<?php

namespace AdPresso\Admin;

use AdPresso\Constants;
use AdPresso\Infrastructure\Util;
use AdPresso\RuntimeDebugger;

defined( 'ABSPATH' ) || exit;

/**
 * Rendering trusts the entity author's unfiltered_html, so nobody may hand an entity to a user with more rights than their own.
 */
class AuthorGuard {

	private const POST_TYPES = [ Constants::POST_TYPE_AD, Constants::POST_TYPE_GROUP, Constants::POST_TYPE_PLACEMENT ];

	/**
	 * Registers the WP hooks.
	 */
	public function hooks(): void {
		add_filter( 'wp_insert_post_data', [ $this, 'keep_author_within_own_rights' ], 10, 2 );
		add_filter( 'map_meta_cap', [ $this, 'deny_editing_items_of_more_privileged_authors' ], 10, 4 );
	}

	/**
	 * Whether the current user may make $user_id the author of an entity.
	 *
	 * @param int $user_id The prospective author.
	 */
	public static function can_assign_to( int $user_id ): bool {
		$current_id = get_current_user_id();
		if ( $user_id === $current_id ) {
			return true;
		}
		if ( $user_id <= 0 || ! get_userdata( $user_id ) ) {
			return false;
		}

		return ! self::outranks( $user_id, $current_id );
	}

	/**
	 * Whether the post type is one of ours.
	 *
	 * @param string $post_type Post type slug.
	 */
	public static function is_guarded_post_type( string $post_type ): bool {
		return in_array( $post_type, self::POST_TYPES, true );
	}

	/**
	 * Reverts an author change to a user the current user may not assign to.
	 *
	 * @param array $data    Slashed post data about to be written.
	 * @param array $postarr Raw arguments passed to wp_insert_post().
	 */
	public function keep_author_within_own_rights( array $data, array $postarr ): array {
		if ( ! self::is_guarded_post_type( (string) ( $data['post_type'] ?? '' ) ) ) {
			return $data;
		}

		$author   = (int) ( $data['post_author'] ?? 0 );
		$existing = ! empty( $postarr['ID'] ) ? (int) get_post_field( 'post_author', (int) $postarr['ID'] ) : 0;

		if ( $author === $existing || self::can_assign_to( $author ) ) {
			return $data;
		}

		$data['post_author'] = $existing > 0 ? $existing : get_current_user_id();
		RuntimeDebugger::add_server_error_log_entry( sprintf( 'AdPresso: refused to assign %s to user #%d (more rights than the current user).', $data['post_type'], $author ) );

		return $data;
	}

	/**
	 * Blocks edit_post/delete_post on entities whose author outranks the user.
	 *
	 * @param array  $caps    Primitive capabilities required.
	 * @param string $cap     Meta capability being checked.
	 * @param int    $user_id User being checked.
	 * @param array  $args    Additional arguments, [0] is the post ID.
	 */
	public function deny_editing_items_of_more_privileged_authors( array $caps, string $cap, int $user_id, array $args ): array {
		if ( ! in_array( $cap, [ 'edit_post', 'delete_post' ], true ) || empty( $args[0] ) ) {
			return $caps;
		}

		$post = get_post( (int) $args[0] );
		if ( ! $post || ! self::is_guarded_post_type( $post->post_type ) ) {
			return $caps;
		}

		$author_id = (int) $post->post_author;
		if ( $author_id === $user_id || ! get_userdata( $author_id ) ) {
			return $caps;
		}

		return self::outranks( $author_id, $user_id ) ? [ 'do_not_allow' ] : $caps;
	}

	/**
	 * Super admins outrank everyone on multisite; otherwise unfiltered_html decides.
	 *
	 * @param int $user_id  The user in question.
	 * @param int $other_id The user to compare against.
	 */
	private static function outranks( int $user_id, int $other_id ): bool {
		if ( is_multisite() && is_super_admin( $user_id ) && ! is_super_admin( $other_id ) ) {
			return true;
		}

		return Util::user_can_unfiltered_html( $user_id ) && ! Util::user_can_unfiltered_html( $other_id );
	}
}