<?php
namespace AntivirusAI\V1;

/** Administrator-only security changes; passwords, email values and customer profiles are not recorded. */
final class AccountMonitor {
	public static function register(): void {
		add_action( 'set_user_role', array( self::class, 'role' ), 10, 3 );
		add_action( 'add_user_role', array( self::class, 'addedRole' ), 10, 2 );
		add_action( 'remove_user_role', array( self::class, 'removedRole' ), 10, 2 );
		add_action( 'user_register', array( self::class, 'created' ) );
		add_action( 'delete_user', array( self::class, 'deleted' ) );
		add_action( 'profile_update', array( self::class, 'profile' ), 10, 2 );
	}
	public static function role( int $id, string $role, array $old ): void {
		if ( 'administrator' === $role || in_array( 'administrator', $old, true ) ) { self::record( 'administrator_role_changed', $id, array( 'administrator_before' => in_array( 'administrator', $old, true ), 'administrator_after' => 'administrator' === $role ) ); }
	}
	public static function addedRole( int $id, string $role ): void { if ( 'administrator' === $role ) { self::record( 'administrator_role_added', $id ); } }
	public static function removedRole( int $id, string $role ): void { if ( 'administrator' === $role ) { self::record( 'administrator_role_removed', $id ); } }
	public static function created( int $id ): void { if ( self::administrator( $id ) ) { self::record( 'administrator_created', $id ); } }
	public static function deleted( int $id ): void { if ( self::administrator( $id ) ) { self::record( 'administrator_deleted', $id ); } }
	private static function administrator( int $id ): bool { $user = get_userdata( $id ); return $user && in_array( 'administrator', (array) $user->roles, true ); }
	public static function profile( int $id, $old ): void {
		if ( ! self::administrator( $id ) ) { return; }
		$new = get_userdata( $id ); $fields = array();
		foreach ( array( 'user_pass' => 'password', 'user_email' => 'email', 'user_login' => 'login' ) as $key => $label ) { if ( (string) $old->$key !== (string) $new->$key ) { $fields[] = $label; } }
		if ( $fields ) { self::record( 'administrator_profile_changed', $id, array( 'changed_fields' => $fields ) ); }
	}
	private static function record( string $event, int $id, array $details = array() ): void {
		try {
			$data = $details + array( 'account_id' => $id, 'actor_id' => get_current_user_id(), 'observed_at' => gmdate( 'c' ), 'meaning' => 'Observed through WordPress hooks; direct database edits may only be detected by a subsequent scan.' );
			( new Store() )->activity( $event, $data );
			Notifications::accountEvent( $event, $id );
		} catch ( \Throwable $error ) {
			update_option( 'antivirus_ai_account_monitor_warning', array( 'at' => time(), 'message' => 'An administrator-change event could not be fully recorded. Review account access and notification delivery.' ), false );
		}
	}
}