<?php
/**
 * Records security-relevant WordPress events locally.
 *
 * @package Keepwatch
 */

namespace Keepwatch\Security;

defined( 'ABSPATH' ) || exit;

/**
 * Hooks into role changes and plugin activation. No remote calls.
 */
final class Monitor {

	/**
	 * Event store.
	 *
	 * @var EventStore
	 */
	private $store;

	/**
	 * Constructor.
	 *
	 * @param EventStore $store Store.
	 */
	public function __construct( EventStore $store ) {
		$this->store = $store;
	}

	/**
	 * Register hooks.
	 */
	public function register(): void {
		add_action( 'set_user_role', array( $this, 'on_role' ), 10, 3 );
		add_action( 'add_user_role', array( $this, 'on_add_role' ), 10, 2 );
		add_action( 'activated_plugin', array( $this, 'on_plugin_activated' ), 10, 1 );
		add_action( 'deactivated_plugin', array( $this, 'on_plugin_deactivated' ), 10, 1 );
	}

	/**
	 * User role replaced.
	 *
	 * @param int    $user_id   User ID.
	 * @param string $role      New role.
	 * @param mixed  $old_roles Previous roles (WordPress may pass a string list).
	 */
	public function on_role( $user_id, $role, $old_roles = array() ): void {
		if ( 'administrator' !== $role ) {
			return;
		}
		$previous = is_array( $old_roles ) ? $old_roles : array();
		if ( in_array( 'administrator', $previous, true ) ) {
			return;
		}
		$user  = get_userdata( (int) $user_id );
		$login = $user ? $user->user_login : (string) $user_id;
		$this->store->record(
			'admin_role',
			sprintf(
				/* translators: %s: user login */
				__( 'User "%s" was granted the administrator role', 'keepwatch' ),
				$login
			),
			array(
				'user_id' => (int) $user_id,
				'login'   => $login,
			)
		);
	}

	/**
	 * Role added alongside existing roles.
	 *
	 * @param int    $user_id User ID.
	 * @param string $role    Role.
	 */
	public function on_add_role( $user_id, $role ): void {
		$this->on_role( $user_id, $role, array() );
	}

	/**
	 * Plugin activated.
	 *
	 * @param string $plugin Plugin basename.
	 */
	public function on_plugin_activated( $plugin ): void {
		// Keepwatch's own activation is not a security event.
		if ( plugin_basename( KEEPWATCH_PLUGIN_FILE ) === (string) $plugin ) {
			return;
		}
		$this->store->record(
			'plugin_activated',
			sprintf(
				/* translators: %s: plugin basename */
				__( 'Plugin activated: %s', 'keepwatch' ),
				(string) $plugin
			),
			array( 'plugin' => (string) $plugin )
		);
	}

	/**
	 * Plugin deactivated.
	 *
	 * @param string $plugin Plugin basename.
	 */
	public function on_plugin_deactivated( $plugin ): void {
		$this->store->record(
			'plugin_deactivated',
			sprintf(
				/* translators: %s: plugin basename */
				__( 'Plugin deactivated: %s', 'keepwatch' ),
				(string) $plugin
			),
			array( 'plugin' => (string) $plugin )
		);
	}
}