<?php
/**
 * Runs on plugin activation.
 *
 * @package ABDS_SEO
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Activation routine: DB schema, role/capability, default options, and the
 * recurring background scan schedule.
 */
class ABDS_SEO_Activator {

	/**
	 * Full-access capability: technical audit, site settings, reports,
	 * rank tracking, local SEO, AI/SERP configuration, license. Granted to
	 * Administrator and the SEO-менеджер role. Kept as "manage_abds_seo"
	 * (the TZ writes "manage_seo_plugin") because renaming a capability
	 * already granted on live sites would silently revoke access — the
	 * name is an internal identifier, and what matters is the two access
	 * levels below actually differ.
	 */
	const CAPABILITY = 'manage_abds_seo';

	/**
	 * Content-level capability: view content recommendations and the
	 * content SEO score. Combined with WordPress's own edit_post at the
	 * REST layer, this scopes Author/Editor to their own posts, while
	 * leaving the full technical audit and settings behind CAPABILITY.
	 */
	const CONTENT_CAPABILITY = 'edit_abds_seo_content';

	/**
	 * R1 (F1.5) admin-menu-page-level capability: gates the Tools and Plans
	 * screens. Granted to the same roles CAPABILITY already covers — this
	 * is purely additive, page-render-gating only. The REST permission
	 * layer (class-abds-seo-rest-base.php) deliberately keeps using
	 * CAPABILITY/CONTENT_CAPABILITY unchanged in R1; do not introduce this
	 * constant there without a separate, explicitly-reviewed change (see
	 * that file's own docblock on the activate_plugins double-gate).
	 */
	const MANAGE_CAPABILITY = 'abds_seo_manage';

	/**
	 * R1 (F1.5) admin-menu-page-level capability: gates Dashboard, SEO
	 * Audit, and Content SEO. Mirrors CONTENT_CAPABILITY's existing
	 * Editor/Author scope — same audience, a page-render-gating name of
	 * its own rather than reusing CONTENT_CAPABILITY, since a future
	 * release may need the two to diverge.
	 */
	const AUDIT_CAPABILITY = 'abds_seo_audit';

	/**
	 * R1 (F1.5) admin-menu-page-level capability: gates the Settings
	 * screen only. Granted to the same roles CAPABILITY already covers.
	 */
	const SETTINGS_CAPABILITY = 'abds_seo_settings';

	/**
	 * Option storing which capability-assignment revision has run, so the
	 * additive role migration re-applies exactly once per bump on sites
	 * that were activated before the two-tier split existed.
	 */
	const CAPS_VERSION_OPTION = 'abds_seo_caps_version';

	/**
	 * Current capability-assignment revision. Bumped to '3' for R1's three
	 * new admin-menu-page-level capabilities (MANAGE_CAPABILITY,
	 * AUDIT_CAPABILITY, SETTINGS_CAPABILITY) — additive only, see
	 * capability_map().
	 */
	const CAPS_VERSION = '3';

	/**
	 * Transient key ABDS_SEO_Admin::maybe_activation_redirect() checks for
	 * the one-time post-activation redirect to the Dashboard.
	 */
	const ACTIVATION_REDIRECT_TRANSIENT = 'abds_seo_activation_redirect';

	/**
	 * Runs on plugin activation.
	 */
	public static function activate() {
		ABDS_SEO_DB_Installer::install();
		self::add_seo_manager_role();
		self::assign_capabilities();
		self::set_default_options();

		if ( function_exists( 'as_has_scheduled_action' ) && function_exists( 'as_schedule_recurring_action' ) ) {
			if ( ! as_has_scheduled_action( 'abds_seo_run_site_scan' ) ) {
				as_schedule_recurring_action( time() + HOUR_IN_SECONDS, DAY_IN_SECONDS, 'abds_seo_run_site_scan', array(), 'abds-seo' );
			}
		}

		set_transient( self::ACTIVATION_REDIRECT_TRANSIENT, 1, MINUTE_IN_SECONDS );

		flush_rewrite_rules();
	}

	/**
	 * Registers the "SEO-менеджер" role, per the role/permission table in
	 * the TZ (§2.10, §3). Capability grants for existing roles are handled
	 * separately by assign_capabilities() so the activation path and the
	 * upgrade path share one additive implementation.
	 */
	protected static function add_seo_manager_role() {
		if ( ! get_role( 'seo_manager' ) ) {
			$caps = array_fill_keys( self::capability_map()['seo_manager'], true );

			add_role(
				'seo_manager',
				__( 'SEO Manager', 'abds-seo' ),
				array_merge(
					array( 'read' => true ),
					$caps,
					array( 'edit_posts' => true )
				)
			);
		}
	}

	/**
	 * The role => capabilities the plugin grants, additively. Full access
	 * (including the R1 admin-menu-page caps) for Administrator/
	 * SEO-менеджер; content+audit access for Editor and Author (their own
	 * posts, scoped by edit_post at the REST layer) — audit mirrors
	 * CONTENT_CAPABILITY's existing scope, per the R1 plan sign-off.
	 *
	 * @return array<string, string[]> Role slug => capabilities to add.
	 */
	public static function capability_map(): array {
		$full = array(
			self::CAPABILITY,
			self::CONTENT_CAPABILITY,
			self::MANAGE_CAPABILITY,
			self::AUDIT_CAPABILITY,
			self::SETTINGS_CAPABILITY,
		);

		return array(
			'administrator' => $full,
			'seo_manager'   => $full,
			'editor'        => array( self::CONTENT_CAPABILITY, self::AUDIT_CAPABILITY ),
			'author'        => array( self::CONTENT_CAPABILITY, self::AUDIT_CAPABILITY ),
		);
	}

	/**
	 * Additively grants the plugin's capabilities to their roles. Uses
	 * WP_Role::add_cap, which is idempotent and never removes an existing
	 * capability — so re-running never revokes access, and a site owner
	 * who has hand-tuned role assignments keeps them. Runs on activation
	 * and, via maybe_upgrade_caps(), once per CAPS_VERSION bump on sites
	 * that predate a change.
	 */
	public static function assign_capabilities() {
		foreach ( self::capability_map() as $role_slug => $capabilities ) {
			$role = get_role( $role_slug );
			if ( ! $role ) {
				continue;
			}

			foreach ( $capabilities as $capability ) {
				if ( ! $role->has_cap( $capability ) ) {
					$role->add_cap( $capability );
				}
			}
		}

		update_option( self::CAPS_VERSION_OPTION, self::CAPS_VERSION );
	}

	/**
	 * Re-applies the additive capability grants once per CAPS_VERSION on
	 * already-active sites (activation only fires once, and existing sites
	 * never re-run activate()). Hooked to plugins_loaded. Safe to call on
	 * every request — it no-ops when the stored revision is current.
	 */
	public static function maybe_upgrade_caps() {
		if ( get_option( self::CAPS_VERSION_OPTION ) === self::CAPS_VERSION ) {
			return;
		}

		self::assign_capabilities();
	}

	/**
	 * Seeds the plugin's default settings option if it doesn't already exist.
	 */
	protected static function set_default_options() {
		add_option(
			'abds_seo_settings',
			array(
				'migration_completed'    => false,
				'ai_provider'            => '',
				'ai_api_key_encrypted'   => '',
				'keep_data_on_uninstall' => true,
			)
		);
	}
}