<?php
/**
 * Keeps MCP requests away from site administration.
 *
 * @package HandyMCP
 */

namespace HandyMCP\Auth;

defined( 'ABSPATH' ) || exit;

/**
 * While an MCP request runs, the signed-in user loses every administrative
 * capability, whatever their role: plugins, themes, core updates, users,
 * file editing, import/export, unfiltered HTML and uploads, and network
 * administration. AI apps can only work with content (posts, pages, media,
 * menus, terms, products, forms and SEO fields) that the user may already edit.
 *
 * manage_options stays, because site settings tools need it, but critical core
 * options (site address, admin email, registration and default role, active
 * plugins and theme, user roles, cron and similar) cannot be changed while the
 * guard is on: such updates are silently dropped.
 */
final class CapGuard {

	/** @var bool */
	private static $on = false;

	/**
	 * Capabilities an MCP request never has.
	 *
	 * @return string[]
	 */
	public static function denied(): array {
		return array(
			'activate_plugins', 'install_plugins', 'update_plugins', 'delete_plugins', 'edit_plugins', 'resume_plugins',
			'install_themes', 'switch_themes', 'update_themes', 'delete_themes', 'edit_themes', 'resume_themes',
			'install_languages', 'update_languages', 'update_core', 'edit_files',
			'create_users', 'edit_users', 'delete_users', 'promote_users', 'remove_users', 'add_users', 'list_users', 'promote_user', 'edit_user', 'delete_user', 'remove_user',
			'unfiltered_html', 'unfiltered_upload', 'import', 'export', 'erase_others_personal_data', 'export_others_personal_data', 'manage_privacy_options',
			'manage_network', 'manage_sites', 'manage_network_users', 'manage_network_plugins', 'manage_network_themes', 'manage_network_options', 'upgrade_network', 'setup_network', 'create_sites', 'delete_sites', 'delete_site',
		);
	}

	/**
	 * Core options an MCP request may never change.
	 *
	 * @return string[]
	 */
	public static function protected_options(): array {
		global $wpdb;
		return array(
			'siteurl', 'home', 'admin_email', 'new_admin_email', 'users_can_register', 'default_role',
			'active_plugins', 'active_sitewide_plugins', 'template', 'stylesheet', 'current_theme',
			'permalink_structure', 'WPLANG', 'blog_public', 'upload_path', 'upload_url_path',
			'recently_activated', 'uninstall_plugins',
			$wpdb->prefix . 'user_roles', $wpdb->get_blog_prefix() . 'user_roles', 'cron',
			'site_admins', 'registration', 'add_new_users',
		);
	}

	/**
	 * Keep the stored value of a protected option.
	 *
	 * @param mixed  $value     New value.
	 * @param string $option    Option name.
	 * @param mixed  $old_value Stored value.
	 * @return mixed
	 */
	public static function protect_option( $value, $option, $old_value ) {
		if ( in_array( (string) $option, self::protected_options(), true ) ) {
			return $old_value;
		}
		return $value;
	}

	/**
	 * Keep the stored value of a protected network option.
	 *
	 * @param mixed  $value     New value.
	 * @param mixed  $old_value Stored value.
	 * @param string $option    Option name.
	 * @return mixed
	 */
	public static function protect_site_option( $value, $old_value, $option = '' ) {
		return self::protect_option( $value, $option, $old_value );
	}

	/**
	 * Turn the guard on for the rest of this request.
	 */
	public static function apply(): void {
		if ( self::$on ) {
			return;
		}
		self::$on = true;
		add_filter( 'user_has_cap', array( __CLASS__, 'filter' ), PHP_INT_MAX, 4 );
		add_filter( 'map_meta_cap', array( __CLASS__, 'map' ), PHP_INT_MAX, 2 );
		add_filter( 'pre_update_option', array( __CLASS__, 'protect_option' ), PHP_INT_MAX, 3 );
		if ( is_multisite() ) {
			foreach ( self::protected_options() as $option ) {
				add_filter( 'pre_update_site_option_' . $option, array( __CLASS__, 'protect_site_option' ), PHP_INT_MAX, 3 );
			}
		}
		// Without unfiltered_html, content saved during this request goes through kses.
		if ( function_exists( 'kses_init_filters' ) ) {
			kses_init_filters();
		}
	}

	/**
	 * Whether the guard is on.
	 */
	public static function active(): bool {
		return self::$on;
	}

	/**
	 * Remove administrative capabilities from the user.
	 *
	 * @param array<string, bool> $allcaps All capabilities of the user.
	 * @param string[]            $caps    Required primitive capabilities.
	 * @param array<int, mixed>   $args    Requested capability and arguments.
	 * @param \WP_User|null       $user    User.
	 * @return array<string, bool>
	 */
	public static function filter( $allcaps, $caps = array(), $args = array(), $user = null ): array {
		foreach ( self::denied() as $cap ) {
			$allcaps[ $cap ] = false;
		}
		return (array) $allcaps;
	}

	/**
	 * Refuse meta capabilities that map to administrative work, including for
	 * super admins, whose capabilities are not read from their role.
	 *
	 * @param string[] $caps Primitive capabilities.
	 * @param string   $cap  Requested capability.
	 * @return string[]
	 */
	public static function map( $caps, $cap ): array {
		$denied = self::denied();
		if ( in_array( $cap, $denied, true ) || array_intersect( (array) $caps, $denied ) ) {
			return array( 'do_not_allow' );
		}
		return (array) $caps;
	}
}