<?php
if ( ! defined( 'ABSPATH' ) ) { exit; }

/**
 * Security helpers (safe utilities).
 */
function aiaas_require_cap( $cap ) {
    if ( ! current_user_can( $cap ) ) {
        wp_die( esc_html__( 'You do not have permission to access this feature.', 'aas-ai-authors-studio' ) );
    }
}

function aiaas_verify_ajax_nonce( $action, $field = 'nonce' ) {
    $nonce = \AIAAS\Request::request( $field, 'text', '' );
    if ( $nonce === '' && '_ajax_nonce' !== $field ) {
        $nonce = \AIAAS\Request::post( '_ajax_nonce', 'text', '' );
    }
    if ( $nonce === '' && '_wpnonce' !== $field ) {
        $nonce = \AIAAS\Request::post( '_wpnonce', 'text', '' );
    }
    if ( $nonce === '' || ! wp_verify_nonce( $nonce, $action ) ) {
        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'aas-ai-authors-studio' ) ), 403 );
    }
}

/**
 * Enforce standard AJAX security pattern.
 */
function aiaas_enforce_ajax_security( $capability = 'manage_options', $nonce_action = '' ) {
    if ( ! current_user_can( $capability ) ) {
        wp_send_json_error( array( 'message' => 'Permission denied.' ), 403 );
    }

    if ( ! empty( $nonce_action ) ) {
        $nonce = \AIAAS\Request::request( '_ajax_nonce', 'text', '' );
        if ( '' === $nonce ) {
            $nonce = \AIAAS\Request::request( '_wpnonce', 'text', '' );
        }
        if ( '' === $nonce ) {
            $nonce = \AIAAS\Request::request( 'nonce', 'text', '' );
        }
        if ( '' === $nonce || ! wp_verify_nonce( $nonce, $nonce_action ) ) {
            wp_send_json_error( array( 'message' => 'Invalid nonce.' ), 403 );
        }
    }
}

/**
 * Safe nonce field output for admin/portal forms.
 */
function aiaas_nonce_field_safe( $action, $name = "_wpnonce", $referer = true ) {
    $html = wp_nonce_field( $action, $name, $referer, false );
    $allowed = array(
        "input" => array(
            "type"  => true,
            "name"  => true,
            "value" => true,
            "id"    => true,
            "class" => true,
        ),
    );
    return wp_kses( $html, $allowed );
}


function aiaas_request_nonce_is_valid( $action, $fields = array( '_wpnonce', '_aiaas_nonce', '_aiaas_legacy_nonce', '_ajax_nonce', 'nonce' ) ) {
    foreach ( (array) $fields as $field ) {
        $nonce = \AIAAS\Request::request( (string) $field, 'text', '' );
        if ( '' === $nonce ) {
            continue;
        }
        if ( wp_verify_nonce( $nonce, $action ) ) {
            return true;
        }
    }
    return false;
}

function aiaas_request_nonce_matches_any( array $actions, $fields = array( '_wpnonce', '_aiaas_nonce', '_aiaas_legacy_nonce', '_ajax_nonce', 'nonce' ) ) {
    foreach ( $actions as $action ) {
        $action = (string) $action;
        if ( '' === $action ) {
            continue;
        }
        if ( aiaas_request_nonce_is_valid( $action, $fields ) ) {
            return true;
        }
    }
    return false;
}