<?php
/**
 * Read-only WordPress session visibility.
 *
 * @package AdminWatch
 */

defined( 'ABSPATH' ) || exit;

/**
 * Counts valid core WordPress sessions without retaining session information.
 */
class WebStudio_Admin_Watch_Session_Visibility {
	/**
	 * Return valid-session counts keyed by user ID.
	 *
	 * WP_Session_Tokens::get_all() delegates validity to the configured core
	 * session manager. AdminWatch Central intentionally reads only the count; token
	 * verifiers and session metadata are never retained or exposed.
	 *
	 * @param array<int,int> $user_ids User IDs in AdminWatch Central's access scope.
	 * @return array<int,int>
	 */
	public function counts_for_users( $user_ids ) {
		$counts = array();

		foreach ( array_unique( array_map( 'absint', (array) $user_ids ) ) as $user_id ) {
			if ( ! $user_id ) {
				continue;
			}

			$sessions = WP_Session_Tokens::get_instance( $user_id )->get_all();
			$count    = is_array( $sessions ) ? count( $sessions ) : 0;

			if ( $count ) {
				$counts[ $user_id ] = $count;
			}
		}

		return $counts;
	}
}