<?php
// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- Compatibility checks reference third-party/WordPress constants that QW Optimize does not define.
namespace QWSpeedCache\Compatibility;

defined( 'ABSPATH' ) || exit;

/**
 * Role-based access and hardening toggles.
 */
class Access {

	public function __construct() {
		add_filter( 'qwsc_admin_capability', array( $this, 'capability' ) );

		$s = \QWSpeedCache\Plugin::instance()->get_all_settings();

		if ( ! empty( $s['disable_application_passwords'] ) ) {
			add_filter( 'wp_is_application_passwords_available', '__return_false' );
			add_filter( 'wp_is_application_passwords_available_for_user', '__return_false' );
		}

		if ( ! empty( $s['disable_file_editor'] ) ) {
			$this->maybe_disable_file_editor();
		}

		if ( ! empty( $s['login_errors_generic'] ) ) {
			add_filter( 'login_errors', array( $this, 'generic_login_error' ) );
		}
	}

	/**
	 * @param string $cap Capability.
	 * @return string
	 */
	public function capability( $cap ) {
		$s    = \QWSpeedCache\Plugin::instance()->get_all_settings();
		$role = isset( $s['access_role'] ) ? $s['access_role'] : 'manage_options';
		$map  = array(
			'manage_options'    => 'manage_options',
			'edit_others_posts' => 'edit_others_posts',
		);
		return isset( $map[ $role ] ) ? $map[ $role ] : 'manage_options';
	}

	/**
	 * Define DISALLOW_FILE_EDIT when not already set (cannot override wp-config true/false once defined).
	 */
	private function maybe_disable_file_editor() {
		if ( ! defined( 'DISALLOW_FILE_EDIT' ) ) {
			define( 'DISALLOW_FILE_EDIT', true );
		}
	}

	/**
	 * Generic login failure message (no username enumeration).
	 *
	 * @param string $error Original error HTML.
	 * @return string
	 */
	public function generic_login_error( $error ) {
		return self::generic_login_message();
	}

	/**
	 * Pure message for tests.
	 *
	 * @return string
	 */
	public static function generic_login_message() {
		if ( function_exists( '__' ) ) {
			return __( 'Invalid username or password.', 'qw-optimize' );
		}
		return 'Invalid username or password.';
	}

	/**
	 * Whether application passwords should be blocked (pure).
	 *
	 * @param bool $setting_enabled Setting on.
	 * @return bool
	 */
	public static function should_block_app_passwords( $setting_enabled ) {
		return (bool) $setting_enabled;
	}
}