<?php
/**
 * The one set of rules for whether a visit may be tracked.
 *
 * @package Tagsmith
 */

declare(strict_types=1);

namespace Tagsmith\Tracking;

use Tagsmith\Settings;

defined( 'ABSPATH' ) || exit;

/**
 * Decides whether this request may carry tracking: the Google tag, Clarity
 * and, later, the ad pixels all ask here, so they follow the same
 * exclusions. Three kinds of rule, each usable on its own:
 *
 * - environment: production, or a staging or development site that opted in;
 * - request: an ordinary page view, not a preview, the customizer, AJAX,
 *   cron, a REST or JSON request or a feed;
 * - visitor: not in an excluded role, and the tagsmith_should_track filter
 *   agrees.
 *
 * Whether anything is configured to track is not decided here.
 */
class Gate {

	/**
	 * Settings store.
	 *
	 * @var Settings
	 */
	private Settings $settings;

	/**
	 * Constructor.
	 *
	 * @param Settings $settings Settings store.
	 */
	public function __construct( Settings $settings ) {
		$this->settings = $settings;
	}

	/**
	 * Whether every rule passes, checked in order: environment, request,
	 * visitor. The tagsmith_should_track filter is the last word, so it only
	 * runs when everything before it passed.
	 *
	 * The request rule uses conditional tags (is_preview() and is_feed()), so
	 * this is valid only from the `wp` action onward: called earlier, for
	 * example at plugins_loaded, WordPress raises _doing_it_wrong.
	 *
	 * @param \WP_User|null $user The user to check; defaults to the current user.
	 */
	public function allows( ?\WP_User $user = null ): bool {
		return $this->environment_allows() && $this->request_allows() && $this->visitor_allows( $user );
	}

	/**
	 * Whether tags are added in this environment: production, or
	 * non-production tracking is explicitly allowed.
	 */
	public function environment_allows(): bool {
		if ( 'production' === wp_get_environment_type() ) {
			return true;
		}

		return (bool) $this->settings->get( 'track_non_production' );
	}

	/**
	 * Whether this is a request that shows a page to a visitor: not a post
	 * or customizer preview, AJAX, cron, a REST or JSON request or a feed.
	 *
	 * It uses conditional tags (is_preview(), is_customize_preview() and
	 * is_feed()), so it is valid only from the `wp` action onward: called
	 * earlier, for example at plugins_loaded, WordPress raises
	 * _doing_it_wrong.
	 */
	public function request_allows(): bool {
		if ( is_preview() || is_customize_preview() ) {
			return false;
		}

		return ! ( wp_doing_ajax() || wp_doing_cron() || wp_is_json_request() || is_feed() );
	}

	/**
	 * Whether this visitor may be tracked: not in an excluded role, and the
	 * tagsmith_should_track filter does not refuse. A user that does not
	 * exist (a logged-out visitor) is never excluded by role.
	 *
	 * @param \WP_User|null $user The user to check; defaults to the current user.
	 */
	public function visitor_allows( ?\WP_User $user = null ): bool {
		$user = $user ?? wp_get_current_user();

		if ( $user instanceof \WP_User && $user->exists() ) {
			$exclude_roles = (array) $this->settings->get( 'exclude_roles' );

			if ( array_intersect( (array) $user->roles, $exclude_roles ) ) {
				return false;
			}
		}

		/**
		 * Filters whether a visit is tracked, after Tagsmith's own checks
		 * (environment, request type and excluded roles) have passed. Return
		 * false to leave this visit out, for example for a page or a visitor
		 * your site treats as internal.
		 *
		 * @since 2.0.0
		 *
		 * @param bool          $track Whether to track. Default true.
		 * @param \WP_User|null $user  The visitor being checked.
		 */
		return (bool) apply_filters( 'tagsmith_should_track', true, $user );
	}
}