<?php
/**
 * Plugin Name: AdBear Roles and Admin Access Manager
 * Plugin URI: https://wordpressplugin.adbear.cloud/adbear-roles-and-admin-access-manager/
 * Description: Manage WordPress roles, admin menus, dashboard widgets, login redirects, ACF access, and wp-login branding by user role.
 * Version: 0.6.3
 * Author: Adbear Digital
 * Author URI: https://wordpressplugin.adbear.cloud/
 * Text Domain: adbear-roles-admin-access-manager
 * Requires at least: 6.0
 * Requires PHP: 7.4
 * License: GPLv2 or later
 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 */

if (!defined('ABSPATH')) {
    exit;
}

require_once plugin_dir_path(__FILE__) . 'includes/class-adbam-our-plugins.php';

final class Adbam_Admin_Access {

    const VERSION = '0.6.3';
    const MENU_SLUG = 'adbear-admin-access';
    const NONCE_ACTION = 'adbam_manage_settings';
    const NONCE_FIELD = 'adbam_nonce';

    const OPTION_MENU_RULES = 'adbam_menu_rules';
    const OPTION_DASHBOARD_RULES = 'adbam_dashboard_rules';
    const OPTION_ADMIN_BAR_RULES = 'adbam_admin_bar_rules';
    const OPTION_LOGIN_REDIRECT_RULES = 'adbam_login_redirect_rules';
    const OPTION_ACF_RULES = 'adbam_acf_rules';
    const OPTION_BRANDING = 'adbam_branding_settings';

    /**
     * Singleton instance.
     *
     * @var self|null
     */
    private static $instance = null;

    /**
     * Get singleton instance.
     *
     * @return self
     */
    public static function instance() {
        if (self::$instance === null) {
            self::$instance = new self();
        }
        return self::$instance;
    }

    /**
     * Constructor.
     */
    private function __construct() {
        add_action('admin_menu', [$this, 'register_admin_menu']);
        add_action('admin_init', [$this, 'handle_forms']);
        add_action('admin_init', [$this, 'enforce_admin_page_access'], 1);
        add_action('admin_enqueue_scripts', [$this, 'enqueue_admin_assets']);
        add_action('admin_menu', [$this, 'apply_menu_rules'], 9999);
        add_action('wp_dashboard_setup', [$this, 'apply_dashboard_rules'], 999);
        add_action('admin_bar_menu', [$this, 'apply_admin_bar_rules'], 999);
        add_filter('login_redirect', [$this, 'apply_login_redirect'], 10, 3);
        add_filter('acf/load_field_groups', [$this, 'apply_acf_rules']);
        add_action('login_enqueue_scripts', [$this, 'enqueue_login_branding']);
        add_filter('login_headerurl', [$this, 'login_logo_url']);
        add_filter('login_headertext', [$this, 'login_logo_title']);
        add_filter('admin_footer_text', [$this, 'admin_footer_text']);
        add_action('admin_enqueue_scripts', [$this, 'enqueue_modern_admin_assets']);
        add_action('plugins_loaded', [self::class, 'maybe_migrate_legacy_options']);
    }

    /**
     * Migrate options from the legacy arc_ prefix.
     */
    public static function maybe_migrate_legacy_options() {
        $legacy_map = [
            'arc_menu_rules' => self::OPTION_MENU_RULES,
            'arc_dashboard_rules' => self::OPTION_DASHBOARD_RULES,
            'arc_admin_bar_rules' => self::OPTION_ADMIN_BAR_RULES,
            'arc_login_redirect_rules' => self::OPTION_LOGIN_REDIRECT_RULES,
            'arc_acf_rules' => self::OPTION_ACF_RULES,
            'arc_branding_settings' => self::OPTION_BRANDING,
        ];

        foreach ($legacy_map as $legacy_key => $new_key) {
            $legacy_value = get_option($legacy_key, null);
            if ($legacy_value === null) {
                continue;
            }
            if (false === get_option($new_key, false)) {
                add_option($new_key, $legacy_value);
            }
            delete_option($legacy_key);
        }
    }

    /**
     * Activation hook.
     */
    public static function activate() {
        self::maybe_migrate_legacy_options();

        if (!get_option(self::OPTION_MENU_RULES)) {
            add_option(self::OPTION_MENU_RULES, []);
        }
        if (!get_option(self::OPTION_DASHBOARD_RULES)) {
            add_option(self::OPTION_DASHBOARD_RULES, []);
        }
        if (!get_option(self::OPTION_ADMIN_BAR_RULES)) {
            add_option(self::OPTION_ADMIN_BAR_RULES, []);
        }
        if (!get_option(self::OPTION_LOGIN_REDIRECT_RULES)) {
            add_option(self::OPTION_LOGIN_REDIRECT_RULES, []);
        }
        if (!get_option(self::OPTION_ACF_RULES)) {
            add_option(self::OPTION_ACF_RULES, []);
        }
        if (!get_option(self::OPTION_BRANDING)) {
            add_option(self::OPTION_BRANDING, (new self())->default_branding_settings());
        }
    }

    /**
     * Register admin menus.
     */
    public function register_admin_menu() {
        add_menu_page(
            __('AdBear Roles', 'adbear-roles-admin-access-manager'),
            __('AdBear Roles', 'adbear-roles-admin-access-manager'),
            'manage_options',
            self::MENU_SLUG,
            [$this, 'render_roles_page'],
            'dashicons-shield-alt',
            81
        );

        add_submenu_page(self::MENU_SLUG, __('Roles & Capabilities', 'adbear-roles-admin-access-manager'), __('Roles & Capabilities', 'adbear-roles-admin-access-manager'), 'manage_options', self::MENU_SLUG, [$this, 'render_roles_page']);
        add_submenu_page(self::MENU_SLUG, __('Admin Menu Visibility', 'adbear-roles-admin-access-manager'), __('Admin Menu Visibility', 'adbear-roles-admin-access-manager'), 'manage_options', self::MENU_SLUG . '-menus', [$this, 'render_menus_page']);
        add_submenu_page(self::MENU_SLUG, __('Dashboard Widgets', 'adbear-roles-admin-access-manager'), __('Dashboard Widgets', 'adbear-roles-admin-access-manager'), 'manage_options', self::MENU_SLUG . '-dashboard', [$this, 'render_dashboard_page']);
        add_submenu_page(self::MENU_SLUG, __('Admin Bar', 'adbear-roles-admin-access-manager'), __('Admin Bar', 'adbear-roles-admin-access-manager'), 'manage_options', self::MENU_SLUG . '-admin-bar', [$this, 'render_admin_bar_page']);
        add_submenu_page(self::MENU_SLUG, __('Login Redirects', 'adbear-roles-admin-access-manager'), __('Login Redirects', 'adbear-roles-admin-access-manager'), 'manage_options', self::MENU_SLUG . '-redirects', [$this, 'render_redirects_page']);
        add_submenu_page(self::MENU_SLUG, __('ACF Group Visibility', 'adbear-roles-admin-access-manager'), __('ACF Group Visibility', 'adbear-roles-admin-access-manager'), 'manage_options', self::MENU_SLUG . '-acf', [$this, 'render_acf_page']);
        add_submenu_page(self::MENU_SLUG, __('Login & Branding', 'adbear-roles-admin-access-manager'), __('Login & Branding', 'adbear-roles-admin-access-manager'), 'manage_options', self::MENU_SLUG . '-branding', [$this, 'render_branding_page']);
    }

    /**
     * Enqueue admin assets.
     *
     * @param string $hook Current admin page hook.
     */
    public function enqueue_admin_assets($hook) {
        if (strpos((string) $hook, self::MENU_SLUG) === false) {
            return;
        }

        wp_register_style('adbam-admin', false, [], self::VERSION);
        wp_enqueue_style('adbam-admin');
        wp_add_inline_style(
            'adbam-admin',
            '.arc-wrap{max-width:1220px}.arc-card{background:#fff;border:1px solid #dcdcde;border-radius:10px;padding:18px;margin:16px 0}.arc-grid{display:grid;grid-template-columns:1fr 1fr;gap:16px}.arc-field{margin-bottom:14px}.arc-field label{font-weight:600;display:block;margin-bottom:6px}.arc-field input[type=text],.arc-field select,.arc-field input[type=url],.arc-field input[type=number]{width:100%;max-width:440px}.arc-cap-list,.arc-menu-list{columns:2;max-height:390px;overflow:auto;border:1px solid #dcdcde;padding:12px;background:#fafafa}.arc-cap-list label,.arc-menu-list label{display:block;margin:0 0 7px}.arc-table th{font-weight:600}.arc-table th,.arc-table td{padding:14px 16px!important;vertical-align:middle!important}.arc-table .arc-actions{min-width:150px}.arc-badge{display:inline-block;background:#f0f0f1;border-radius:20px;padding:2px 8px;font-size:12px}.arc-actions,.arc-bulk-actions{display:flex;gap:8px;align-items:center;flex-wrap:wrap}.arc-actions{white-space:nowrap}.arc-actions form{margin:0!important;display:inline-flex}.arc-actions .button{min-width:64px;justify-content:center}.arc-bulk-actions{margin:0 0 10px}.arc-warning{background:#fff8e5;border-left:4px solid #dba617;padding:10px 12px;margin:12px 0}.arc-info{background:#f0f6fc;border-left:4px solid #72aee6;padding:10px 12px;margin:12px 0}.arc-submit-row{margin-top:14px}.arc-muted{color:#646970}.arc-code{background:#f6f7f7;border:1px solid #dcdcde;padding:12px;border-radius:8px}.arc-media-preview img{max-width:180px;height:auto;border-radius:8px;border:1px solid #dcdcde}@media(max-width:900px){.arc-grid{grid-template-columns:1fr}.arc-cap-list,.arc-menu-list{columns:1}}'
        );

        if (strpos((string) $hook, 'adbear-admin-access-our-plugins') !== false) {
            return;
        }

        wp_enqueue_media();
        wp_register_script('adbam-admin-js', false, ['jquery'], self::VERSION, true);
        wp_enqueue_script('adbam-admin-js');
        wp_add_inline_script(
            'adbam-admin-js',
            "jQuery(function($){
                $('.arc-select-all').on('click',function(e){e.preventDefault();$(this).closest('form').find('input[type=checkbox]').prop('checked',true);});
                $('.arc-clear-all').on('click',function(e){e.preventDefault();$(this).closest('form').find('input[type=checkbox]').prop('checked',false);});
                $('.arc-media-upload').on('click',function(e){e.preventDefault();var input=$(this).data('target');var frame=wp.media({title:'Select Image',button:{text:'Use Image'},multiple:false});frame.on('select',function(){var url=frame.state().get('selection').first().toJSON().url;$('#'+input).val(url);});frame.open();});
            });"
        );
    }

    /**
     * Handle admin form submissions.
     */
    public function handle_forms() {
        if (!is_admin() || !current_user_can('manage_options')) {
            return;
        }

        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Bail before verifying when this plugin form was not submitted.
        if (!isset($_POST['adbam_action'])) {
            return;
        }

        check_admin_referer(self::NONCE_ACTION, self::NONCE_FIELD);

        $action = sanitize_key($this->get_post_value('adbam_action', ''));
        $allowed_actions = [
            'save_role',
            'delete_role',
            'clone_role',
            'save_default_role',
            'save_menu_rules',
            'save_dashboard_rules',
            'save_admin_bar_rules',
            'save_login_redirects',
            'save_acf_rules',
            'save_branding',
        ];

        if (!in_array($action, $allowed_actions, true)) {
            return;
        }

        switch ($action) {
            case 'save_role':
                $this->save_role();
                break;
            case 'delete_role':
                $this->delete_role();
                break;
            case 'clone_role':
                $this->clone_role();
                break;
            case 'save_default_role':
                $this->save_default_role();
                break;
            case 'save_menu_rules':
                $this->save_menu_rules();
                break;
            case 'save_dashboard_rules':
                $this->save_dashboard_rules();
                break;
            case 'save_admin_bar_rules':
                $this->save_admin_bar_rules();
                break;
            case 'save_login_redirects':
                $this->save_login_redirects();
                break;
            case 'save_acf_rules':
                $this->save_acf_rules();
                break;
            case 'save_branding':
                $this->save_branding();
                break;
        }
    }

    /**
     * Retrieve a POST value after nonce verification in handle_forms().
     *
     * @param string $key     Field key.
     * @param mixed  $default Default value.
     * @return mixed
     */
    private function get_post_value($key, $default = '') {
        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Verified in handle_forms().
        if (!isset($_POST[$key])) {
            return $default;
        }

        // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Verified in handle_forms(); sanitized by callers.
        return wp_unslash($_POST[$key]);
    }

    /**
     * Retrieve a GET query argument for read-only admin UI state.
     *
     * @param string $key     Query key.
     * @param string $default Default value.
     * @return string
     */
    private function get_query_arg($key, $default = '') {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only admin navigation parameter.
        if (!isset($_GET[$key])) {
            return $default;
        }

        // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Read-only admin navigation parameter; sanitized by callers.
        $value = wp_unslash($_GET[$key]);
        return is_string($value) ? $value : $default;
    }

    /**
     * Redirect after form save.
     *
     * @param string $notice Notice key.
     * @param string $page   Page slug.
     */
    private function redirect($notice, $page = self::MENU_SLUG) {
        $notice = sanitize_key($notice);
        $url = add_query_arg('adbam_notice', $notice, menu_page_url($page, false));
        wp_safe_redirect($url);
        exit;
    }

    /**
     * Sanitize internal redirect URL.
     *
     * @param string $url Raw URL.
     * @return string
     */
    private function sanitize_internal_redirect_url($url) {
        $url = trim((string) $url);
        if ($url === '') {
            return '';
        }
        if ($url[0] === '/') {
            $url = home_url($url);
        }
        $url = esc_url_raw($url);
        if ($url === '') {
            return '';
        }
        $validated = wp_validate_redirect($url, admin_url());
        return $validated ? $validated : '';
    }

    /**
     * Sanitize CSS gradient value.
     *
     * @param string $value Raw gradient.
     * @return string
     */
    private function sanitize_css_gradient($value) {
        $value = wp_strip_all_tags((string) $value);
        $value = preg_replace('/[\x00-\x1F\x7F]/', '', $value);
        $value = trim($value);
        if ($value !== '' && preg_match('/^(linear-gradient|radial-gradient)\([^;{}<>\\\\]+\)$/i', $value)) {
            return $value;
        }
        return 'linear-gradient(135deg,#eef4ff 0%,#ffffff 45%,#f5f7fb 100%)';
    }

    /**
     * Save role and capabilities.
     */
    private function save_role() {
        global $wp_roles;

        $role_key = sanitize_key($this->get_post_value('role_key', ''));
        $role_label = sanitize_text_field($this->get_post_value('role_label', ''));
        $original_role = sanitize_key($this->get_post_value('original_role', ''));
        $custom_caps = sanitize_textarea_field($this->get_post_value('custom_caps', ''));
        $caps_raw = $this->get_post_value('caps', []);
        $caps = is_array($caps_raw) ? array_map('sanitize_key', $caps_raw) : [];

        if ($role_key === '' || $role_label === '') {
            $this->redirect('error');
        }

        if ($role_key === 'administrator') {
            $this->redirect('protected');
        }

        $cap_map = [];
        foreach ($caps as $cap) {
            if ($cap !== '') {
                $cap_map[$cap] = true;
            }
        }

        foreach (preg_split('/[\s,]+/', $custom_caps) as $cap) {
            $cap = sanitize_key($cap);
            if ($cap !== '') {
                $cap_map[$cap] = true;
            }
        }

        if ($original_role && $original_role !== $role_key && get_role($original_role)) {
            remove_role($original_role);
        }

        $existing = get_role($role_key);
        if ($existing) {
            foreach ($existing->capabilities as $cap => $grant) {
                $existing->remove_cap($cap);
            }
            foreach ($cap_map as $cap => $grant) {
                $existing->add_cap($cap, $grant);
            }
            $wp_roles->roles[$role_key]['name'] = $role_label;
            $wp_roles->role_names[$role_key] = $role_label;
            update_option('wp_user_roles', $wp_roles->roles);
        } else {
            add_role($role_key, $role_label, $cap_map);
        }

        $this->redirect('saved');
    }

    /**
     * Delete a custom role.
     */
    private function delete_role() {
        $role_key = sanitize_key($this->get_post_value('role_key', ''));
        $protected = ['administrator', 'editor', 'author', 'contributor', 'subscriber'];

        if ($role_key && !in_array($role_key, $protected, true)) {
            remove_role($role_key);
            $option_keys = [
                self::OPTION_MENU_RULES,
                self::OPTION_DASHBOARD_RULES,
                self::OPTION_ADMIN_BAR_RULES,
                self::OPTION_ACF_RULES,
            ];
            foreach ($option_keys as $option_key) {
                $rules = get_option($option_key, []);
                if (isset($rules[$role_key])) {
                    unset($rules[$role_key]);
                    update_option($option_key, $rules);
                }
            }
            $redirects = get_option(self::OPTION_LOGIN_REDIRECT_RULES, []);
            if (isset($redirects[$role_key])) {
                unset($redirects[$role_key]);
                update_option(self::OPTION_LOGIN_REDIRECT_RULES, $redirects);
            }
        }

        $this->redirect('deleted');
    }

    /**
     * Clone an existing role.
     */
    private function clone_role() {
        global $wp_roles;

        $source = sanitize_key($this->get_post_value('source_role', ''));
        $new_key = sanitize_key($this->get_post_value('new_role_key', ''));
        $new_label = sanitize_text_field($this->get_post_value('new_role_label', ''));

        if (!$source || !$new_key || !$new_label || get_role($new_key)) {
            $this->redirect('error');
        }

        $source_role = get_role($source);
        if (!$source_role) {
            $this->redirect('error');
        }

        add_role($new_key, $new_label, $source_role->capabilities);
        $this->redirect('cloned');
    }

    /**
     * Save default registration role.
     */
    private function save_default_role() {
        $role_key = sanitize_key($this->get_post_value('default_role', ''));
        if ($role_key && get_role($role_key)) {
            update_option('default_role', $role_key);
        }
        $this->redirect('default_saved');
    }

    /**
     * Save admin menu visibility rules.
     */
    private function save_menu_rules() {
        $role_key = sanitize_key($this->get_post_value('role_key', ''));
        $allowed_menus_raw = $this->get_post_value('allowed_menus', []);
        $allowed_menus = is_array($allowed_menus_raw) ? array_map('sanitize_text_field', $allowed_menus_raw) : [];
        $rules_enabled = !empty($this->get_post_value('rules_enabled', ''));

        if (!$role_key) {
            $this->redirect('error', self::MENU_SLUG . '-menus');
        }

        $rules = get_option(self::OPTION_MENU_RULES, []);
        if ($rules_enabled) {
            $rules[$role_key] = array_values(array_unique(array_filter($allowed_menus)));
        } else {
            unset($rules[$role_key]);
        }
        update_option(self::OPTION_MENU_RULES, $rules);
        $this->redirect('menu_saved', self::MENU_SLUG . '-menus');
    }

    /**
     * Save dashboard widget rules.
     */
    private function save_dashboard_rules() {
        $role_key = sanitize_key($this->get_post_value('role_key', ''));
        $allowed_raw = $this->get_post_value('allowed_widgets', []);
        $allowed = is_array($allowed_raw) ? array_map('sanitize_text_field', $allowed_raw) : [];
        $rules_enabled = !empty($this->get_post_value('rules_enabled', ''));

        if (!$role_key) {
            $this->redirect('error', self::MENU_SLUG . '-dashboard');
        }

        $rules = get_option(self::OPTION_DASHBOARD_RULES, []);
        if ($rules_enabled) {
            $rules[$role_key] = array_values(array_unique(array_filter($allowed)));
        } else {
            unset($rules[$role_key]);
        }
        update_option(self::OPTION_DASHBOARD_RULES, $rules);
        $this->redirect('dashboard_saved', self::MENU_SLUG . '-dashboard');
    }

    /**
     * Save admin bar rules.
     */
    private function save_admin_bar_rules() {
        $role_key = sanitize_key($this->get_post_value('role_key', ''));
        $allowed_raw = $this->get_post_value('allowed_nodes', []);
        $allowed = is_array($allowed_raw) ? array_map('sanitize_key', $allowed_raw) : [];
        $rules_enabled = !empty($this->get_post_value('rules_enabled', ''));

        if (!$role_key) {
            $this->redirect('error', self::MENU_SLUG . '-admin-bar');
        }

        $rules = get_option(self::OPTION_ADMIN_BAR_RULES, []);
        if ($rules_enabled) {
            $rules[$role_key] = array_values(array_unique(array_filter($allowed)));
        } else {
            unset($rules[$role_key]);
        }
        update_option(self::OPTION_ADMIN_BAR_RULES, $rules);
        $this->redirect('admin_bar_saved', self::MENU_SLUG . '-admin-bar');
    }

    /**
     * Save login redirect rules.
     */
    private function save_login_redirects() {
        $redirects = [];
        $redirects_raw = $this->get_post_value('redirects', []);
        if (!empty($redirects_raw) && is_array($redirects_raw)) {
            foreach ($redirects_raw as $role => $url) {
                $role = sanitize_key($role);
                $url = $this->sanitize_internal_redirect_url($url);
                if ($role && $url !== '') {
                    $redirects[$role] = $url;
                }
            }
        }
        update_option(self::OPTION_LOGIN_REDIRECT_RULES, $redirects);
        $this->redirect('redirects_saved', self::MENU_SLUG . '-redirects');
    }

    /**
     * Save ACF group visibility rules.
     */
    private function save_acf_rules() {
        $role_key = sanitize_key($this->get_post_value('role_key', ''));
        $allowed_raw = $this->get_post_value('allowed_groups', []);
        $allowed = is_array($allowed_raw) ? array_map('sanitize_text_field', $allowed_raw) : [];
        $rules_enabled = !empty($this->get_post_value('rules_enabled', ''));

        if (!$role_key) {
            $this->redirect('error', self::MENU_SLUG . '-acf');
        }

        $rules = get_option(self::OPTION_ACF_RULES, []);
        if ($rules_enabled) {
            $rules[$role_key] = array_values(array_unique(array_filter($allowed)));
        } else {
            unset($rules[$role_key]);
        }
        update_option(self::OPTION_ACF_RULES, $rules);
        $this->redirect('acf_saved', self::MENU_SLUG . '-acf');
    }

    /**
     * Save login branding settings.
     */
    private function save_branding() {
        $settings = $this->default_branding_settings();
        $settings['enabled'] = !empty($this->get_post_value('enabled', '')) ? 1 : 0;
        $settings['logo_url'] = esc_url_raw($this->get_post_value('logo_url', ''));
        $settings['background_type'] = sanitize_key($this->get_post_value('background_type', 'gradient'));
        if (!in_array($settings['background_type'], ['color', 'gradient', 'image'], true)) {
            $settings['background_type'] = 'gradient';
        }
        $settings['background_color'] = sanitize_hex_color($this->get_post_value('background_color', '#f3f6fb'));
        if (!$settings['background_color']) {
            $settings['background_color'] = '#f3f6fb';
        }
        $settings['background_gradient'] = $this->sanitize_css_gradient($this->get_post_value('background_gradient', $settings['background_gradient']));
        $settings['background_image'] = esc_url_raw($this->get_post_value('background_image', ''));
        $settings['button_color'] = sanitize_hex_color($this->get_post_value('button_color', '#2271b1'));
        if (!$settings['button_color']) {
            $settings['button_color'] = '#2271b1';
        }
        $settings['card_radius'] = min(40, absint($this->get_post_value('card_radius', 18)));
        $logo_link = esc_url_raw($this->get_post_value('logo_link', home_url('/')));
        $settings['logo_link'] = $logo_link !== '' ? $logo_link : home_url('/');
        $settings['logo_title'] = sanitize_text_field($this->get_post_value('logo_title', get_bloginfo('name')));
        $settings['footer_text'] = wp_kses_post($this->get_post_value('footer_text', ''));
        $settings['login_layout'] = sanitize_key($this->get_post_value('login_layout', 'center'));
        if (!in_array($settings['login_layout'], ['center', 'split'], true)) {
            $settings['login_layout'] = 'center';
        }
        $settings['side_image'] = esc_url_raw($this->get_post_value('side_image', ''));
        $settings['admin_modern_enabled'] = !empty($this->get_post_value('admin_modern_enabled', '')) ? 1 : 0;
        update_option(self::OPTION_BRANDING, $settings);
        $this->redirect('branding_saved', self::MENU_SLUG . '-branding');
    }

    /**
     * Default branding settings.
     *
     * @return array<string, mixed>
     */
    private function default_branding_settings() {
        return [
            'enabled' => 0,
            'logo_url' => '',
            'background_type' => 'gradient',
            'background_color' => '#f3f6fb',
            'background_gradient' => 'linear-gradient(135deg,#eef4ff 0%,#ffffff 45%,#f5f7fb 100%)',
            'background_image' => '',
            'button_color' => '#2271b1',
            'card_radius' => 18,
            'logo_link' => home_url('/'),
            'logo_title' => get_bloginfo('name'),
            'footer_text' => '',
            'login_layout' => 'center',
            'side_image' => '',
            'admin_modern_enabled' => 0,
        ];
    }

    /**
     * Get branding settings.
     *
     * @return array<string, mixed>
     */
    private function get_branding_settings() {
        $settings = wp_parse_args((array) get_option(self::OPTION_BRANDING, []), $this->default_branding_settings());
        $settings['background_gradient'] = $this->sanitize_css_gradient($settings['background_gradient']);
        $background_color = sanitize_hex_color($settings['background_color']);
        $settings['background_color'] = $background_color ? $background_color : '#f3f6fb';
        $button_color = sanitize_hex_color($settings['button_color']);
        $settings['button_color'] = $button_color ? $button_color : '#2271b1';
        $settings['logo_url'] = esc_url_raw($settings['logo_url']);
        $settings['background_image'] = esc_url_raw($settings['background_image']);
        $settings['side_image'] = esc_url_raw($settings['side_image']);
        $settings['logo_link'] = esc_url_raw($settings['logo_link']);
        if (!in_array($settings['background_type'], ['color', 'gradient', 'image'], true)) {
            $settings['background_type'] = 'gradient';
        }
        if (!in_array($settings['login_layout'], ['center', 'split'], true)) {
            $settings['login_layout'] = 'center';
        }
        $settings['card_radius'] = min(40, absint($settings['card_radius']));
        return $settings;
    }

    /**
     * Get current user's primary role for rule application.
     *
     * @return string
     */
    private function get_current_user_role() {
        $user = wp_get_current_user();
        if (!$user || empty($user->roles)) {
            return '';
        }
        if (in_array('administrator', $user->roles, true)) {
            return '';
        }
        return (string) $user->roles[0];
    }

    /**
     * Apply admin menu visibility rules.
     */
    public function apply_menu_rules() {
        $role_key = $this->get_current_user_role();
        if ($role_key === '') {
            return;
        }

        $rules = get_option(self::OPTION_MENU_RULES, []);
        if (empty($rules[$role_key]) || !is_array($rules[$role_key])) {
            return;
        }

        global $menu, $submenu;
        $allowed = $rules[$role_key];
        $allowed_lookup = array_flip($allowed);

        if (!empty($menu)) {
            foreach ($menu as $index => $item) {
                $slug = isset($item[2]) ? $item[2] : '';
                if ($slug && !isset($allowed_lookup[$slug])) {
                    remove_menu_page($slug);
                }
            }
        }

        if (!empty($submenu)) {
            foreach ($submenu as $parent => $items) {
                if (!isset($allowed_lookup[$parent])) {
                    remove_menu_page($parent);
                }
            }
        }
    }

    /**
     * Block direct URL access to hidden admin pages.
     */
    public function enforce_admin_page_access() {
        if (!is_admin() || wp_doing_ajax() || (defined('DOING_CRON') && DOING_CRON)) {
            return;
        }

        $role_key = $this->get_current_user_role();
        if ($role_key === '') {
            return;
        }

        $rules = get_option(self::OPTION_MENU_RULES, []);
        if (empty($rules[$role_key]) || !is_array($rules[$role_key])) {
            return;
        }

        $current_key = $this->get_current_admin_rule_key();
        if ($current_key === '' || $this->is_current_admin_page_allowed($rules[$role_key], $current_key)) {
            return;
        }

        wp_die(
            esc_html__('You do not have permission to access this admin page.', 'adbear-roles-admin-access-manager'),
            esc_html__('Access denied', 'adbear-roles-admin-access-manager'),
            ['response' => 403]
        );
    }

    /**
     * Get current admin page rule key.
     *
     * @return string
     */
    private function get_current_admin_rule_key() {
        global $plugin_page, $pagenow;

        if (!empty($plugin_page)) {
            return sanitize_text_field($plugin_page);
        }

        if ($this->get_query_arg('page') !== '') {
            return sanitize_text_field($this->get_query_arg('page'));
        }

        if ($this->get_query_arg('post_type') !== '') {
            return sanitize_key($this->get_query_arg('post_type'));
        }

        return sanitize_file_name((string) $pagenow);
    }

    /**
     * Check if current admin page is allowed.
     *
     * @param array<int, string> $allowed     Allowed keys.
     * @param string             $current_key Current key.
     * @return bool
     */
    private function is_current_admin_page_allowed(array $allowed, $current_key) {
        if (in_array($current_key, $allowed, true)) {
            return true;
        }

        foreach ($allowed as $item) {
            if (strpos($item, '.php') !== false && strpos($current_key, $item) !== false) {
                return true;
            }
        }

        return false;
    }

    /**
     * Apply dashboard widget visibility rules.
     */
    public function apply_dashboard_rules() {
        $role_key = $this->get_current_user_role();
        if ($role_key === '') {
            return;
        }

        $rules = get_option(self::OPTION_DASHBOARD_RULES, []);
        if (empty($rules[$role_key]) || !is_array($rules[$role_key])) {
            return;
        }

        global $wp_meta_boxes;
        $allowed = array_flip($rules[$role_key]);

        foreach ((array) $wp_meta_boxes['dashboard'] as $context => $priorities) {
            foreach ((array) $priorities as $priority => $boxes) {
                foreach ((array) $boxes as $box_id => $box) {
                    if (!isset($allowed[$box_id])) {
                        remove_meta_box($box_id, 'dashboard', $context);
                    }
                }
            }
        }
    }

    /**
     * Apply admin bar visibility rules.
     *
     * @param WP_Admin_Bar $wp_admin_bar Admin bar instance.
     */
    public function apply_admin_bar_rules($wp_admin_bar) {
        $role_key = $this->get_current_user_role();
        if ($role_key === '' || !is_object($wp_admin_bar)) {
            return;
        }

        $rules = get_option(self::OPTION_ADMIN_BAR_RULES, []);
        if (empty($rules[$role_key]) || !is_array($rules[$role_key])) {
            return;
        }

        $allowed = array_flip($rules[$role_key]);
        $nodes = $wp_admin_bar->get_nodes();

        foreach ((array) $nodes as $node) {
            if (!isset($allowed[$node->id])) {
                $wp_admin_bar->remove_node($node->id);
            }
        }
    }

    /**
     * Apply login redirect by role.
     *
     * @param string           $redirect_to           Redirect URL.
     * @param string           $requested_redirect_to Requested redirect.
     * @param WP_User|WP_Error $user                  User object.
     * @return string
     */
    public function apply_login_redirect($redirect_to, $requested_redirect_to, $user) {
        if (!$user || is_wp_error($user) || empty($user->roles)) {
            return $redirect_to;
        }

        $redirects = get_option(self::OPTION_LOGIN_REDIRECT_RULES, []);
        foreach ((array) $user->roles as $role) {
            if (!empty($redirects[$role])) {
                $validated = wp_validate_redirect($redirects[$role], admin_url());
                if ($validated) {
                    return $validated;
                }
            }
        }

        return $redirect_to;
    }

    /**
     * Apply ACF field group visibility rules.
     *
     * @param array<int, array<string, mixed>> $groups Field groups.
     * @return array<int, array<string, mixed>>
     */
    public function apply_acf_rules($groups) {
        if (!is_admin() || !function_exists('acf_get_field_groups')) {
            return $groups;
        }

        $role_key = $this->get_current_user_role();
        if ($role_key === '') {
            return $groups;
        }

        $rules = get_option(self::OPTION_ACF_RULES, []);
        if (empty($rules[$role_key]) || !is_array($rules[$role_key])) {
            return $groups;
        }

        $allowed = array_flip($rules[$role_key]);
        $filtered = [];

        foreach ((array) $groups as $group) {
            $key = isset($group['key']) ? $group['key'] : '';
            if ($key && isset($allowed[$key])) {
                $filtered[] = $group;
            }
        }

        return $filtered;
    }

    /**
     * Enqueue login branding styles.
     */
    public function enqueue_login_branding() {
        $settings = $this->get_branding_settings();
        if (empty($settings['enabled'])) {
            return;
        }

        $bg = '';
        if ($settings['background_type'] === 'color') {
            $bg = 'background:' . esc_attr($settings['background_color']) . '!important;';
        } elseif ($settings['background_type'] === 'image' && !empty($settings['background_image'])) {
            $bg = 'background:url(' . esc_url($settings['background_image']) . ') center/cover no-repeat!important;';
        } else {
            $bg = 'background:' . esc_attr($settings['background_gradient']) . '!important;';
        }

        $radius = absint($settings['card_radius']);
        $button = esc_attr($settings['button_color']);
        $logo = !empty($settings['logo_url']) ? esc_url($settings['logo_url']) : '';
        $layout = $settings['login_layout'];
        $side_image = !empty($settings['side_image']) ? esc_url($settings['side_image']) : '';
        $is_split = ($layout === 'split' && $side_image);

        $css = 'body.login{margin:0!important;padding:0!important;min-height:100vh!important;box-sizing:border-box;}';
        $css .= 'body.login #login{width:100%;max-width:420px;padding:0!important;margin:0!important;float:none!important;}';
        $css .= 'body.login #login h1{text-align:center;margin-bottom:18px;}';
        $css .= 'body.login #nav,body.login #backtoblog{text-align:center;margin:12px 0 0;padding:0;}';
        $css .= 'body.login #nav a,body.login #backtoblog a{display:inline-block;}';
        $css .= '#loginform,#registerform,#lostpasswordform{background:#fff;border:0;border-radius:' . $radius . 'px;box-shadow:0 18px 50px rgba(15,23,42,.12);padding:28px;margin:0;}';
        $css .= '.wp-core-ui .button-primary{background:' . $button . '!important;border-color:' . $button . '!important;border-radius:10px;box-shadow:none;}';

        if ($logo) {
            $css .= '#login h1 a{background-image:url(' . $logo . ');background-size:contain;background-position:center;width:100%;height:84px;margin:0 auto 18px;}';
        }

        if ($is_split) {
            $css .= 'body.login{display:grid!important;grid-template-columns:minmax(0,1fr) minmax(0,1fr);align-items:stretch;background:#fff!important;}';
            $css .= 'body.login::before{content:"";grid-column:1;grid-row:1;background:url(' . $side_image . ') center/cover no-repeat;min-height:100vh;}';
            $css .= 'body.login #login{grid-column:2;grid-row:1;justify-self:center;align-self:center;width:100%;max-width:420px;padding:40px 24px!important;min-height:auto;background:transparent;}';
            $css .= 'body.login #language-switcher{grid-column:2;grid-row:1;align-self:end;justify-self:center;position:relative!important;top:auto!important;right:auto!important;left:auto!important;bottom:auto!important;margin:0 0 24px;width:auto;z-index:2;}';
        } else {
            $css .= 'body.login{' . $bg . 'display:flex!important;flex-direction:column;align-items:center;justify-content:center;padding:24px!important;}';
            $css .= 'body.login #login{flex:0 0 auto;width:100%;max-width:420px;}';
            $css .= 'body.login #language-switcher{position:relative!important;top:auto!important;right:auto!important;left:auto!important;bottom:auto!important;margin:16px 0 0;text-align:center;width:100%;max-width:420px;}';
        }

        wp_register_style('adbam-login', false, [], self::VERSION);
        wp_enqueue_style('adbam-login');
        wp_add_inline_style('adbam-login', $css);
    }

    /**
     * Filter login logo URL.
     *
     * @param string $url Logo URL.
     * @return string
     */
    public function login_logo_url($url) {
        $settings = $this->get_branding_settings();
        if (!empty($settings['enabled']) && !empty($settings['logo_link'])) {
            return esc_url($settings['logo_link']);
        }
        return $url;
    }

    /**
     * Filter login logo title.
     *
     * @param string $title Logo title.
     * @return string
     */
    public function login_logo_title($title) {
        $settings = $this->get_branding_settings();
        if (!empty($settings['enabled']) && !empty($settings['logo_title'])) {
            return esc_attr($settings['logo_title']);
        }
        return $title;
    }

    /**
     * Filter admin footer text.
     *
     * @param string $text Footer text.
     * @return string
     */
    public function admin_footer_text($text) {
        $settings = $this->get_branding_settings();
        if (!empty($settings['enabled']) && !empty($settings['footer_text'])) {
            return wp_kses_post($settings['footer_text']);
        }
        return $text;
    }

    /**
     * Enqueue modern admin CSS when enabled.
     */
    public function enqueue_modern_admin_assets() {
        $settings = $this->get_branding_settings();
        if (empty($settings['admin_modern_enabled'])) {
            return;
        }

        wp_register_style('adbam-modern-admin', false, [], self::VERSION);
        wp_enqueue_style('adbam-modern-admin');
        wp_add_inline_style(
            'adbam-modern-admin',
            '#wpcontent{background:transparent!important;padding-left:100px;}'
            . '#adminmenu,#adminmenu .wp-submenu,#adminmenuback,#adminmenuwrap{width:260px!important;}'
            . '#adminmenuback,#adminmenuwrap,#adminmenu{background:#0f172a!important;}'
            . '#adminmenu a,#adminmenu .wp-submenu a{color:#cbd5e1!important;}'
            . '#adminmenu .wp-has-current-submenu>a,#adminmenu .current a.menu-top{color:#fff!important;background:#2563eb!important;}'
            . '#adminmenuwrap{box-shadow:10px 0 35px rgba(15,23,42,.16);}'
            . '#wpbody-content .wrap h1{font-weight:700;letter-spacing:-.02em;}'
            . '.arc-card,.postbox,.card{border-radius:14px!important;box-shadow:0 1px 3px rgba(15,23,42,.05)!important;}'
        );
    }

    /**
     * Get all capabilities.
     *
     * @return array<int, string>
     */
    private function get_all_capabilities() {
        global $wp_roles;
        $caps = [];
        foreach ($wp_roles->roles as $role) {
            foreach (array_keys((array) $role['capabilities']) as $cap) {
                $caps[$cap] = $cap;
            }
        }
        ksort($caps);
        return array_values($caps);
    }

    /**
     * Get admin menu items for rules UI.
     *
     * @return array<int, array{slug: string, label: string}>
     */
    private function get_admin_menus() {
        global $menu;
        $items = [];

        if (!is_array($menu)) {
            return $items;
        }

        foreach ($menu as $item) {
            if (empty($item[2])) {
                continue;
            }
            $items[] = [
                'slug' => $item[2],
                'label' => wp_strip_all_tags((string) $item[0]),
            ];
        }

        return $items;
    }

    /**
     * Get dashboard widgets for rules UI.
     *
     * @return array<int, array{id: string, label: string}>
     */
    private function get_dashboard_widgets() {
        global $wp_meta_boxes;
        $widgets = [];

        if (!function_exists('wp_dashboard_setup')) {
            require_once ABSPATH . 'wp-admin/includes/dashboard.php';
        }
        if (empty($wp_meta_boxes['dashboard'])) {
            wp_dashboard_setup();
        }

        if (!isset($wp_meta_boxes['dashboard']) || !is_array($wp_meta_boxes['dashboard'])) {
            return $widgets;
        }

        foreach ($wp_meta_boxes['dashboard'] as $context => $priorities) {
            foreach ((array) $priorities as $priority => $boxes) {
                foreach ((array) $boxes as $box_id => $box) {
                    $widgets[$box_id] = [
                        'id' => $box_id,
                        'label' => isset($box['title']) ? wp_strip_all_tags((string) $box['title']) : $box_id,
                    ];
                }
            }
        }

        return array_values($widgets);
    }

    /**
     * Collect raw admin bar nodes from a toolbar instance.
     *
     * @param mixed $admin_bar Admin bar instance.
     * @return array<string, object>
     */
    private function collect_admin_bar_nodes_from_bar($admin_bar) {
        if (!is_object($admin_bar) || !method_exists($admin_bar, 'get_nodes')) {
            return [];
        }

        return array_filter((array) $admin_bar->get_nodes());
    }

    /**
     * Format admin bar nodes for the settings UI.
     *
     * @param array<string, object> $nodes_map Raw admin bar nodes.
     * @return array<int, array{id: string, label: string}>
     */
    private function format_admin_bar_nodes_list(array $nodes_map) {
        $nodes = [];

        foreach ($nodes_map as $node) {
            if (!is_object($node) || empty($node->id)) {
                continue;
            }

            $label = trim(wp_strip_all_tags((string) $node->title));
            if ($label === '') {
                $label = (string) $node->id;
            }

            $nodes[$node->id] = [
                'id' => (string) $node->id,
                'label' => $label,
            ];
        }

        uasort(
            $nodes,
            static function ($a, $b) {
                return strcasecmp($a['label'], $b['label']);
            }
        );

        return array_values($nodes);
    }

    /**
     * Bootstrap admin bar nodes for the settings screen.
     *
     * @return array<int, array{id: string, label: string}>
     */
    private function bootstrap_admin_bar_nodes_for_settings() {
        global $wp_admin_bar;

        if (!class_exists('WP_Admin_Bar')) {
            require_once ABSPATH . WPINC . '/class-wp-admin-bar.php';
        }

        if (!function_exists('_wp_admin_bar_init')) {
            require_once ABSPATH . 'wp-admin/includes/admin-bar.php';
        }

        $existing_nodes = $this->collect_admin_bar_nodes_from_bar($wp_admin_bar);
        if (!empty($existing_nodes)) {
            return $this->format_admin_bar_nodes_list($existing_nodes);
        }

        if (!did_action('add_admin_bar_menus')) {
            do_action('add_admin_bar_menus');
        }

        if (!is_object($wp_admin_bar)) {
            $wp_admin_bar = new WP_Admin_Bar();
            $wp_admin_bar->initialize();
        }

        do_action_ref_array('admin_bar_menu', [&$wp_admin_bar]);

        $nodes_map = $this->collect_admin_bar_nodes_from_bar($wp_admin_bar);
        if (!empty($nodes_map)) {
            return $this->format_admin_bar_nodes_list($nodes_map);
        }

        $force_show = static function () {
            return true;
        };

        add_filter('show_admin_bar', $force_show, PHP_INT_MAX);
        _wp_admin_bar_init();
        remove_filter('show_admin_bar', $force_show, PHP_INT_MAX);

        return $this->format_admin_bar_nodes_list($this->collect_admin_bar_nodes_from_bar($wp_admin_bar));
    }

    /**
     * Get admin bar nodes for rules UI.
     *
     * @return array<int, array{id: string, label: string}>
     */
    private function get_admin_bar_nodes() {
        return $this->bootstrap_admin_bar_nodes_for_settings();
    }

    /**
     * Get ACF field groups for rules UI.
     *
     * @return array<int, array{key: string, label: string}>
     */
    private function get_acf_groups() {
        if (!function_exists('acf_get_field_groups')) {
            return [];
        }

        $groups = [];
        foreach (acf_get_field_groups() as $group) {
            $groups[] = [
                'key' => isset($group['key']) ? $group['key'] : '',
                'label' => isset($group['title']) ? $group['title'] : '',
            ];
        }

        return $groups;
    }

    /**
     * Render admin notice.
     */
    private function render_notice() {
        $notice = sanitize_key($this->get_query_arg('adbam_notice', ''));
        if ($notice === '') {
            return;
        }

        $messages = [
            'saved' => __('Role saved successfully.', 'adbear-roles-admin-access-manager'),
            'deleted' => __('Role deleted.', 'adbear-roles-admin-access-manager'),
            'cloned' => __('Role cloned successfully.', 'adbear-roles-admin-access-manager'),
            'default_saved' => __('Default role updated.', 'adbear-roles-admin-access-manager'),
            'menu_saved' => __('Admin menu rules saved.', 'adbear-roles-admin-access-manager'),
            'dashboard_saved' => __('Dashboard widget rules saved.', 'adbear-roles-admin-access-manager'),
            'admin_bar_saved' => __('Admin bar rules saved.', 'adbear-roles-admin-access-manager'),
            'redirects_saved' => __('Login redirects saved.', 'adbear-roles-admin-access-manager'),
            'acf_saved' => __('ACF group rules saved.', 'adbear-roles-admin-access-manager'),
            'branding_saved' => __('Branding settings saved.', 'adbear-roles-admin-access-manager'),
            'protected' => __('The administrator role cannot be modified.', 'adbear-roles-admin-access-manager'),
            'error' => __('There was a problem saving your changes.', 'adbear-roles-admin-access-manager'),
        ];

        if (!isset($messages[$notice])) {
            return;
        }

        $class = ($notice === 'error' || $notice === 'protected') ? 'notice-error' : 'notice-success';
        echo '<div class="notice ' . esc_attr($class) . ' is-dismissible"><p>' . esc_html($messages[$notice]) . '</p></div>';
    }

    /**
     * Output nonce field.
     */
    private function render_nonce_field() {
        wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD);
        echo '<input type="hidden" name="adbam_action" value="" id="adbam-action-field" />';
    }

    /**
     * Render role selector field.
     *
     * @param string $selected Selected role.
     */
    private function render_role_selector($selected) {
        global $wp_roles;
        $page = sanitize_key($this->get_query_arg('page', self::MENU_SLUG));
        echo '<div class="arc-field"><label for="arc-role-key">' . esc_html__('Select role', 'adbear-roles-admin-access-manager') . '</label>';
        echo '<select id="arc-role-key" name="role_key" onchange="if(this.value){window.location.href=\'' . esc_url(admin_url('admin.php')) . '?page=' . esc_attr($page) . '&role_key=\'+this.value;}">';
        foreach ($wp_roles->roles as $role_key => $role) {
            echo '<option value="' . esc_attr($role_key) . '" ' . selected($selected, $role_key, false) . '>' . esc_html(translate_user_role($role['name'])) . '</option>';
        }
        echo '</select></div>';
    }

    /**
     * Render roles page.
     */
    public function render_roles_page() {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adbear-roles-admin-access-manager'));
        }

        global $wp_roles;
        $edit_role_key = sanitize_key($this->get_query_arg('edit_role', ''));
        $editing = $edit_role_key && get_role($edit_role_key);
        $all_caps = $this->get_all_capabilities();
        $default_role = get_option('default_role', 'subscriber');
        ?>
        <div class="wrap arc-wrap">
            <h1><?php echo esc_html__('Roles & Capabilities', 'adbear-roles-admin-access-manager'); ?></h1>
            <?php $this->render_notice(); ?>
            <div class="arc-info"><?php echo esc_html__('Start here: create or clone a role, assign capabilities, then use the submenu pages to control admin menus, dashboard widgets, the admin bar, login redirects, ACF groups, and login branding for each role.', 'adbear-roles-admin-access-manager'); ?></div>

            <div class="arc-card">
                <h2><?php echo esc_html__('Default registration role', 'adbear-roles-admin-access-manager'); ?></h2>
                <form method="post">
                    <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                    <input type="hidden" name="adbam_action" value="save_default_role" />
                    <div class="arc-field">
                        <select name="default_role">
                            <?php foreach ($wp_roles->roles as $role_key => $role) : ?>
                                <option value="<?php echo esc_attr($role_key); ?>" <?php selected($default_role, $role_key); ?>><?php echo esc_html(translate_user_role($role['name'])); ?></option>
                            <?php endforeach; ?>
                        </select>
                    </div>
                    <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save default role', 'adbear-roles-admin-access-manager'); ?></button></p>
                </form>
            </div>

            <div class="arc-grid">
                <div class="arc-card">
                    <h2><?php echo $editing ? esc_html__('Edit role', 'adbear-roles-admin-access-manager') : esc_html__('Add role', 'adbear-roles-admin-access-manager'); ?></h2>
                    <form method="post">
                        <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                        <input type="hidden" name="adbam_action" value="save_role" />
                        <?php if ($editing) : ?>
                            <input type="hidden" name="original_role" value="<?php echo esc_attr($edit_role_key); ?>" />
                        <?php endif; ?>
                        <div class="arc-field">
                            <label for="role_key"><?php echo esc_html__('Role key', 'adbear-roles-admin-access-manager'); ?></label>
                            <input type="text" id="role_key" name="role_key" value="<?php echo esc_attr($editing ? $edit_role_key : ''); ?>" <?php echo $editing ? 'readonly' : ''; ?> required />
                        </div>
                        <div class="arc-field">
                            <label for="role_label"><?php echo esc_html__('Role label', 'adbear-roles-admin-access-manager'); ?></label>
                            <input type="text" id="role_label" name="role_label" value="<?php echo esc_attr($editing ? translate_user_role($wp_roles->roles[$edit_role_key]['name']) : ''); ?>" required />
                        </div>
                        <div class="arc-field">
                            <label for="custom_caps"><?php echo esc_html__('Custom capabilities (comma or space separated)', 'adbear-roles-admin-access-manager'); ?></label>
                            <textarea id="custom_caps" name="custom_caps" rows="2" class="large-text"></textarea>
                        </div>
                        <div class="arc-bulk-actions">
                            <button type="button" class="button arc-select-all"><?php echo esc_html__('Select all', 'adbear-roles-admin-access-manager'); ?></button>
                            <button type="button" class="button arc-clear-all"><?php echo esc_html__('Clear all', 'adbear-roles-admin-access-manager'); ?></button>
                        </div>
                        <div class="arc-cap-list">
                            <?php
                            $role_caps = $editing ? array_keys((array) $wp_roles->roles[$edit_role_key]['capabilities']) : [];
                            foreach ($all_caps as $cap) :
                                ?>
                                <label><input type="checkbox" name="caps[]" value="<?php echo esc_attr($cap); ?>" <?php checked(in_array($cap, $role_caps, true)); ?> /> <?php echo esc_html($cap); ?></label>
                            <?php endforeach; ?>
                        </div>
                        <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save role', 'adbear-roles-admin-access-manager'); ?></button></p>
                    </form>
                </div>

                <div class="arc-card">
                    <h2><?php echo esc_html__('Clone role', 'adbear-roles-admin-access-manager'); ?></h2>
                    <form method="post">
                        <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                        <input type="hidden" name="adbam_action" value="clone_role" />
                        <div class="arc-field">
                            <label for="source_role"><?php echo esc_html__('Source role', 'adbear-roles-admin-access-manager'); ?></label>
                            <select id="source_role" name="source_role">
                                <?php foreach ($wp_roles->roles as $role_key => $role) : ?>
                                    <option value="<?php echo esc_attr($role_key); ?>"><?php echo esc_html(translate_user_role($role['name'])); ?></option>
                                <?php endforeach; ?>
                            </select>
                        </div>
                        <div class="arc-field">
                            <label for="new_role_key"><?php echo esc_html__('New role key', 'adbear-roles-admin-access-manager'); ?></label>
                            <input type="text" id="new_role_key" name="new_role_key" required />
                        </div>
                        <div class="arc-field">
                            <label for="new_role_label"><?php echo esc_html__('New role label', 'adbear-roles-admin-access-manager'); ?></label>
                            <input type="text" id="new_role_label" name="new_role_label" required />
                        </div>
                        <p class="arc-submit-row"><button type="submit" class="button"><?php echo esc_html__('Clone role', 'adbear-roles-admin-access-manager'); ?></button></p>
                    </form>
                </div>
            </div>

            <div class="arc-card">
                <h2><?php echo esc_html__('Existing roles', 'adbear-roles-admin-access-manager'); ?></h2>
                <table class="widefat striped arc-table">
                    <thead><tr><th><?php echo esc_html__('Role', 'adbear-roles-admin-access-manager'); ?></th><th><?php echo esc_html__('Key', 'adbear-roles-admin-access-manager'); ?></th><th><?php echo esc_html__('Capabilities', 'adbear-roles-admin-access-manager'); ?></th><th><?php echo esc_html__('Actions', 'adbear-roles-admin-access-manager'); ?></th></tr></thead>
                    <tbody>
                    <?php foreach ($wp_roles->roles as $role_key => $role) : ?>
                        <tr>
                            <td><?php echo esc_html(translate_user_role($role['name'])); ?></td>
                            <td><code><?php echo esc_html($role_key); ?></code></td>
                            <td><span class="arc-badge"><?php echo esc_html((string) count((array) $role['capabilities'])); ?></span></td>
                            <td class="arc-actions">
                                <?php if ($role_key !== 'administrator') : ?>
                                    <a class="button" href="<?php echo esc_url(add_query_arg(['page' => self::MENU_SLUG, 'edit_role' => $role_key], admin_url('admin.php'))); ?>"><?php echo esc_html__('Edit', 'adbear-roles-admin-access-manager'); ?></a>
                                <?php else : ?>
                                    <span class="arc-muted"><?php echo esc_html__('Protected', 'adbear-roles-admin-access-manager'); ?></span>
                                <?php endif; ?>
                                <?php if (!in_array($role_key, ['administrator', 'editor', 'author', 'contributor', 'subscriber'], true)) : ?>
                                    <form method="post" onsubmit="return confirm('<?php echo esc_js(__('Delete this role?', 'adbear-roles-admin-access-manager')); ?>');">
                                        <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                                        <input type="hidden" name="adbam_action" value="delete_role" />
                                        <input type="hidden" name="role_key" value="<?php echo esc_attr($role_key); ?>" />
                                        <button type="submit" class="button button-link-delete"><?php echo esc_html__('Delete', 'adbear-roles-admin-access-manager'); ?></button>
                                    </form>
                                <?php endif; ?>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                    </tbody>
                </table>
            </div>
        </div>
        <?php
    }

    /**
     * Render admin menu visibility page.
     */
    public function render_menus_page() {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adbear-roles-admin-access-manager'));
        }

        global $wp_roles;
        $selected_role = sanitize_key($this->get_query_arg('role_key', 'subscriber'));
        $rules = get_option(self::OPTION_MENU_RULES, []);
        $rules_enabled = isset($rules[$selected_role]) && is_array($rules[$selected_role]);
        $allowed = $rules_enabled ? $rules[$selected_role] : [];
        $menus = $this->get_admin_menus();
        ?>
        <div class="wrap arc-wrap">
            <h1><?php echo esc_html__('Admin Menu Visibility', 'adbear-roles-admin-access-manager'); ?></h1>
            <?php $this->render_notice(); ?>
            <div class="arc-info"><?php echo esc_html__('When enabled, only checked menu items will be visible. Direct URL access to hidden pages is also blocked.', 'adbear-roles-admin-access-manager'); ?></div>
            <div class="arc-card">
                <form method="post">
                    <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                    <input type="hidden" name="adbam_action" value="save_menu_rules" />
                    <?php $this->render_role_selector($selected_role); ?>
                    <div class="arc-field">
                        <label><input type="checkbox" name="rules_enabled" value="1" <?php checked($rules_enabled); ?> /> <?php echo esc_html__('Enable menu restrictions for this role', 'adbear-roles-admin-access-manager'); ?></label>
                    </div>
                    <div class="arc-bulk-actions">
                        <button type="button" class="button arc-select-all"><?php echo esc_html__('Select all', 'adbear-roles-admin-access-manager'); ?></button>
                        <button type="button" class="button arc-clear-all"><?php echo esc_html__('Clear all', 'adbear-roles-admin-access-manager'); ?></button>
                    </div>
                    <div class="arc-menu-list">
                        <?php foreach ($menus as $menu) : ?>
                            <label><input type="checkbox" name="allowed_menus[]" value="<?php echo esc_attr($menu['slug']); ?>" <?php checked(in_array($menu['slug'], $allowed, true)); ?> /> <?php echo esc_html($menu['label']); ?> <span class="arc-muted">(<?php echo esc_html($menu['slug']); ?>)</span></label>
                        <?php endforeach; ?>
                    </div>
                    <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save menu rules', 'adbear-roles-admin-access-manager'); ?></button></p>
                </form>
            </div>
        </div>
        <?php
    }

    /**
     * Render dashboard widgets page.
     */
    public function render_dashboard_page() {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adbear-roles-admin-access-manager'));
        }

        $selected_role = sanitize_key($this->get_query_arg('role_key', 'subscriber'));
        $rules = get_option(self::OPTION_DASHBOARD_RULES, []);
        $enabled = isset($rules[$selected_role]) && is_array($rules[$selected_role]);
        $allowed = $enabled ? $rules[$selected_role] : [];
        $widgets = $this->get_dashboard_widgets();
        ?>
        <div class="wrap arc-wrap">
            <h1><?php echo esc_html__('Dashboard Widget Visibility', 'adbear-roles-admin-access-manager'); ?></h1>
            <?php $this->render_notice(); ?>
            <div class="arc-card">
                <form method="post">
                    <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                    <input type="hidden" name="adbam_action" value="save_dashboard_rules" />
                    <?php $this->render_role_selector($selected_role); ?>
                    <div class="arc-field">
                        <label><input type="checkbox" name="rules_enabled" value="1" <?php checked($enabled); ?> /> <?php echo esc_html__('Enable dashboard widget restrictions for this role', 'adbear-roles-admin-access-manager'); ?></label>
                    </div>
                    <div class="arc-bulk-actions">
                        <button type="button" class="button arc-select-all"><?php echo esc_html__('Select all', 'adbear-roles-admin-access-manager'); ?></button>
                        <button type="button" class="button arc-clear-all"><?php echo esc_html__('Clear all', 'adbear-roles-admin-access-manager'); ?></button>
                    </div>
                    <div class="arc-menu-list">
                        <?php foreach ($widgets as $widget) : ?>
                            <label><input type="checkbox" name="allowed_widgets[]" value="<?php echo esc_attr($widget['id']); ?>" <?php checked(in_array($widget['id'], $allowed, true)); ?> /> <?php echo esc_html($widget['label']); ?></label>
                        <?php endforeach; ?>
                    </div>
                    <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save dashboard rules', 'adbear-roles-admin-access-manager'); ?></button></p>
                </form>
            </div>
        </div>
        <?php
    }

    /**
     * Render admin bar page.
     */
    public function render_admin_bar_page() {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adbear-roles-admin-access-manager'));
        }

        $selected_role = sanitize_key($this->get_query_arg('role_key', 'subscriber'));
        $rules = get_option(self::OPTION_ADMIN_BAR_RULES, []);
        $enabled = isset($rules[$selected_role]) && is_array($rules[$selected_role]);
        $allowed = $enabled ? $rules[$selected_role] : [];
        $nodes = $this->get_admin_bar_nodes();
        ?>
        <div class="wrap arc-wrap">
            <h1><?php echo esc_html__('Admin Bar Manager', 'adbear-roles-admin-access-manager'); ?></h1>
            <?php $this->render_notice(); ?>
            <?php if (empty($nodes)) : ?>
                <div class="arc-warning"><?php echo esc_html__('No admin bar items were found. Try reloading this page or visit another admin screen first, then return here.', 'adbear-roles-admin-access-manager'); ?></div>
            <?php endif; ?>
            <div class="arc-card">
                <form method="post">
                    <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                    <input type="hidden" name="adbam_action" value="save_admin_bar_rules" />
                    <?php $this->render_role_selector($selected_role); ?>
                    <div class="arc-field">
                        <label><input type="checkbox" name="rules_enabled" value="1" <?php checked($enabled); ?> /> <?php echo esc_html__('Enable admin bar restrictions for this role', 'adbear-roles-admin-access-manager'); ?></label>
                    </div>
                    <div class="arc-bulk-actions">
                        <button type="button" class="button arc-select-all"><?php echo esc_html__('Select all', 'adbear-roles-admin-access-manager'); ?></button>
                        <button type="button" class="button arc-clear-all"><?php echo esc_html__('Clear all', 'adbear-roles-admin-access-manager'); ?></button>
                    </div>
                    <div class="arc-menu-list">
                        <?php foreach ($nodes as $node) : ?>
                            <label><input type="checkbox" name="allowed_nodes[]" value="<?php echo esc_attr($node['id']); ?>" <?php checked(in_array($node['id'], $allowed, true)); ?> /> <?php echo esc_html($node['label']); ?> <span class="arc-muted">(<?php echo esc_html($node['id']); ?>)</span></label>
                        <?php endforeach; ?>
                    </div>
                    <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save admin bar rules', 'adbear-roles-admin-access-manager'); ?></button></p>
                </form>
            </div>
        </div>
        <?php
    }

    /**
     * Render login redirects page.
     */
    public function render_redirects_page() {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adbear-roles-admin-access-manager'));
        }

        global $wp_roles;
        $redirects = get_option(self::OPTION_LOGIN_REDIRECT_RULES, []);
        ?>
        <div class="wrap arc-wrap">
            <h1><?php echo esc_html__('Login Redirect Manager', 'adbear-roles-admin-access-manager'); ?></h1>
            <?php $this->render_notice(); ?>
            <div class="arc-card">
                <form method="post">
                    <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                    <input type="hidden" name="adbam_action" value="save_login_redirects" />
                    <table class="widefat striped arc-table">
                        <thead><tr><th><?php echo esc_html__('Role', 'adbear-roles-admin-access-manager'); ?></th><th><?php echo esc_html__('Redirect URL', 'adbear-roles-admin-access-manager'); ?></th></tr></thead>
                        <tbody>
                        <?php foreach ($wp_roles->roles as $role_key => $role) : ?>
                            <tr>
                                <td><?php echo esc_html(translate_user_role($role['name'])); ?></td>
                                <td><input type="url" name="redirects[<?php echo esc_attr($role_key); ?>]" value="<?php echo esc_attr(isset($redirects[$role_key]) ? $redirects[$role_key] : ''); ?>" class="regular-text" placeholder="<?php echo esc_attr(home_url('/')); ?>" /></td>
                            </tr>
                        <?php endforeach; ?>
                        </tbody>
                    </table>
                    <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save redirects', 'adbear-roles-admin-access-manager'); ?></button></p>
                </form>
            </div>
        </div>
        <?php
    }

    /**
     * Render ACF group visibility page.
     */
    public function render_acf_page() {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adbear-roles-admin-access-manager'));
        }

        $selected_role = sanitize_key($this->get_query_arg('role_key', 'subscriber'));
        $rules = get_option(self::OPTION_ACF_RULES, []);
        $enabled = isset($rules[$selected_role]) && is_array($rules[$selected_role]);
        $allowed = $enabled ? $rules[$selected_role] : [];
        $groups = $this->get_acf_groups();
        ?>
        <div class="wrap arc-wrap">
            <h1><?php echo esc_html__('ACF Group Visibility', 'adbear-roles-admin-access-manager'); ?></h1>
            <?php $this->render_notice(); ?>
            <?php if (empty($groups)) : ?>
                <div class="arc-warning"><?php echo esc_html__('Advanced Custom Fields is not active or no field groups were found.', 'adbear-roles-admin-access-manager'); ?></div>
            <?php endif; ?>
            <div class="arc-card">
                <form method="post">
                    <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                    <input type="hidden" name="adbam_action" value="save_acf_rules" />
                    <?php $this->render_role_selector($selected_role); ?>
                    <div class="arc-field">
                        <label><input type="checkbox" name="rules_enabled" value="1" <?php checked($enabled); ?> /> <?php echo esc_html__('Enable ACF group restrictions for this role', 'adbear-roles-admin-access-manager'); ?></label>
                    </div>
                    <div class="arc-bulk-actions">
                        <button type="button" class="button arc-select-all"><?php echo esc_html__('Select all', 'adbear-roles-admin-access-manager'); ?></button>
                        <button type="button" class="button arc-clear-all"><?php echo esc_html__('Clear all', 'adbear-roles-admin-access-manager'); ?></button>
                    </div>
                    <div class="arc-menu-list">
                        <?php foreach ($groups as $group) : ?>
                            <label><input type="checkbox" name="allowed_groups[]" value="<?php echo esc_attr($group['key']); ?>" <?php checked(in_array($group['key'], $allowed, true)); ?> /> <?php echo esc_html($group['label']); ?></label>
                        <?php endforeach; ?>
                    </div>
                    <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save ACF rules', 'adbear-roles-admin-access-manager'); ?></button></p>
                </form>
            </div>
        </div>
        <?php
    }

    /**
     * Render login branding page.
     */
    public function render_branding_page() {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('You do not have permission to access this page.', 'adbear-roles-admin-access-manager'));
        }

        $settings = $this->get_branding_settings();
        ?>
        <div class="wrap arc-wrap">
            <h1><?php echo esc_html__('Login Screen & Branding', 'adbear-roles-admin-access-manager'); ?></h1>
            <?php $this->render_notice(); ?>
            <div class="arc-card">
                <form method="post">
                    <?php wp_nonce_field(self::NONCE_ACTION, self::NONCE_FIELD); ?>
                    <input type="hidden" name="adbam_action" value="save_branding" />
                    <div class="arc-field">
                        <label><input type="checkbox" name="enabled" value="1" <?php checked(!empty($settings['enabled'])); ?> /> <?php echo esc_html__('Enable login screen branding', 'adbear-roles-admin-access-manager'); ?></label>
                    </div>
                    <div class="arc-field">
                        <label><input type="checkbox" name="admin_modern_enabled" value="1" <?php checked(!empty($settings['admin_modern_enabled'])); ?> /> <?php echo esc_html__('Enable modern WordPress admin UI', 'adbear-roles-admin-access-manager'); ?></label>
                    </div>
                    <div class="arc-grid">
                        <div>
                            <div class="arc-field">
                                <label for="logo_url"><?php echo esc_html__('Login logo URL', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="url" id="logo_url" name="logo_url" value="<?php echo esc_attr($settings['logo_url']); ?>" class="regular-text" />
                                <button type="button" class="button arc-media-upload" data-target="logo_url"><?php echo esc_html__('Upload', 'adbear-roles-admin-access-manager'); ?></button>
                            </div>
                            <div class="arc-field">
                                <label for="logo_link"><?php echo esc_html__('Logo link URL', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="url" id="logo_link" name="logo_link" value="<?php echo esc_attr($settings['logo_link']); ?>" class="regular-text" />
                            </div>
                            <div class="arc-field">
                                <label for="logo_title"><?php echo esc_html__('Logo title', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="text" id="logo_title" name="logo_title" value="<?php echo esc_attr($settings['logo_title']); ?>" class="regular-text" />
                            </div>
                            <div class="arc-field">
                                <label for="footer_text"><?php echo esc_html__('Admin footer text', 'adbear-roles-admin-access-manager'); ?></label>
                                <textarea id="footer_text" name="footer_text" rows="3" class="large-text"><?php echo esc_textarea($settings['footer_text']); ?></textarea>
                            </div>
                        </div>
                        <div>
                            <div class="arc-field">
                                <label for="background_type"><?php echo esc_html__('Background type', 'adbear-roles-admin-access-manager'); ?></label>
                                <select id="background_type" name="background_type">
                                    <option value="color" <?php selected($settings['background_type'], 'color'); ?>><?php echo esc_html__('Color', 'adbear-roles-admin-access-manager'); ?></option>
                                    <option value="gradient" <?php selected($settings['background_type'], 'gradient'); ?>><?php echo esc_html__('Gradient', 'adbear-roles-admin-access-manager'); ?></option>
                                    <option value="image" <?php selected($settings['background_type'], 'image'); ?>><?php echo esc_html__('Image', 'adbear-roles-admin-access-manager'); ?></option>
                                </select>
                            </div>
                            <div class="arc-field">
                                <label for="background_color"><?php echo esc_html__('Background color', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="text" id="background_color" name="background_color" value="<?php echo esc_attr($settings['background_color']); ?>" />
                            </div>
                            <div class="arc-field">
                                <label for="background_gradient"><?php echo esc_html__('Background gradient CSS', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="text" id="background_gradient" name="background_gradient" value="<?php echo esc_attr($settings['background_gradient']); ?>" class="large-text" />
                            </div>
                            <div class="arc-field">
                                <label for="background_image"><?php echo esc_html__('Background image URL', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="url" id="background_image" name="background_image" value="<?php echo esc_attr($settings['background_image']); ?>" class="regular-text" />
                                <button type="button" class="button arc-media-upload" data-target="background_image"><?php echo esc_html__('Upload', 'adbear-roles-admin-access-manager'); ?></button>
                            </div>
                            <div class="arc-field">
                                <label for="button_color"><?php echo esc_html__('Button color', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="text" id="button_color" name="button_color" value="<?php echo esc_attr($settings['button_color']); ?>" />
                            </div>
                            <div class="arc-field">
                                <label for="card_radius"><?php echo esc_html__('Card border radius', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="number" id="card_radius" name="card_radius" value="<?php echo esc_attr((string) $settings['card_radius']); ?>" min="0" max="40" />
                            </div>
                            <div class="arc-field">
                                <label for="login_layout"><?php echo esc_html__('Login layout', 'adbear-roles-admin-access-manager'); ?></label>
                                <select id="login_layout" name="login_layout">
                                    <option value="center" <?php selected($settings['login_layout'], 'center'); ?>><?php echo esc_html__('Centered', 'adbear-roles-admin-access-manager'); ?></option>
                                    <option value="split" <?php selected($settings['login_layout'], 'split'); ?>><?php echo esc_html__('Split with side image', 'adbear-roles-admin-access-manager'); ?></option>
                                </select>
                            </div>
                            <div class="arc-field">
                                <label for="side_image"><?php echo esc_html__('Side image URL (split layout)', 'adbear-roles-admin-access-manager'); ?></label>
                                <input type="url" id="side_image" name="side_image" value="<?php echo esc_attr($settings['side_image']); ?>" class="regular-text" />
                                <button type="button" class="button arc-media-upload" data-target="side_image"><?php echo esc_html__('Upload', 'adbear-roles-admin-access-manager'); ?></button>
                            </div>
                        </div>
                    </div>
                    <p class="arc-submit-row"><button type="submit" class="button button-primary"><?php echo esc_html__('Save branding settings', 'adbear-roles-admin-access-manager'); ?></button></p>
                </form>
            </div>
        </div>
        <?php
    }
}

register_activation_hook(__FILE__, ['Adbam_Admin_Access', 'activate']);
Adbam_Admin_Access::instance();
Adbam_Our_Plugins::instance();