Read-Only Custom Fields Viewer for Administrators

// Who can see the box.
$wpide_meta_viewer_capability = 'manage_options';

// Also list hidden keys that start with an underscore (used by WordPress and plugins).
$wpide_meta_viewer_show_hidden = true;

// Post types that get the box. Leave empty for every post type with an edit screen.
$wpide_meta_viewer_post_types = array();

$wpide_meta_viewer_value = function ( $value ) {
    $value = (string) $value;

    if ( '' === $value ) {
        return '<em>(empty)</em>';
    }

    // Serialized data is unpacked for reading only. Objects are never rebuilt.
    if ( is_serialized( $value ) ) {
        $data = @unserialize( trim( $value ), array( 'allowed_classes' => false ) ); // phpcs:ignore WordPress.PHP.NoSilencedErrors, WordPress.PHP.DiscouragedPHPFunctions

        if ( false !== $data || 'b:0;' === trim( $value ) ) {
            return '<span class="wpide-meta-viewer__type">serialized ' . esc_html( gettype( $data ) ) . '</span><pre>' . esc_html( print_r( $data, true ) ) . '</pre>'; // phpcs:ignore WordPress.PHP.DevelopmentFunctions
        }
    }

    $first = substr( ltrim( $value ), 0, 1 );

    if ( '{' === $first || '[' === $first ) {
        $data = json_decode( $value, true );

        if ( null !== $data ) {
            return '<span class="wpide-meta-viewer__type">JSON</span><pre>' . esc_html( (string) wp_json_encode( $data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE ) ) . '</pre>';
        }
    }

    return '<pre>' . esc_html( $value ) . '</pre>';
};

$wpide_meta_viewer_render = function ( $post ) use ( $wpide_meta_viewer_show_hidden, $wpide_meta_viewer_value ) {
    $meta = get_post_meta( $post->ID );
    $meta = is_array( $meta ) ? $meta : array();

    if ( ! $wpide_meta_viewer_show_hidden ) {
        $meta = array_filter( $meta, function ( $key ) {
            return ! is_protected_meta( $key, 'post' );
        }, ARRAY_FILTER_USE_KEY );
    }

    uksort( $meta, 'strnatcasecmp' );

    if ( ! $meta ) {
        echo '<p>This post has no custom fields.</p>';
        return;
    }

    ?>
    <style>
        .wpide-meta-viewer { table-layout: fixed; }
        .wpide-meta-viewer th:first-child { width: 30%; }
        .wpide-meta-viewer td { vertical-align: top; overflow-wrap: anywhere; }
        .wpide-meta-viewer pre { margin: 0; max-height: 240px; overflow: auto; white-space: pre-wrap; word-break: break-word; font-size: 12px; }
        .wpide-meta-viewer__type { display: inline-block; margin-bottom: 4px; padding: 0 6px; border-radius: 3px; background: #f0f0f1; color: #50575e; font-size: 11px; }
        .wpide-meta-viewer-filter { margin: 4px 0 8px; }
    </style>
    <p class="wpide-meta-viewer-filter">
        <label for="wpide-meta-viewer-search"><?php echo esc_html( sprintf( '%d keys. Filter by key:', count( $meta ) ) ); ?></label>
        <input type="search" id="wpide-meta-viewer-search" class="regular-text">
    </p>
    <table class="widefat striped wpide-meta-viewer">
        <thead><tr><th scope="col">Key</th><th scope="col">Value</th></tr></thead>
        <tbody>
        <?php foreach ( $meta as $key => $values ) : ?>
            <?php foreach ( (array) $values as $value ) : ?>
                <tr data-key="<?php echo esc_attr( strtolower( $key ) ); ?>">
                    <td><code><?php echo esc_html( $key ); ?></code></td>
                    <td><?php echo $wpide_meta_viewer_value( $value ); // phpcs:ignore WordPress.Security.EscapeOutput -- escaped when built. ?></td>
                </tr>
            <?php endforeach; ?>
        <?php endforeach; ?>
        </tbody>
    </table>
    <script>
    ( function () {
        var search = document.getElementById( 'wpide-meta-viewer-search' );
        if ( ! search ) { return; }
        search.addEventListener( 'input', function () {
            var term = search.value.trim().toLowerCase();
            document.querySelectorAll( '.wpide-meta-viewer tbody tr' ).forEach( function ( row ) {
                row.hidden = term !== '' && row.getAttribute( 'data-key' ).indexOf( term ) === -1;
            } );
        } );
    } )();
    </script>
    <?php
};

add_action( 'add_meta_boxes', function ( $post_type, $post ) use ( $wpide_meta_viewer_capability, $wpide_meta_viewer_post_types, $wpide_meta_viewer_render ) {
    if ( ! $post instanceof WP_Post || ! current_user_can( $wpide_meta_viewer_capability ) ) {
        return;
    }

    if ( $wpide_meta_viewer_post_types && ! in_array( $post_type, $wpide_meta_viewer_post_types, true ) ) {
        return;
    }

    add_meta_box( 'wpide-post-meta-viewer', 'All Custom Fields (read-only)', $wpide_meta_viewer_render, $post_type, 'normal', 'low' );
}, 10, 2 );