<?php
/**
 * Which WordPress accounts a personal agent may EVER be signed in to
 * (PLAN.md §5.4 rule 2).
 *
 * A signed-in agent acts as the account. For a customer that means their
 * orders and addresses; for an administrator or shop manager it would mean the
 * store. So an account is eligible only when it has an allowed role AND none
 * of the capabilities below. Checked at the consent page, at code exchange, at
 * every Account Token use, and on every API request, because roles change.
 *
 * @package AgentAdapt
 */

defined( 'ABSPATH' ) || exit;

/**
 * Account eligibility.
 */
final class AgentAdapt_Eligibility {

	/**
	 * Capabilities that make an account ineligible whatever its role.
	 */
	private const DENY_CAPS = array( 'manage_options', 'manage_woocommerce', 'edit_shop_orders', 'edit_others_shop_orders', 'edit_posts', 'edit_pages', 'list_users', 'edit_users', 'promote_users', 'delete_users', 'create_users', 'install_plugins', 'activate_plugins', 'edit_theme_options', 'unfiltered_html', 'export', 'import' );

	/**
	 * Whether an account may be connected to a personal agent.
	 *
	 * @param int $user_id User ID.
	 */
	public static function eligible( int $user_id ): bool {
		$user = $user_id > 0 ? get_userdata( $user_id ) : false;
		if ( ! $user instanceof WP_User || ! $user->exists() ) {
			return false;
		}
		/**
		 * Roles whose accounts may be connected. Default: customer, subscriber.
		 *
		 * @param string[] $roles Role slugs.
		 */
		$roles = (array) apply_filters( 'agentadapt_eligible_roles', array( 'customer', 'subscriber' ) );
		if ( ! array_intersect( (array) $user->roles, $roles ) ) {
			return false;
		}
		/**
		 * Capabilities that make an account ineligible. Extend, don't shrink:
		 * a capability removed here lets an agent wield it.
		 *
		 * @param string[] $caps Capabilities.
		 */
		foreach ( array_unique( array_merge( self::DENY_CAPS, (array) apply_filters( 'agentadapt_ineligible_caps', array() ) ) ) as $cap ) {
			if ( user_can( $user, $cap ) ) {
				return false;
			}
		}
		return true;
	}
}