<?php

declare(strict_types=1);

namespace AdsDestroyer\Security;

use AdsDestroyer\Settings\OptionsRepository;

/**
 * Capabilities service for managing user permissions.
 * 
 * This class handles permission checks for plugin functionality,
 * including role-based access control and capability verification.
 * 
 * @since 1.0.0
 */
final class CapabilitiesService {
    
    private OptionsRepository $options_repository;
    
    /**
     * Constructor.
     * 
     * @since 1.0.0
     * @param OptionsRepository $options_repository Options repository instance.
     */
    public function __construct(OptionsRepository $options_repository) {
        $this->options_repository = $options_repository;
    }
    
    /**
     * Check if current user can manage plugin settings.
     * 
     * @since 1.0.0
     * @return bool True if user can manage settings, false otherwise.
     */
    public function can_manage_settings(): bool {
        return current_user_can('manage_options');
    }
    
    /**
     * Check if current user can access selection mode.
     * 
     * @since 1.0.0
     * @return bool True if user can access selection mode, false otherwise.
     */
    public function can_access_selection_mode(): bool {
        return $this->can_use_selector();
    }
    
    /**
     * Check if current user can access settings.
     * 
     * @since 1.0.0
     * @return bool True if user can access settings, false otherwise.
     */
    public function can_access_settings(): bool {
        return $this->can_manage_settings();
    }
    
    /**
     * Check if current user can use the selector functionality.
     * 
     * @since 1.0.0
     * @return bool True if user can use selector, false otherwise.
     */
    public function can_use_selector(): bool {
        // First check basic capability
        if (!current_user_can('edit_posts')) {
            return false;
        }
        
        // Check if user's role is allowed
        $user = wp_get_current_user();
        $allowed_roles = $this->get_allowed_roles();
        
        if (empty($allowed_roles)) {
            return false;
        }
        
        // Check if user has any of the allowed roles
        foreach ($allowed_roles as $role) {
            if (in_array($role, $user->roles, true)) {
                return true;
            }
        }
        
        return false;
    }
    
    /**
     * Check if current user can create rules.
     * 
     * @since 1.0.0
     * @return bool True if user can create rules, false otherwise.
     */
    public function can_create_rules(): bool {
        return $this->can_use_selector();
    }
    
    /**
     * Check if current user can edit rules.
     * 
     * @since 1.0.0
     * @return bool True if user can edit rules, false otherwise.
     */
    public function can_edit_rules(): bool {
        return $this->can_manage_settings();
    }
    
    /**
     * Check if current user can delete rules.
     * 
     * @since 1.0.0
     * @return bool True if user can delete rules, false otherwise.
     */
    public function can_delete_rules(): bool {
        return $this->can_manage_settings();
    }
    
    /**
     * Check if current user can view logs.
     * 
     * @since 1.0.0
     * @return bool True if user can view logs, false otherwise.
     */
    public function can_view_logs(): bool {
        return $this->can_manage_settings();
    }
    
    /**
     * Check if admin bar button should be shown for current user.
     * 
     * @since 1.0.0
     * @return bool True if button should be shown, false otherwise.
     */
    public function should_show_admin_bar_button(): bool {
        // Check if admin bar button is enabled in settings
        $show_button = $this->options_repository->get_option('ui.show_admin_bar_button', true);
        if (!$show_button) {
            return false;
        }
        
        // Check if user can use selector
        return $this->can_use_selector();
    }
    
    /**
     * Get allowed roles for plugin functionality.
     * 
     * @since 1.0.0
     * @return array<string> Array of allowed role names.
     */
    public function get_allowed_roles(): array {
        $allowed_roles = $this->options_repository->get_option('access.roles_allowed', ['administrator']);
        
        // Ensure we always have at least administrator
        if (empty($allowed_roles)) {
            return ['administrator'];
        }
        
        return array_values(array_unique($allowed_roles));
    }
    
    /**
     * Check if a specific role is allowed.
     * 
     * @since 1.0.0
     * @param string $role Role name to check.
     * @return bool True if role is allowed, false otherwise.
     */
    public function is_role_allowed(string $role): bool {
        $allowed_roles = $this->get_allowed_roles();
        return in_array($role, $allowed_roles, true);
    }
    
    /**
     * Get available WordPress roles.
     * 
     * @since 1.0.0
     * @return array<string, array<string, mixed>> Array of available roles.
     */
    public function get_available_roles(): array {
        if (!function_exists('get_editable_roles')) {
            return [];
        }
        
        return get_editable_roles();
    }
    
    /**
     * Require capability and die if not met.
     * 
     * @since 1.0.0
     * @param string $capability Capability to check.
     * @param string $message Error message to display.
     * @throws \Exception If capability check fails.
     */
    public function require_capability(string $capability, string $message = ''): void {
        $capability_method = 'can_' . str_replace('-', '_', $capability);
        
        if (!method_exists($this, $capability_method)) {
            throw new \InvalidArgumentException("Unknown capability: {$capability}");
        }
        
        if (!$this->$capability_method()) {
            $error_message = $message ?: sprintf(
                __('You do not have sufficient permissions to perform this action.', 'ads-destroyer'),
                $capability
            );
            
            if (wp_doing_ajax()) {
                wp_send_json_error(['message' => $error_message]);
            } else {
                wp_die(esc_html($error_message));
            }
        }
    }
    
    /**
     * Check if current user is super admin (for multisite).
     * 
     * @since 1.0.0
     * @return bool True if user is super admin, false otherwise.
     */
    public function is_super_admin(): bool {
        if (!is_multisite()) {
            return false;
        }
        
        return is_super_admin();
    }
    
    /**
     * Get current user's primary role.
     * 
     * @since 1.0.0
     * @return string|null User's primary role or null if no user.
     */
    public function get_current_user_role(): ?string {
        $user = wp_get_current_user();
        
        if (!$user || !$user->exists()) {
            return null;
        }
        
        $roles = $user->roles;
        return !empty($roles) ? $roles[0] : null;
    }

    /**
     * Check if current user can access selection mode (read operations).
     * 
     * @since 1.0.0
     * @return bool True if user can access, false otherwise.
     */
    public function current_user_can_access(): bool {
        return $this->can_access_selection_mode();
    }

    /**
     * Check if current user can manage rules/settings (write operations).
     * 
     * @since 1.0.0
     * @return bool True if user can manage, false otherwise.
     */
    public function current_user_can_manage(): bool {
        return $this->can_create_rules();
    }
}