<?php
/**
 * Disable file editor.
 *
 * @package OvanapAdminToolkit
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}
return array(
	'key'      => 'disable_file_editor',
	'title'    => 'Disable file editor in admin',
	'desc'     => 'Remove the theme and plugin file editors from the admin',
	'icon'     => 'shield',
	'risk'     => 'recommended',
	'level'    => 'standard',
	'audience' => 'agency',
	'priority' => 9,
	'benefit'  => 'Someone who gets into an admin account could use the built-in editors to add malicious code to your theme or plugins. Removing them closes that easy route. They could still upload a plugin, so this is one layer of protection, not a complete one.',
	'help'     => 'Denies the edit_themes, edit_plugins and edit_files capabilities to every user, so the Theme File Editor and Plugin File Editor disappear. It does not write DISALLOW_FILE_EDIT to wp-config.php; turning the feature off brings the editors back. Plugin and theme updates are not affected.',
	'before'   => 'Theme File Editor and Plugin File Editor available to administrators',
	'after'    => 'Both editors removed for every user.',
	'detect'   => function () {
		if ( defined( 'DISALLOW_FILE_EDIT' ) && DISALLOW_FILE_EDIT ) {
			return array(
				'detected' => false,
				'message'  => 'File editor already disabled via wp-config.php',
				'safe'     => false,
			);
		}
		return array(
			'detected' => true,
			'message'  => 'Theme/plugin file editor is accessible',
			'safe'     => true,
			'savings'  => 'Security',
		);
	},
	'callback' => function () {
		// Deny the file-editing capabilities through map_meta_cap instead of
		// defining DISALLOW_FILE_EDIT, so the effect is scoped to this feature
		// and disappears as soon as it is switched off.
		add_filter(
			'map_meta_cap',
			function ( $caps, $cap ) {
				if ( in_array( $cap, array( 'edit_themes', 'edit_plugins', 'edit_files' ), true ) ) {
					return array( 'do_not_allow' );
				}
				return $caps;
			},
			10,
			2
		);
	},
);