<?php
/**
 * Who may use search and chat, and which content is members-only.
 *
 * Access rules decide who is shown the search upgrade and the chat
 * (everyone, logged-in users, chosen roles). Members-only content gives
 * items a visibility of their own; the AskMyPages service returns those
 * items only to a viewer whose signed member token carries an allowed
 * role, in search and in chat alike.
 *
 * @package AskMyPages
 */

namespace AskMyPages;

defined( 'ABSPATH' ) || exit;

/**
 * Access rules and members-only content.
 */
class Access {

	// Rules per feature: for search and for chat, who may use it and which roles.
	const OPT_RULES = 'askmypages_access_rules';
	// Members-only settings: on or off, private pages included, category ids, roles.
	const OPT_MEMBERS = 'askmypages_members';
	// Per item: 'members' or 'roles' (absent = public, or inherited).
	const META_VISIBILITY = '_askmypages_visibility';
	const META_ROLES      = '_askmypages_roles';
	// Must match the service (access/member-token.ts).
	const TOKEN_PREFIX  = 'hookandplug-member:v1:';
	const TOKEN_SECONDS = 3600;

	// Bumped when access settings change: part of every cached document
	// hash's key, so the next check recomputes visibility for every item.
	const OPT_VERSION = 'askmypages_access_version';

	const WHO = array( 'everyone', 'logged_in', 'roles' );

	/**
	 * Registers the save handler.
	 */
	public static function init() {
		add_action( 'admin_post_askmypages_access', array( __CLASS__, 'handle_save' ) );
	}

	/**
	 * The rule for a feature.
	 *
	 * @param string $feature 'search' or 'chat'.
	 * @return array{who:string,roles:string[]}
	 */
	public static function rule( $feature ) {
		$rules = get_option( self::OPT_RULES, null );
		if ( ! is_array( $rules ) ) {
			// Before 0.9.5 the chat had the only rule; search was open to all.
			$old   = get_option( Chat::OPT_ACCESS, array() );
			$rules = array(
				'search' => array(
					'who'   => 'everyone',
					'roles' => array(),
				),
				'chat'   => is_array( $old ) ? $old : array(),
			);
		}
		$rule  = isset( $rules[ $feature ] ) && is_array( $rules[ $feature ] ) ? $rules[ $feature ] : array();
		$who   = in_array( $rule['who'] ?? '', self::WHO, true ) ? $rule['who'] : 'everyone';
		$roles = array_values( array_map( 'sanitize_key', (array) ( $rule['roles'] ?? array() ) ) );
		return array(
			'who'   => 'roles' === $who && ! $roles ? 'logged_in' : $who,
			'roles' => $roles,
		);
	}

	/**
	 * Whether the current visitor may use a feature.
	 *
	 * @param string $feature 'search' or 'chat'.
	 * @return bool
	 */
	public static function allowed( $feature ) {
		$rule = self::rule( $feature );
		if ( 'everyone' === $rule['who'] ) {
			return true;
		}
		if ( ! is_user_logged_in() ) {
			return false;
		}
		if ( 'roles' !== $rule['who'] ) {
			return true;
		}
		return (bool) array_intersect( (array) wp_get_current_user()->roles, $rule['roles'] );
	}

	/**
	 * The current visitor as the service sees them.
	 *
	 * @return array{loggedIn:bool,roles:string[]}
	 */
	public static function viewer() {
		if ( ! is_user_logged_in() ) {
			return array(
				'loggedIn' => false,
				'roles'    => array(),
			);
		}
		return array(
			'loggedIn' => true,
			'roles'    => array_values( array_map( 'sanitize_key', (array) wp_get_current_user()->roles ) ),
		);
	}

	/**
	 * A short-lived token proving the current user's roles to the public
	 * search and chat routes, signed with this site's private key. Empty
	 * for visitors who are not logged in, or when members-only content is
	 * off (nothing to prove).
	 *
	 * @return string
	 */
	public static function member_token() {
		if ( ! is_user_logged_in() || ! self::members_enabled() || ! Keys::is_connected() ) {
			return '';
		}
		$user    = wp_get_current_user();
		$payload = wp_json_encode(
			array(
				'k' => (string) get_option( Keys::OPT_KEY_ID ),
				'r' => array_values( array_map( 'sanitize_key', (array) $user->roles ) ),
				'e' => time() + self::TOKEN_SECONDS,
				'u' => substr( hash( 'sha256', (string) $user->ID . wp_salt( 'auth' ) ), 0, 16 ),
			)
		);
		$body    = self::b64url( $payload );
		$sig     = Keys::sign( self::TOKEN_PREFIX . $body );
		if ( false === $sig ) {
			return '';
		}
		return 'v1.' . $body . '.' . self::b64url( base64_decode( $sig ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- a signature.
	}

	/**
	 * URL-safe base64 without padding.
	 *
	 * @param string $raw Bytes.
	 * @return string
	 */
	private static function b64url( $raw ) {
		return rtrim( strtr( base64_encode( $raw ), '+/', '-_' ), '=' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- token encoding.
	}

	/**
	 * Current access version (see OPT_VERSION).
	 *
	 * @return int
	 */
	public static function version() {
		return (int) get_option( self::OPT_VERSION, 0 );
	}

	/**
	 * Members-only settings.
	 *
	 * @return array{enabled:bool,private:bool,terms:int[],roles:string[]}
	 */
	public static function members() {
		$m = get_option( self::OPT_MEMBERS, array() );
		$m = is_array( $m ) ? $m : array();
		return array(
			'enabled' => ! empty( $m['enabled'] ),
			'private' => ! empty( $m['private'] ),
			'terms'   => array_values( array_filter( array_map( 'absint', (array) ( $m['terms'] ?? array() ) ) ) ),
			'roles'   => array_values( array_map( 'sanitize_key', (array) ( $m['roles'] ?? array() ) ) ),
		);
	}

	/**
	 * Whether members-only content is on and the plan allows it.
	 *
	 * @return bool
	 */
	public static function members_enabled() {
		return self::members()['enabled'] && Chat::feature( 'membersOnly' );
	}

	/**
	 * Whether private and password-protected items are indexed (as
	 * members-only).
	 *
	 * @return bool
	 */
	public static function include_private() {
		return self::members_enabled() && self::members()['private'];
	}

	/**
	 * The visibility an item is sent with: its own mark, else its parent's
	 * (PDFs), else private/password-protected → members, else a members-only
	 * category → the configured roles, else public.
	 *
	 * @param \WP_Post $post Post or attachment.
	 * @return array{visibility:string,roles:string[]}
	 */
	public static function visibility_for( $post ) {
		$public = array(
			'visibility' => 'public',
			'roles'      => array(),
		);
		if ( ! $post instanceof \WP_Post || ! self::members_enabled() ) {
			return $public;
		}
		$own = self::own_mark( $post );
		if ( $own ) {
			return $own;
		}
		if ( 'attachment' === $post->post_type && $post->post_parent ) {
			$parent = get_post( $post->post_parent );
			if ( $parent ) {
				return self::visibility_for( $parent );
			}
			return $public;
		}
		if ( 'private' === $post->post_status || '' !== $post->post_password ) {
			return array(
				'visibility' => 'members',
				'roles'      => array(),
			);
		}
		$m = self::members();
		if ( $m['terms'] && is_object_in_taxonomy( $post->post_type, 'category' ) && has_category( $m['terms'], $post ) ) {
			return $m['roles'] ? array(
				'visibility' => 'roles',
				'roles'      => $m['roles'],
			) : array(
				'visibility' => 'members',
				'roles'      => array(),
			);
		}
		return $public;
	}

	/**
	 * The item's own "Members only" mark from its edit screen, if any.
	 *
	 * @param \WP_Post $post Post.
	 * @return array{visibility:string,roles:string[]}|null
	 */
	private static function own_mark( $post ) {
		$vis = (string) get_post_meta( $post->ID, self::META_VISIBILITY, true );
		if ( 'members' !== $vis && 'roles' !== $vis ) {
			return null;
		}
		$roles = array_values( array_map( 'sanitize_key', (array) get_post_meta( $post->ID, self::META_ROLES, true ) ) );
		return 'roles' === $vis && $roles ? array(
			'visibility' => 'roles',
			'roles'      => $roles,
		) : array(
			'visibility' => 'members',
			'roles'      => array(),
		);
	}

	/**
	 * Saves the Access tab.
	 */
	public static function handle_save() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'You do not have permission to do this.', 'askmypages' ), 403 );
		}
		check_admin_referer( 'askmypages_access' );
		// phpcs:disable WordPress.Security.NonceVerification.Missing -- checked above.
		$valid = array_keys( wp_roles()->get_names() );
		$rules = array();
		foreach ( array( 'search', 'chat' ) as $feature ) {
			$who               = isset( $_POST[ $feature . '_who' ] ) ? sanitize_key( wp_unslash( $_POST[ $feature . '_who' ] ) ) : 'everyone';
			$roles             = isset( $_POST[ $feature . '_roles' ] ) ? array_map( 'sanitize_key', (array) wp_unslash( $_POST[ $feature . '_roles' ] ) ) : array();
			$roles             = array_values( array_intersect( $roles, $valid ) );
			$rules[ $feature ] = array(
				'who'   => in_array( $who, self::WHO, true ) ? ( 'roles' === $who && ! $roles ? 'logged_in' : $who ) : 'everyone',
				'roles' => $roles,
			);
		}
		update_option( self::OPT_RULES, $rules, false );
		$terms  = isset( $_POST['members_terms'] ) ? array_map( 'absint', (array) wp_unslash( $_POST['members_terms'] ) ) : array();
		$mroles = isset( $_POST['members_roles'] ) ? array_map( 'sanitize_key', (array) wp_unslash( $_POST['members_roles'] ) ) : array();
		update_option(
			self::OPT_MEMBERS,
			array(
				'enabled' => isset( $_POST['members_enabled'] ),
				'private' => isset( $_POST['members_private'] ),
				'terms'   => array_values( array_filter( $terms ) ),
				'roles'   => array_values( array_intersect( $mroles, $valid ) ),
			),
			false
		);
		// phpcs:enable WordPress.Security.NonceVerification.Missing
		// Visibility travels with every item: cached hashes are retired and
		// every item is checked again (unchanged ones cost one cheap request).
		update_option( self::OPT_VERSION, self::version() + 1, false );
		if ( Keys::is_connected() ) {
			as_enqueue_async_action( Sync::HOOK_RECONCILE, array(), Sync::GROUP );
		}
		wp_safe_redirect( add_query_arg( 'askmypages_notice', 'access_saved', Admin::tab_url( 'access' ) ) );
		exit;
	}

	/**
	 * The Access tab.
	 */
	public static function render_tab() {
		$paid    = Chat::feature( 'membersOnly' );
		$members = self::members();
		$names   = wp_roles()->get_names();
		$rule    = static function ( $feature, $label, $help ) use ( $names ) {
			$r = self::rule( $feature );
			?>
			<tr>
				<th scope="row"><?php echo esc_html( $label ); ?></th>
				<td><fieldset>
					<label class="amp-choice"><input type="radio" name="<?php echo esc_attr( $feature ); ?>_who" value="everyone" <?php checked( 'everyone', $r['who'] ); ?>> <?php esc_html_e( 'Everyone', 'askmypages' ); ?></label>
					<label class="amp-choice"><input type="radio" name="<?php echo esc_attr( $feature ); ?>_who" value="logged_in" <?php checked( 'logged_in', $r['who'] ); ?>> <?php esc_html_e( 'Only logged-in users', 'askmypages' ); ?></label>
					<label class="amp-choice"><input type="radio" name="<?php echo esc_attr( $feature ); ?>_who" value="roles" <?php checked( 'roles', $r['who'] ); ?>> <?php esc_html_e( 'Only users with these roles', 'askmypages' ); ?></label>
					<div class="amp-roles">
					<?php foreach ( $names as $role => $role_name ) : ?>
						<label><input type="checkbox" name="<?php echo esc_attr( $feature ); ?>_roles[]" value="<?php echo esc_attr( $role ); ?>" <?php checked( in_array( $role, $r['roles'], true ) ); ?>> <?php echo esc_html( translate_user_role( $role_name ) ); ?></label>
					<?php endforeach; ?>
					</div>
					<p class="description"><?php echo esc_html( $help ); ?></p>
				</fieldset></td>
			</tr>
			<?php
		};
		?>
		<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
			<input type="hidden" name="action" value="askmypages_access">
			<?php wp_nonce_field( 'askmypages_access' ); ?>

			<div class="amp-section">
				<h2><?php esc_html_e( 'Who can use it', 'askmypages' ); ?></h2>
				<p class="description"><?php esc_html_e( 'Visitors outside the rule get your theme\'s normal search and no chat button.', 'askmypages' ); ?></p>
				<table class="form-table" role="presentation"><tbody>
					<?php
					$rule( 'search', __( 'Search box upgrade', 'askmypages' ), __( 'Who gets AskMyPages results in the search box.', 'askmypages' ) );
					$rule( 'chat', __( 'Chat', 'askmypages' ), __( 'Who is shown the chat button and the answer card.', 'askmypages' ) );
					?>
				</tbody></table>
			</div>

			<div class="amp-section">
				<h2><?php esc_html_e( 'Members-only content', 'askmypages' ); ?>
					<?php
					if ( ! $paid ) :
						?>
						<span class="amp-pill is-plan"><?php esc_html_e( 'Starter and above', 'askmypages' ); ?></span><?php endif; ?>
				</h2>
				<p class="description"><?php esc_html_e( 'Content marked members-only is answered from only for logged-in users with an allowed role, in search and in chat. Everyone else never sees a word of it, whatever the rules above say. The AskMyPages service enforces this on every request.', 'askmypages' ); ?></p>
				<?php if ( ! $paid ) : ?>
					<p class="description"><?php esc_html_e( 'Available on Starter and above.', 'askmypages' ); ?> <?php echo wp_kses_post( Admin::upgrade_link( __( 'Upgrade', 'askmypages' ) ) ); ?></p>
				<?php endif; ?>
				<table class="form-table" role="presentation"><tbody>
					<tr>
						<th scope="row"><?php esc_html_e( 'Status', 'askmypages' ); ?></th>
						<td><label><input type="checkbox" name="members_enabled" value="1" <?php checked( $members['enabled'] ); ?> <?php disabled( ! $paid ); ?>> <?php esc_html_e( 'Index members-only content', 'askmypages' ); ?></label>
						<p class="description"><?php esc_html_e( 'Mark a page, post or PDF as members-only in the AskMyPages box on its edit screen, or choose categories below.', 'askmypages' ); ?></p></td>
					</tr>
					<tr>
						<th scope="row"><?php esc_html_e( 'Private pages', 'askmypages' ); ?></th>
						<td><label><input type="checkbox" name="members_private" value="1" <?php checked( $members['private'] ); ?> <?php disabled( ! $paid ); ?>> <?php esc_html_e( 'Include private and password-protected pages and posts, and their PDFs, for logged-in users', 'askmypages' ); ?></label></td>
					</tr>
					<?php
					$categories = get_terms(
						array(
							'taxonomy'   => 'category',
							'hide_empty' => false,
							'number'     => 200,
						)
					);
					if ( is_array( $categories ) && $categories ) :
						?>
					<tr>
						<th scope="row"><?php esc_html_e( 'Members-only categories', 'askmypages' ); ?></th>
						<td><div class="amp-roles">
						<?php foreach ( $categories as $term ) : ?>
							<label><input type="checkbox" name="members_terms[]" value="<?php echo (int) $term->term_id; ?>" <?php checked( in_array( (int) $term->term_id, $members['terms'], true ) ); ?> <?php disabled( ! $paid ); ?>> <?php echo esc_html( $term->name ); ?> <span class="description">(<?php echo (int) $term->count; ?>)</span></label>
						<?php endforeach; ?>
						</div>
						<p class="description"><?php esc_html_e( 'Posts in these categories are members-only.', 'askmypages' ); ?></p></td>
					</tr>
					<?php endif; ?>
					<tr>
						<th scope="row"><?php esc_html_e( 'Who counts as a member', 'askmypages' ); ?></th>
						<td><div class="amp-roles">
						<?php foreach ( $names as $role => $role_name ) : ?>
							<label><input type="checkbox" name="members_roles[]" value="<?php echo esc_attr( $role ); ?>" <?php checked( in_array( $role, $members['roles'], true ) ); ?> <?php disabled( ! $paid ); ?>> <?php echo esc_html( translate_user_role( $role_name ) ); ?></label>
						<?php endforeach; ?>
						</div>
						<p class="description"><?php esc_html_e( 'Leave every role unticked to mean any logged-in user. A page or PDF can name its own roles in its AskMyPages box.', 'askmypages' ); ?></p></td>
					</tr>
				</tbody></table>
			</div>
			<?php submit_button( __( 'Save access', 'askmypages' ) ); ?>
		</form>
		<?php
	}
}