<?php
/**
 * Session expiration functionality for Admin Only Dashboard plugin
 *
 * @package Admin_Only_Dashboard
 */

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Set session expiration based on plugin settings
 *
 * @param int  $expiration Current expiration time in seconds.
 * @param int  $user_id User ID.
 * @param bool $remember Whether to remember the user.
 * @return int Modified expiration time
 */
function admon_set_session_expiration( $expiration, $user_id, $remember ): int {
	$settings = get_option( 'admin_only_settings', array() );

	if ( empty( $settings['session_timeout'] ) && empty( $settings['admin_timeout_hours'] ) ) {
		return $expiration;
	}

	$apply_to_admins = ! empty( $settings['apply_to_admins'] );
	$user            = get_userdata( $user_id );
	$is_admin        = $user && $user->has_cap( apply_filters( 'admon_access_capability', 'manage_options' ) );

	// Administrators are exempt unless explicitly included.
	if ( $is_admin && ! $apply_to_admins ) {
		return $expiration;
	}

	// Start with the general timeout, then use a valid administrator override if set.
	if ( 'custom' === ( $settings['session_timeout'] ?? '' ) ) {
		$timeout_hours = absint( $settings['custom_timeout_hours'] ?? 0 );
	} else {
		$timeout_hours = absint( $settings['session_timeout'] ?? 0 );
	}

	$admin_hours = $settings['admin_timeout_hours'] ?? '';
	if ( $is_admin && is_scalar( $admin_hours ) && ctype_digit( (string) $admin_hours ) && (int) $admin_hours >= 1 && (int) $admin_hours <= 168 ) {
		$timeout_hours = (int) $admin_hours;
	}

	// Validate timeout hours (1 hour minimum, 168 hours/1 week maximum).
	if ( $timeout_hours < 1 || $timeout_hours > 168 ) {
		return $expiration; // Fall back to default if invalid.
	}

	// Check if we should respect "Remember Me" checkbox.
	$override_remember_me = ! empty( $settings['override_remember_me'] );
	if ( ! $override_remember_me && $remember ) {
		// If "Remember Me" is checked and we're not overriding it,
		// let WordPress handle the extended session (typically 2 weeks).
		return $expiration;
	}

	$timeout_seconds = $timeout_hours * HOUR_IN_SECONDS;

	// Return the custom timeout.
	return $timeout_seconds;
}
add_filter( 'auth_cookie_expiration', 'admon_set_session_expiration', 10, 3 );