<?php
/**
 * Roles and capabilities.
 *
 * @package QuietAdmin
 */

namespace QuietAdmin;

defined( 'ABSPATH' ) || exit;

/**
 * Class Roles.
 *
 * Ships its own allowlist-based role `quietadmin_client` and
 * distributes the plugin capabilities to administrator/editor.
 *
 * @since 0.1.0
 */
class Roles {

	/**
	 * Slug of the client role.
	 *
	 * @since 0.1.0
	 * @var string
	 */
	const CLIENT_ROLE = 'quietadmin_client';

	/**
	 * Returns the capabilities of the client role (allowlist principle).
	 *
	 * Anything not listed here, the client cannot do - in addition,
	 * the admin menu is reduced via the menu allowlist (see Menu_Filter).
	 *
	 * @since 0.1.0
	 *
	 * @return array<string,bool>
	 */
	public static function client_capabilities() {
		$caps = array(
			'read'                   => true,
			'edit_posts'             => true,
			'edit_published_posts'   => true,
			'publish_posts'          => true,
			'delete_posts'           => true,
			'delete_published_posts' => true,
			'upload_files'           => true,
			'edit_pages'             => true,
			'edit_published_pages'   => true,
			'read_private_pages'     => true,

			// Own profile, but no user/plugin/theme management.
			'edit_theme_options'     => false,
			'manage_options'         => false,
			'activate_plugins'       => false,
			'edit_plugins'           => false,
			'edit_themes'            => false,
			'edit_files'             => false,
			'import'                 => false,
			'export'                 => false,
			'unfiltered_html'        => false,
			'unfiltered_upload'      => false,

			// Plugin capabilities.
			'qa_view_dashboard'      => true,
			'qa_use_quick_actions'   => true,
			'qa_request_support'     => true,
			'qa_view_reports'        => false,
			'qa_manage_settings'     => false,
		);

		/**
		 * Filters the capabilities of the client role.
		 *
		 * @since 0.1.0
		 *
		 * @param array<string,bool> $caps Capability list.
		 */
		return apply_filters( 'quietadmin_client_capabilities', $caps );
	}

	/**
	 * Plugin capabilities per default role.
	 *
	 * @since 0.1.0
	 *
	 * @return array<string,array<string,bool>>
	 */
	public static function capabilities_map() {
		$full = array(
			'qa_manage_settings'   => true,
			'qa_view_reports'      => true,
			'qa_view_dashboard'    => true,
			'qa_use_quick_actions' => true,
			'qa_request_support'   => true,
		);

		$map = array(
			'administrator'   => $full,
			'editor'          => array(
				'qa_view_reports'      => true,
				'qa_view_dashboard'    => true,
				'qa_use_quick_actions' => true,
				'qa_request_support'   => true,
				'qa_manage_settings'   => false,
			),
			self::CLIENT_ROLE => array(
				'qa_view_dashboard'    => true,
				'qa_use_quick_actions' => true,
				'qa_request_support'   => true,
				'qa_view_reports'      => false,
				'qa_manage_settings'   => false,
			),
		);

		/**
		 * Filters the capability distribution.
		 *
		 * @since 0.1.0
		 *
		 * @param array<string,array<string,bool>> $map Roles => capabilities.
		 */
		return apply_filters( 'quietadmin_capabilities_map', $map );
	}

	/**
	 * Distributes the plugin capabilities to all configured roles.
	 *
	 * @since 0.1.0
	 *
	 * @return void
	 */
	public static function sync_capabilities() {
		foreach ( self::capabilities_map() as $role_key => $caps ) {
			$role = get_role( $role_key );

			if ( ! $role ) {
				continue;
			}

			foreach ( $caps as $cap => $grant ) {
				if ( $grant ) {
					$role->add_cap( $cap );
				} else {
					$role->remove_cap( $cap );
				}
			}
		}
	}

	/**
	 * Checks a plugin capability for a user (or the current one).
	 *
	 * @since 0.1.0
	 *
	 * @param string   $cap  Capability, e.g. 'qa_manage_settings'.
	 * @param int|null $user User ID, defaults to the current user.
	 * @return bool
	 */
	public static function user_can( $cap, $user = null ) {
		if ( null === $user ) {
			return current_user_can( $cap );
		}

		$account = get_userdata( $user );

		return $account ? user_can( $account, $cap ) : false;
	}

	/**
	 * All users with the client role.
	 *
	 * @since 0.1.0
	 *
	 * @param int $number Maximum number of users (0 = unlimited).
	 * @return \WP_User[]
	 */
	public static function get_client_users( $number = 100 ) {
		return get_users(
			array(
				'role'   => self::CLIENT_ROLE,
				'number' => max( 0, (int) $number ),
			)
		);
	}

	/**
	 * Is the user a client (according to role)?
	 *
	 * @since 0.1.0
	 *
	 * @param int|\WP_User $user User.
	 * @return bool
	 */
	public static function is_client( $user = null ) {
		if ( null === $user ) {
			$user = wp_get_current_user();
		} elseif ( is_numeric( $user ) ) {
			$user = get_userdata( (int) $user );
		}

		if ( ! $user instanceof \WP_User || 0 === $user->ID ) {
			return false;
		}

		return in_array( self::CLIENT_ROLE, (array) $user->roles, true );
	}
}