<?php
namespace Zadex\Team;

defined('ABSPATH') || exit;

/**
 * Role manager (T170): which roles may use the Zadex editor and how.
 *
 *   none     the editor never opens for the role, "Edit with Zadex" links are hidden, editor REST routes answer 403
 *   content  the role edits the content controls of existing elements only (Team\ContentGuard enforces it on save)
 *   full     no restriction (default for every role)
 *
 * Stored in the option `zadex_role_access` as `{role: mode}`. Administrators (`manage_options`) are always full.
 * A user with several roles gets the most permissive mode. Filter `zadex/team/access_mode` ($mode, $user) decides last.
 */
final class Access
{
    public const OPTION = 'zadex_role_access';
    public const NONE = 'none';
    public const CONTENT = 'content';
    public const FULL = 'full';
    public const MODES = [self::NONE, self::CONTENT, self::FULL];
    private const RANK = [self::NONE => 0, self::CONTENT => 1, self::FULL => 2];

    /** @return array<string, string> role => mode (only valid modes; missing roles are full) */
    public static function roles_config(): array
    {
        $raw = get_option(self::OPTION, []);
        $out = [];
        foreach (is_array($raw) ? $raw : [] as $role => $mode) {
            if (is_string($role) && in_array($mode, self::MODES, true) && $role !== 'administrator') {
                $out[$role] = $mode;
            }
        }
        return $out;
    }

    /**
     * Sanitizes the Role Manager form: known roles only (never administrator), modes from MODES; `full` entries
     * are dropped (full is the default).
     *
     * @param array<string, mixed> $input role => mode
     * @param array<int, string> $known registered role slugs
     * @return array<string, string>
     */
    public static function sanitize_roles(array $input, array $known): array
    {
        $out = [];
        foreach ($input as $role => $mode) {
            $role = sanitize_key((string) $role);
            if ($role === '' || $role === 'administrator' || !in_array($role, $known, true)) {
                continue;
            }
            $mode = is_string($mode) ? $mode : '';
            if (in_array($mode, [self::NONE, self::CONTENT], true)) {
                $out[$role] = $mode;
            }
        }
        ksort($out);
        return $out;
    }

    /** @param \WP_User|object|null $user */
    public static function mode_for_user($user = null): string
    {
        if ($user === null && function_exists('wp_get_current_user')) {
            $user = wp_get_current_user();
        }
        $id = is_object($user) ? (int) ($user->ID ?? 0) : 0;
        if ($id <= 0) {
            $mode = self::FULL; // anonymous: nothing to restrict here, WordPress capabilities already deny editing
        } elseif (user_can($user, 'manage_options')) {
            $mode = self::FULL;
        } else {
            $roles = array_values(array_filter((array) ($user->roles ?? []), 'is_string'));
            $config = self::roles_config();
            $mode = $roles ? self::NONE : self::FULL;
            foreach ($roles as $role) {
                $candidate = $config[$role] ?? self::FULL;
                if (self::RANK[$candidate] > self::RANK[$mode]) {
                    $mode = $candidate;
                }
            }
        }
        $mode = apply_filters('zadex/team/access_mode', $mode, $user);
        return in_array($mode, self::MODES, true) ? $mode : self::FULL;
    }

    /** Access mode of the current user. */
    public static function mode(): string
    {
        return self::mode_for_user(null);
    }

    /** `zadex/editor/can_edit`: "No access" roles never open the editor (and never see the Edit with Zadex links). */
    public static function filter_can_edit($can, $post_id = 0): bool
    {
        return (bool) $can && self::mode() !== self::NONE;
    }
}