<?php
/**
 * Permissions Manager
 *
 * Manages user permissions and access control.
 *
 * @package LumoContentRestrictor\Core
 * @since 2.0.0
 */

namespace LumoContentRestrictor\Core;

defined( 'ABSPATH' ) || exit;

/**
 * Permissions class.
 *
 * @since 2.0.0
 */
class Permissions {

	/**
	 * Check if current user can access plugin settings.
	 *
	 * @since 2.0.0
	 * @return bool True if user has access, false otherwise.
	 */
	public static function can_access_settings() {
		// Super admin always has access.
		if ( is_super_admin() ) {
			return true;
		}

		// Get current user.
		$current_user = wp_get_current_user();

		if ( ! $current_user || ! $current_user->ID ) {
			return false;
		}

		// Administrator always has access by default.
		if ( in_array( 'administrator', (array) $current_user->roles, true ) ) {
			return true;
		}

		// Get allowed roles from settings.
		$settings      = get_option( 'lumocr_settings', array() );
		$allowed_roles = isset( $settings['advanced']['allowed_roles'] ) && is_array( $settings['advanced']['allowed_roles'] ) 
			? $settings['advanced']['allowed_roles'] 
			: array();

		// Check if user has any of the allowed roles.
		if ( ! empty( $allowed_roles ) ) {
			foreach ( $current_user->roles as $role ) {
				if ( in_array( $role, $allowed_roles, true ) ) {
					return true;
				}
			}
		}

		return false;
	}

	/**
	 * Get allowed roles for plugin access.
	 *
	 * @since 2.0.0
	 * @return array Array of allowed role slugs.
	 */
	public static function get_allowed_roles() {
		$settings      = get_option( 'lumocr_settings', array() );
		$allowed_roles = isset( $settings['advanced']['allowed_roles'] ) && is_array( $settings['advanced']['allowed_roles'] ) 
			? $settings['advanced']['allowed_roles'] 
			: array();

		// Administrator is always included.
		if ( ! in_array( 'administrator', $allowed_roles, true ) ) {
			$allowed_roles[] = 'administrator';
		}

		return $allowed_roles;
	}

	/**
	 * Die with permission denied message.
	 *
	 * @since 2.0.0
	 */
	public static function permission_denied() {
		wp_die(
			esc_html__( 'You do not have permission to access this page.', 'lumo-access-studio' ),
			esc_html__( 'Permission Denied', 'lumo-access-studio' ),
			array(
				'response'  => 403,
				'back_link' => true,
			)
		);
	}
}