<?php
/**
 * Login guard.
 *
 * @package HostKhata
 */

namespace HostKhata\Security;

defined( 'ABSPATH' ) || exit;

use HostKhata\Core\Hookable;
use HostKhata\Database\Repositories\CustomerRepository;
use HostKhata\Domain\Customers\CustomerStatus;
use WP_Error;
use WP_User;

/**
 * Stops customers who are blocked, anonymised or still waiting for approval
 * from logging in. Staff accounts are never affected.
 *
 * @since 0.1.0
 */
final class LoginGuard implements Hookable {

	/**
	 * Customers.
	 *
	 * @var CustomerRepository
	 */
	private $customers;

	/**
	 * Constructor.
	 *
	 * @param CustomerRepository $customers Customers.
	 */
	public function __construct( CustomerRepository $customers ) {
		$this->customers = $customers;
	}

	/**
	 * {@inheritdoc}
	 */
	public function register(): void {
		add_filter( 'wp_authenticate_user', array( $this, 'check' ), 20 );
	}

	/**
	 * Rejects the login of a customer that may not log in.
	 *
	 * @since 0.1.0
	 *
	 * @param WP_User|WP_Error $user User or error from earlier checks.
	 * @return WP_User|WP_Error
	 */
	public function check( $user ) {
		if ( ! $user instanceof WP_User || user_can( $user, 'manage_options' ) || user_can( $user, 'hostkhata_access_app' ) ) {
			return $user;
		}

		$customer = $this->customers->find_by_user_id( (int) $user->ID );

		if ( null === $customer || ! in_array( $customer['status'], CustomerStatus::login_blocked(), true ) ) {
			return $user;
		}

		if ( CustomerStatus::PENDING === $customer['status'] ) {
			return new WP_Error( 'hostkhata_pending', __( 'Your account is waiting for approval. We will let you know as soon as it is active.', 'hostkhata' ) );
		}

		return new WP_Error( 'hostkhata_disabled', __( 'This account has been disabled. Please contact us.', 'hostkhata' ) );
	}
}