function version(): string { return '1.1.0'; }
    public static function description(): string { return 'Displays stored HTML, sanitised to a safe allowlist (no scripts, event handlers, or unsafe URLs).'; }

    public static function render(mixed $value, array $settings): string
    {
        $html = (string) ($value ?? '');
        if (trim($html) === '') return '';
        return Sanitizer::clean($html);
    }

    public static function settingsSchema(): array { return []; }
    public static function assets(): array { return ['js' => [], 'css' => []]; }
}
