<?php
/**
 * Sudo mode — short-lived re-authentication for destructive actions.
 *
 * Before purge / rollback / settings-purge the UI requests a fresh
 * password confirmation from the user. A successful confirmation
 * sets a short-lived user-meta token that satisfies subsequent
 * destructive calls within the window.
 *
 * @package ActivityPilot
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class APWPM_Sudo {

	const META_KEY      = 'apwpm_sudo_until';
	const DEFAULT_TTL   = 300; // 5 minutes
	const NONCE_ACTION  = 'apwpm_sudo';

	public static function enabled() {
		$s = (array) get_option( 'apwpm_settings', array() );
		return ! empty( $s['enable_sudo'] );
	}

	/**
	 * Returns true when the current user has a valid sudo session.
	 */
	public static function is_active( $user_id = 0 ) {
		if ( ! self::enabled() ) {
			return true; // feature disabled → don't gate.
		}
		$user_id = $user_id ?: get_current_user_id();
		if ( ! $user_id ) {
			return false;
		}
		$until = (int) get_user_meta( $user_id, self::META_KEY, true );
		return $until && $until > time();
	}

	public static function grant( $user_id = 0, $ttl = self::DEFAULT_TTL ) {
		$user_id = $user_id ?: get_current_user_id();
		if ( ! $user_id ) {
			return false;
		}
		return update_user_meta( $user_id, self::META_KEY, time() + (int) $ttl );
	}

	public static function revoke( $user_id = 0 ) {
		$user_id = $user_id ?: get_current_user_id();
		return delete_user_meta( $user_id, self::META_KEY );
	}

	/**
	 * Verify a freshly-supplied password belongs to the current user.
	 */
	public static function confirm_password( $password ) {
		$user = wp_get_current_user();
		if ( ! $user || ! $user->ID ) {
			return false;
		}
		$ok = wp_check_password( (string) $password, $user->user_pass, $user->ID );
		if ( $ok ) {
			self::grant( $user->ID );
		}
		return (bool) $ok;
	}
}