<?php
/**
 * Approved-product sync: what a write may do.
 *
 * @package CortexCommerce
 */

namespace CortexCommerce\Sync;

defined( 'ABSPATH' ) || exit;

/**
 * Runs one product's write, and the catalog push's reads, with no user at all, never as an administrator.
 *
 * Measured in wp-env (WooCommerce 11.1, Yoast 28.5, Rank Math 1.0.279, the plugin's own SEO fields): with no current
 * user, every write the sync makes goes through (WC_Product::save(), wp_set_object_terms(), the SEO adapters' meta,
 * alt text, media_handle_sideload() and set_image_id()), and only two capability checks are made:
 *
 * - unfiltered_html, by kses on the way into the post. It stays false, so the copy is filtered like any non-admin edit.
 * - read_private_products on the product, by the in-process wc/v3 read that reports what was written as the catalog
 *   push sends it. That one is granted, for this product and its variations only.
 *
 * The catalog push (run_catalog_read) only reads: it gets read_private_products on every product, with or without an
 * object (wc/v3 lists a product's variations with no object id), so drafts and private products are sent as before.
 *
 * Everything else stays false, and the capabilities in DENIED are refused outright for the whole write, even if another
 * plugin's filter would grant them. A generated image is stored with no author (post_author 0), as WordPress does for
 * any upload made with no user, rather than being attributed to a person who did not make it.
 */
final class SyncPermissions {

	/**
	 * Never true during a sync write, whatever any other filter says.
	 */
	public const DENIED = array(
		'manage_options',
		'manage_woocommerce',
		'activate_plugins',
		'install_plugins',
		'update_plugins',
		'delete_plugins',
		'edit_plugins',
		'install_themes',
		'update_themes',
		'delete_themes',
		'edit_themes',
		'switch_themes',
		'edit_theme_options',
		'update_core',
		'edit_files',
		'list_users',
		'create_users',
		'edit_users',
		'delete_users',
		'promote_users',
		'remove_users',
		'unfiltered_html',
		'unfiltered_upload',
		'import',
		'export',
		'manage_network',
		'manage_sites',
		'manage_network_users',
		'manage_network_plugins',
		'manage_network_themes',
		'manage_network_options',
	);

	/**
	 * Granted, and only for the product being written or one of its variations.
	 */
	public const GRANTED_FOR_PRODUCT = array( 'read_private_products' );

	/**
	 * @var array<int, int>|null The product and its variations, or null for every product (the catalog read).
	 */
	private $ids;

	/**
	 * @param array<int, int>|null $ids The product and its variations, or null for every product.
	 */
	private function __construct( ?array $ids ) {
		$this->ids = $ids;
	}

	/**
	 * Calls $write with no current user and the scope above, then puts the previous user back.
	 *
	 * @template T
	 * @param callable(): T $write The product's write.
	 * @return T
	 */
	public static function run( int $product_id, callable $write ) {
		return ( new self( self::with_variations( $product_id ) ) )->as_nobody( $write );
	}

	/**
	 * Calls $read with no current user and read_private_products on every product, then puts the previous user back.
	 * For the catalog push, which reads every product through wc/v3 and writes nothing.
	 *
	 * @template T
	 * @param callable(): T $read The catalog push.
	 * @return T
	 */
	public static function run_catalog_read( callable $read ) {
		return ( new self( null ) )->as_nobody( $read );
	}

	/**
	 * @template T
	 * @param callable(): T $work What runs in this scope.
	 * @return T
	 */
	private function as_nobody( callable $work ) {
		$previous = get_current_user_id();
		$filter   = array( $this, 'filter' );
		// Action Scheduler may run inside an admin's page load: the work must not inherit that user.
		wp_set_current_user( 0 );
		add_filter( 'user_has_cap', $filter, PHP_INT_MAX, 4 );
		try {
			return $work();
		} finally {
			remove_filter( 'user_has_cap', $filter, PHP_INT_MAX );
			wp_set_current_user( $previous );
		}
	}

	/**
	 * user_has_cap, for the nobody user only: a check about any real user (such as whether the key's owner may still
	 * manage WooCommerce) is left alone.
	 *
	 * Typed loosely on purpose: other plugins' user_has_cap filters run first and may pass anything on.
	 *
	 * @param mixed $allcaps What the user has.
	 * @param mixed $caps    The primitive capabilities being checked.
	 * @param mixed $args    The requested capability, the user id, then the object id when there is one.
	 * @param mixed $user    The user being checked.
	 * @return array<string, bool>
	 */
	public function filter( $allcaps, $caps, $args, $user ) {
		if ( ! $user instanceof \WP_User || 0 !== (int) $user->ID ) {
			return $allcaps;
		}
		$allcaps = is_array( $allcaps ) ? $allcaps : array();
		$object  = is_array( $args ) && isset( $args[2] ) && is_numeric( $args[2] ) ? (int) $args[2] : 0;
		if ( null === $this->ids || ( 0 !== $object && in_array( $object, $this->ids, true ) ) ) {
			foreach ( (array) $caps as $cap ) {
				if ( in_array( $cap, self::GRANTED_FOR_PRODUCT, true ) ) {
					$allcaps[ $cap ] = true;
				}
			}
		}
		foreach ( self::DENIED as $cap ) {
			$allcaps[ $cap ] = false;
		}
		return $allcaps;
	}

	/**
	 * @return array<int, int> The product and its variations.
	 */
	private static function with_variations( int $product_id ): array {
		$product = wc_get_product( $product_id );
		$ids     = array( $product_id );
		if ( $product instanceof \WC_Product ) {
			foreach ( $product->get_children() as $child ) {
				$ids[] = (int) $child;
			}
		}
		return $ids;
	}
}