<?php
namespace Acumenon\Core;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

use Acumenon\Utils\Base;

class AccessControl extends Base {

	private $settings;
	private $post_type;

	public function __construct() {
		$this->settings  = Settings::get_instance();
		$this->post_type = PostType::get_instance();

		add_action( 'template_redirect', [ $this, 'restrict_access' ] );
	}

	/**
	 * Check if current user can access a specific term (Category or Knowledge Base)
	 */
	public static function can_user_access_term( $term_id, $taxonomy ) {
		$self = self::get_instance();
		if ( ! $self->settings->get( 'enable_access_control', false ) ) {
			return true;
		}

		$restrict_list = [];
		if ( $taxonomy === $self->post_type->knowledge_base ) {
			$restrict_list = (array) $self->settings->get( 'restrict_knowledge_base', [ 'all' ] );
		} elseif ( $taxonomy === $self->post_type->category ) {
			$restrict_list = (array) $self->settings->get( 'restrict_categories', [ 'all' ] );
		}

		$is_restricted = false;
		if ( in_array( 'All', $restrict_list ) || in_array( 'all', $restrict_list ) ) {
			$is_restricted = true;
		} else {
			// Find term by ID or Name
			$term = get_term( $term_id, $taxonomy );
			if ( $term && ( in_array( $term->term_id, $restrict_list ) || in_array( $term->name, $restrict_list ) ) ) {
				$is_restricted = true;
			}
		}

		if ( ! $is_restricted ) {
			return true;
		}

		return $self->is_current_user_allowed();
	}

	/**
	 * Check if current user can access a specific post
	 */
	public static function can_user_access_post( $post_id ) {
		$self = self::get_instance();
		if ( ! $self->settings->get( 'enable_access_control', false ) ) {
			return true;
		}

		$restrict_docs = (array) $self->settings->get( 'restrict_docs', [ 'all' ] );
		$is_restricted = false;

		if ( in_array( 'All', $restrict_docs ) || in_array( 'all', $restrict_docs ) ) {
			$is_restricted = true;
		} else {
			$terms = get_the_terms( $post_id, $self->post_type->category );
			if ( ! empty( $terms ) && ! is_wp_error( $terms ) ) {
				foreach ( $terms as $term ) {
					if ( in_array( $term->term_id, $restrict_docs ) || in_array( $term->name, $restrict_docs ) ) {
						$is_restricted = true;
						break;
					}
				}
			}
		}

		if ( ! $is_restricted ) {
			return true;
		}

		return $self->is_current_user_allowed();
	}

	/**
	 * Check if current user has the required roles
	 */
	private function is_current_user_allowed() {
		if ( ! is_user_logged_in() ) {
			return false;
		}

		$user          = wp_get_current_user();
		$allowed_roles = (array) $this->settings->get( 'access_control_roles', [ 'administrator' ] );
		$user_roles    = (array) $user->roles;

		foreach ( $user_roles as $role ) {
			if ( in_array( $role, $allowed_roles ) ) {
				return true;
			}
		}

		return false;
	}

	public function restrict_access() {
		if ( ! $this->settings->get( 'enable_access_control', false ) ) {
			return;
		}

		$is_restricted = false;

		if ( is_singular( $this->post_type->post_type ) ) {
			if ( ! self::can_user_access_post( get_the_ID() ) ) {
				$is_restricted = true;
			}
		}

		if ( ! $is_restricted && ( is_tax( $this->post_type->category ) || is_tax( $this->post_type->tag ) ) ) {
			$queried_object = get_queried_object();
			if ( $queried_object && ! self::can_user_access_term( $queried_object->term_id, $queried_object->taxonomy ) ) {
				$is_restricted = true;
			}
		}

		if ( ! $is_restricted && is_tax( $this->post_type->knowledge_base ) ) {
			$queried_object = get_queried_object();
			if ( $queried_object && ! self::can_user_access_term( $queried_object->term_id, $queried_object->taxonomy ) ) {
				$is_restricted = true;
			}
		}

		// Also restrict root archive
		$is_kb_root = is_post_type_archive( $this->post_type->post_type ) || ( is_page() && get_post_meta( get_the_ID(), '_wp_page_template', true ) === 'acumenon-kb-template.php' );
		if ( ! $is_restricted && $is_kb_root ) {
			$restrict_kbs  = (array) $this->settings->get( 'restrict_knowledge_base', [] );
			$restrict_docs = (array) $this->settings->get( 'restrict_docs', [] );

			// If all docs are restricted OR all knowledge bases are restricted, lock the root
			if ( in_array( 'All', $restrict_kbs ) || in_array( 'All', $restrict_docs ) ) {
				if ( ! $this->is_current_user_allowed() ) {
					$is_restricted = true;
				}
			}
		}

		if ( ! $is_restricted ) {
			return;
		}

		// Handle Redirects
		$redirect_url = $this->settings->get( 'access_control_redirect_url', '' );
		if ( ! empty( $redirect_url ) ) {
			wp_safe_redirect( esc_url_raw( $redirect_url ) );
			exit;
		}

		if ( ! is_user_logged_in() ) {
			auth_redirect();
			exit;
		}

		wp_die( 
			esc_html__( 'You do not have permission to access this internal documentation.', 'acumenon' ), 
			esc_html__( 'Access Denied', 'acumenon' ), 
			[ 'response' => 403 ] 
		);
	}
}