<?php

namespace WTeam_Executor;

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

final class WTeam_Executor_Access_Control {

    const CAPABILITY    = 'wteam_executor_use';
    const OPTION_NAME   = 'wteam_executor_settings';
    const SETTINGS_GROUP = 'wteam_executor_settings_group';
    const MODE_ALL      = 'all_admins';
    const MODE_SELECTED = 'selected_admins';

    /** @return void */
    public static function register_hooks() {
        add_filter( 'map_meta_cap', [ __CLASS__, 'map_meta_cap' ], 10, 4 );
        add_filter( 'option_page_capability_' . self::SETTINGS_GROUP, [ __CLASS__, 'settings_page_capability' ] );
    }

    /**
     * @param array<int, string> $caps
     * @param string             $cap
     * @param int                $user_id
     * @param array<int, mixed>  $args
     * @return array<int, string>
     */
    public static function map_meta_cap( $caps, $cap, $user_id, $args ) {
        unset( $args );

        if ( self::CAPABILITY !== $cap ) {
            return $caps;
        }

        return self::can_user( $user_id ) ? [ 'read' ] : [ 'do_not_allow' ];
    }

    /** @return string */
    public static function settings_page_capability() {
        return self::CAPABILITY;
    }

    /** @return bool */
    public static function can_current_user() {
        $user_id = get_current_user_id();
        return $user_id > 0 && self::can_user( $user_id );
    }

    /**
     * @param int|\WP_User $user User object or ID.
     * @return bool
     */
    public static function can_user( $user ) {
        if ( is_numeric( $user ) ) {
            $user = get_userdata( absint( $user ) );
        }

        if ( ! $user instanceof \WP_User || ! self::is_administrator( $user ) ) {
            return false;
        }

        $policy = self::get_policy();
        if ( self::MODE_SELECTED !== $policy['mode'] ) {
            return true;
        }

        return in_array( (int) $user->ID, $policy['allowed_admin_ids'], true );
    }

    /** @return array{mode:string,allowed_admin_ids:array<int,int>} */
    public static function get_policy() {
        $settings = get_option( self::OPTION_NAME, [] );
        $settings = is_array( $settings ) ? $settings : [];

        $mode = isset( $settings['access_mode'] ) ? sanitize_key( (string) $settings['access_mode'] ) : self::MODE_ALL;
        if ( ! in_array( $mode, [ self::MODE_ALL, self::MODE_SELECTED ], true ) ) {
            $mode = self::MODE_ALL;
        }

        return [
            'mode'              => $mode,
            'allowed_admin_ids' => self::normalize_ids( isset( $settings['allowed_admin_ids'] ) ? $settings['allowed_admin_ids'] : [] ),
        ];
    }

    /** @return array<int, \WP_User> */
    public static function get_admin_users() {
        $users = [];

        if ( is_multisite() ) {
            foreach ( get_super_admins() as $login ) {
                $user = get_user_by( 'login', $login );
                if ( $user instanceof \WP_User && self::is_administrator( $user ) ) {
                    $users[] = $user;
                }
            }
        } else {
            $queried = get_users(
                [
                    'role'    => 'administrator',
                    'orderby' => 'display_name',
                    'order'   => 'ASC',
                ]
            );
            $users = is_array( $queried ) ? $queried : [];
        }

        $current = wp_get_current_user();
        if ( $current instanceof \WP_User && self::is_administrator( $current ) ) {
            $present = false;
            foreach ( $users as $user ) {
                if ( (int) $user->ID === (int) $current->ID ) {
                    $present = true;
                    break;
                }
            }
            if ( ! $present ) {
                $users[] = $current;
            }
        }

        $users = array_values(
            array_filter(
                $users,
                static function ( $user ) {
                    return $user instanceof \WP_User && self::is_administrator( $user );
                }
            )
        );

        usort(
            $users,
            static function ( $a, $b ) {
                return strcasecmp( (string) $a->display_name, (string) $b->display_name );
            }
        );

        return $users;
    }

    /**
     * @param mixed $ids
     * @return array<int, int>
     */
    public static function sanitize_allowed_admin_ids( $ids ) {
        $valid = [];
        foreach ( self::normalize_ids( $ids ) as $user_id ) {
            $user = get_userdata( $user_id );
            if ( $user instanceof \WP_User && self::is_administrator( $user ) ) {
                $valid[] = $user_id;
            }
        }

        return array_values( array_unique( $valid ) );
    }

    /**
     * Executor is intentionally administrator-only.
     * On Multisite, only Network Super Admins may use it.
     *
     * @param \WP_User $user User object.
     * @return bool
     */
    private static function is_administrator( \WP_User $user ) {
        if ( is_multisite() ) {
            return is_super_admin( (int) $user->ID );
        }

        return in_array( 'administrator', (array) $user->roles, true ) && user_can( $user, 'manage_options' );
    }

    /**
     * @param mixed $ids
     * @return array<int, int>
     */
    private static function normalize_ids( $ids ) {
        $ids = is_array( $ids ) ? $ids : [];
        $normalized = [];

        foreach ( $ids as $id ) {
            $id = absint( $id );
            if ( $id > 0 ) {
                $normalized[] = $id;
            }
        }

        return array_values( array_unique( $normalized ) );
    }

    private function __construct() {}
}