<?php
/**
 * Control 5 — accounts holding a listed capability (SPEC row 5).
 *
 * A privileged account without a suspect finding comes out as the member code
 * privileged_user; PassAccumulator folds those into one "to identify" line.
 * Silent on purpose (SPEC muette, reported): orphan metadata rows that do not
 * give the administrator role.
 *
 * @package Timaub\AfterHackChecklist
 */

namespace Timaub\AfterHackChecklist\Domain\Rules;

use Timaub\AfterHackChecklist\Domain\Assumptions;
use Timaub\AfterHackChecklist\Domain\Context;
use Timaub\AfterHackChecklist\Domain\Finding;
use Timaub\AfterHackChecklist\Domain\UserEntry;

final class UserRules {

	/** @return Finding[] */
	public static function inspect( UserEntry $u, Context $ctx ): array {
		$roles = array();
		$own   = array();
		foreach ( $u->capabilities as $key => $granted ) {
			if ( ! $granted ) {
				continue;
			}
			if ( isset( $ctx->roles[ $key ] ) ) {
				$roles[] = (string) $key;
			} else {
				$own[] = (string) $key;
			}
		}
		if ( ! $u->exists ) {
			if ( ! empty( $u->capabilities['administrator'] ) ) {
				return array( Finding::make( 'user_orphan_admin', 'ID ' . $u->id, array( (string) $u->id ) ) );
			}
			return array();
		}
		$fromRoles = array();
		foreach ( $roles as $r ) {
			$fromRoles = array_merge( $fromRoles, $ctx->roleCaps( $r ) );
		}
		$effective = array_unique( array_merge( $fromRoles, $own ) );
		$listed    = array_intersect( Assumptions::CAPS, $effective );
		if ( ! $u->isSuperAdmin && ! $listed ) {
			return array();
		}
		$out = array();
		if ( '' !== $ctx->referenceDate && strcmp( substr( $u->registered, 0, 10 ), $ctx->referenceDate ) >= 0 ) {
			$out[] = Finding::make( 'user_registered_after', $u->login, array( $u->login, (string) $u->id, $u->registered, $ctx->referenceDate ) );
		}
		$outside = array_values( array_diff( array_intersect( Assumptions::CAPS, $own ), $fromRoles ) );
		if ( $outside ) {
			$out[] = Finding::make( 'user_cap_outside_role', $u->login, array( $u->login, (string) $u->id, implode( ', ', $outside ), $roles ? implode( ', ', $roles ) : 'none' ) );
		}
		if ( ! $out ) {
			$out[] = Finding::make( 'privileged_user', $u->login, array( $u->login, (string) $u->id, $u->registered ) );
		}
		return $out;
	}
}