<?php

declare(strict_types=1);

namespace AetosSeo\Security;

if (!defined('ABSPATH')) {
    exit;
}

class Capabilities
{
    /**
     * Capabilities a site may select via the aetos_seo_menu_capability filter.
     * Whitelist (audit 2026-06-10): the filter exists so admins choose WHICH
     * high-privilege capability gates the menu — not so a stray/compromised
     * filter can hand the audit data (full site weakness map) to subscribers
     * by returning something like 'read'. Out-of-list values fall back to the
     * default instead of being honored.
     */
    private const ALLOWED_MENU_CAPABILITIES = ['activate_plugins', 'manage_options'];

    public static function menu_capability(): string
    {
        $cap = (string) apply_filters('aetos_seo_menu_capability', 'activate_plugins');
        if (!in_array($cap, self::ALLOWED_MENU_CAPABILITIES, true)) {
            $cap = 'activate_plugins';
        }
        return $cap;
    }

    public static function can_manage(): bool
    {
        $cap = self::menu_capability();
        return current_user_can($cap) || current_user_can('manage_options') || current_user_can('activate_plugins');
    }

    public static function require_manage_options(): void
    {
        if (!self::can_manage()) {
            wp_die(esc_html__('Access denied.', 'aetos-seo'));
        }
    }

    public static function require_manage_options_ajax(): void
    {
        if (!self::can_manage()) {
            wp_send_json_error(['message' => 'Access denied'], 403);
        }
    }

    public static function require_strict_manage_options(): void
    {
        if (!current_user_can('manage_options')) {
            wp_die(esc_html__('Access denied.', 'aetos-seo'));
        }
    }

    public static function require_strict_manage_options_ajax(): void
    {
        if (!current_user_can('manage_options')) {
            wp_send_json_error(['message' => 'Access denied'], 403);
        }
    }
}