<?php
/**
 * REST permission callbacks.
 *
 * @package Recast\WCS
 */

namespace Recast\WCS\Rest;

defined( 'ABSPATH' ) || exit;

/**
 * Read requires manage_woocommerce; changing settings and stopping a batch require the write capability.
 */
final class Auth {

	/**
	 * Capability required to read.
	 *
	 * @return string
	 */
	public static function read_capability() {
		/**
		 * Filters the capability required to use Recast.
		 *
		 * @param string $capability Capability.
		 */
		return (string) apply_filters( 'recast_read_capability', 'manage_woocommerce' );
	}

	/**
	 * Capability required to apply changes.
	 *
	 * @return string
	 */
	public static function write_capability() {
		/**
		 * Filters the capability required to apply changes.
		 *
		 * @param string $capability Capability.
		 */
		return (string) apply_filters( 'recast_write_capability', 'manage_woocommerce' );
	}

	/**
	 * Permission callback for read routes.
	 *
	 * @return bool|\WP_Error
	 */
	public static function can_read() {
		if ( ! current_user_can( self::read_capability() ) ) {
			return new \WP_Error(
				'recast_forbidden',
				__( 'You do not have permission to use Recast.', 'recast-subscriptions' ),
				array( 'status' => rest_authorization_required_code() )
			);
		}
		return true;
	}

	/**
	 * Whether the current user has the write capability, needed to change settings and to stop a batch.
	 *
	 * @return bool|\WP_Error
	 */
	public static function can_change() {
		$read = self::can_read();
		if ( true !== $read ) {
			return $read;
		}
		if ( ! current_user_can( self::write_capability() ) ) {
			return new \WP_Error(
				'recast_forbidden',
				__( 'You do not have permission to make this change.', 'recast-subscriptions' ),
				array( 'status' => 403 )
			);
		}
		return true;
	}
}