<?php
namespace Zadex\Team;

defined('ABSPATH') || exit;

use WP_Error;

/**
 * `rest_request_before_callbacks` (T170): the REST side of the role modes, for routes the document save guard
 * (ContentGuard) does not cover.
 *
 *  - "No access" users get 403 on every editor route (documents, global, render, notes, library, dynamic,
 *    widgets, templates). Public routes (form submit, loop pagination) are untouched.
 *  - "Content only" users cannot write site settings (`POST /global`), the template library, theme-template
 *    conditions, or restore a revision (a revision may change the structure).
 */
final class RestGuard
{
    public const EDITOR_ROUTES = '#^/zadex/v1/(documents|global|render|notes|library|dynamic|widgets|templates)(/|$)#';
    public const CONTENT_BLOCKED = '#^/zadex/v1/(global|library|templates)(/|$)|^/zadex/v1/documents/\d+/revisions/\d+/restore$#';

    /**
     * @param mixed $response
     * @param mixed $handler
     * @param \WP_REST_Request|object $request
     * @return mixed
     */
    public static function before_callbacks($response, $handler, $request)
    {
        if ($response instanceof WP_Error || !is_object($request) || !method_exists($request, 'get_route')) {
            return $response;
        }
        $route = (string) $request->get_route();
        if (strpos($route, '/zadex/v1/') !== 0 || !is_user_logged_in()) {
            return $response;
        }
        $mode = Access::mode();
        if ($mode === Access::NONE && preg_match(self::EDITOR_ROUTES, $route)) {
            return new WP_Error('zadex_no_access', __('Your role has no access to the Zadex editor.', 'zadex'), ['status' => 403]);
        }
        $method = method_exists($request, 'get_method') ? strtoupper((string) $request->get_method()) : 'GET';
        if ($mode === Access::CONTENT && $method !== 'GET' && preg_match(self::CONTENT_BLOCKED, $route)) {
            return new WP_Error('zadex_content_only', __('Your role can only edit the content of pages: this action is not allowed.', 'zadex'), ['status' => 403]);
        }
        return $response;
    }
}