<?php
namespace Consiva\Consent\Support;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Who may do what (Plugin §9.1).
 *
 * - manage_options (SETTINGS): connect, disconnect, activate, banner and form settings, classifying
 *   findings, applying recommendations, diagnostics.
 * - consiva_manage_privacy (MANAGE): evidence actions (test decision, export, download).
 * - consiva_view_privacy (VIEW): the read-only Consiva screens.
 *
 * Anyone with manage_options holds MANAGE and VIEW (so every administrator, and super admins, without
 * touching roles); anyone with MANAGE holds VIEW. The Administrator role also gets both on activation,
 * so role-editor plugins can list them and grant them to an Editor-level privacy owner.
 */
final class Capabilities {

	const SETTINGS = 'manage_options';
	const MANAGE   = 'consiva_manage_privacy';
	const VIEW     = 'consiva_view_privacy';

	/**
	 * @return void
	 */
	public function register() {
		add_filter( 'user_has_cap', array( __CLASS__, 'grant' ), 10, 1 );
	}

	/**
	 * @param array<string,bool> $allcaps The user's capabilities.
	 * @return array<string,bool>
	 */
	public static function grant( $allcaps ) {
		if ( ! empty( $allcaps[ self::SETTINGS ] ) ) {
			$allcaps[ self::MANAGE ] = true;
		}
		if ( ! empty( $allcaps[ self::MANAGE ] ) ) {
			$allcaps[ self::VIEW ] = true;
		}
		return $allcaps;
	}

	/**
	 * Activation: add both capabilities to the Administrator role (capability registration, §9.7).
	 *
	 * @return void
	 */
	public static function add_to_roles() {
		$role = get_role( 'administrator' );
		if ( $role ) {
			$role->add_cap( self::MANAGE );
			$role->add_cap( self::VIEW );
		}
	}

	/**
	 * Uninstall: remove them from every role they were granted to.
	 *
	 * @return void
	 */
	public static function remove_from_roles() {
		foreach ( wp_roles()->role_objects as $role ) {
			$role->remove_cap( self::MANAGE );
			$role->remove_cap( self::VIEW );
		}
	}

	/** @return bool */
	public static function can_view() {
		return current_user_can( self::VIEW );
	}

	/** @return bool */
	public static function can_manage() {
		return current_user_can( self::MANAGE );
	}

	/** @return bool */
	public static function can_configure() {
		return current_user_can( self::SETTINGS );
	}
}