Skip to content
← Back to Functions
Code

Template Token Auditor

Scans templates and controller variable maps for missing, unused, or leaked tokens.

Function signature

ogAuditTemplateTokens(templates = array(), token_map = array(), required_tokens = array())

Categories

  • Security

Parameters

templatesToken-only template contents keyed by template name.token_mapController-supplied token map keyed by token name.required_tokensTokens that must be present for the template contract to pass.

Return value

Public-safe status string returned by the function for explicit controller branching or logging.

  • success
  • message
  • data

Compatibility

Existing function name, slug, path, and call order preserved; advertised metadata corrected to the actual source behavior.

Minimum PHP version: 7.4

Security notes

Use caller-owned allowlists and context-specific escaping; validate admin actions, export fields, privacy plans, cache keys, templates, settings, routes, and ecommerce policies before production use.

Code

<?php

/*
 * Copyright (c) 2026 Jeffery L. Paris <jparis@phpog.com>.
 * Free for personal and internal use. Paid project use requires visible credit
 * to Jeffery L. Paris. Corporate use requires a paid license fee unless a
 * separate written license states otherwise.
 */

/**
 * Audits template tokens against a supplied token map and required token list.
 *
 * This function supports token-only templates by finding leaked, missing, unused,
 * and undeclared tokens before deployment.
 *
 * @param array $templates Template name to template contents map.
 * @param array $token_map Available token values keyed by token name.
 * @param array $required_tokens Required token names.
 * @return array Template token audit report.
 */
function ogAuditTemplateTokens($templates = array(), $token_map = array(), $required_tokens = array()) {
	$result = array(
		'success' => false,
		'message' => '',
		'data' => array()
	);

	if (!is_array($templates)) {
		$result['message'] = 'Templates must be an array.';
		return $result;
	}
	if (!is_array($token_map)) {
		$token_map = array();
	}
	if (!is_array($required_tokens)) {
		$required_tokens = array();
	}

	$found_tokens = array();
	$template_tokens = array();
	foreach ($templates as $template_name => $template_contents) {
		$template_name = (string)$template_name;
		$template_contents = (string)$template_contents;
		$matches = array();
		preg_match_all('/\{([a-zA-Z0-9_]+)\}/', $template_contents, $matches);
		$template_tokens[$template_name] = array();
		if (!empty($matches[1])) {
			foreach ($matches[1] as $token) {
				$found_tokens[$token] = $token;
				$template_tokens[$template_name][$token] = $token;
			}
		}
		$template_tokens[$template_name] = array_values($template_tokens[$template_name]);
	}

	$available_tokens = array_keys($token_map);
	$missing_required = array();
	foreach ($required_tokens as $token) {
		$token = (string)$token;
		if (!array_key_exists($token, $token_map)) {
			$missing_required[] = $token;
		}
	}

	$undeclared_tokens = array_values(array_diff(array_values($found_tokens), $available_tokens));
	$unused_tokens = array_values(array_diff($available_tokens, array_values($found_tokens)));

	$result['success'] = true;
	$result['message'] = 'Template token audit completed.';
	$result['data'] = array(
		'template_tokens' => $template_tokens,
		'missing_required_tokens' => $missing_required,
		'undeclared_template_tokens' => $undeclared_tokens,
		'unused_supplied_tokens' => $unused_tokens,
		'passes' => empty($missing_required) && empty($undeclared_tokens)
	);

	return $result;
}