<?php
/**
 * Detects MFA only through supported provider APIs.
 *
 * @package AdminWatch
 */

defined( 'ABSPATH' ) || exit;

class WebStudio_Admin_Watch_MFA_Detector {
	const ENABLED      = 'enabled';
	const NOT_ENABLED  = 'not_enabled';
	const NOT_DETECTED = 'not_detected';

	/**
	 * Detect MFA state for a user without copying provider data.
	 *
	 * Currently supports the official WordPress.org Two Factor plugin through
	 * its documented two_factor_enabled_providers_for_user filter.
	 *
	 * @param int $user_id User ID.
	 * @return string One of this class's status constants.
	 */
	public function status_for_user( $user_id ) {
		$user_id = absint( $user_id );
		if ( ! $user_id || ! $this->two_factor_is_active() ) {
			return self::NOT_DETECTED;
		}

		// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Documented public integration hook supplied by the official Two Factor provider.
		$providers = apply_filters( 'two_factor_enabled_providers_for_user', array(), $user_id );
		if ( ! is_array( $providers ) ) {
			return self::NOT_DETECTED;
		}

		return empty( $providers ) ? self::NOT_ENABLED : self::ENABLED;
	}

	/** @return bool */
	private function two_factor_is_active() {
		if ( ! function_exists( 'is_plugin_active' ) ) {
			require_once ABSPATH . 'wp-admin/includes/plugin.php';
		}

		return is_plugin_active( 'two-factor/two-factor.php' );
	}
}