<?php
namespace AntivirusAI\V1;

/** Re-read the current actor's saved role at optional disclosure/mutation boundaries. */
final class WorkflowAuthority {
	public static function administrator(): bool {
		$actor = get_current_user_id(); $site = get_current_blog_id();
		if ( $actor < 1 ) { return false; }
		// Role definitions have their own request cache, separate from individual user roles.
		$roles = wp_roles();
		if ( $roles->use_db ) {
			$stored = Store::freshOption( $roles->role_key, array() );
			if ( ! is_array( $stored ) || ! $stored ) { return false; }
			foreach ( $stored as $role ) { if ( ! is_array( $role ) || ! is_string( $role['name'] ?? null ) || ! is_array( $role['capabilities'] ?? null ) ) { return false; } }
		}
		$roles->for_site( $site );
		clean_user_cache( $actor );
		// wp_get_current_user() can retain an earlier role after another request revokes it.
		$user = new \WP_User( $actor );
		AccountPolicy::invalidate();
		$allowed = $user->exists() && user_can( $user, 'manage_options' );
		return $allowed && $actor === get_current_user_id() && $site === get_current_blog_id();
	}
}