<?php

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( 'AIEO_Safe_Roles', false ) ) {

	class AIEO_Safe_Roles {

		
		public static $source = '';

		
		const POWER_WORDS = array(
			'edit', 'delete', 'publish', 'manage', 'create', 'install', 'activate', 'deactivate', 'update', 'upgrade',
			'upload', 'import', 'export', 'moderate', 'promote', 'remove', 'list', 'switch', 'customize', 'unfiltered',
			'assign', 'private', 'view', 'admin', 'administrator', 'settings', 'options', 'dashboard', 'access', 'setup',
			'network', 'restrict', 'shop', 'order', 'orders', 'coupon', 'coupons', 'woocommerce', 'report', 'reports',
			'aieo', 'rooster', 'wpml', 'loco', 'gravityforms', 'gform',
		);

		
		const CORE_CAPS = array(
			'activate_plugins', 'create_users', 'delete_others_pages', 'delete_others_posts', 'delete_pages', 'delete_plugins',
			'delete_posts', 'delete_private_pages', 'delete_private_posts', 'delete_published_pages', 'delete_published_posts',
			'delete_themes', 'delete_users', 'edit_dashboard', 'edit_files', 'edit_others_pages', 'edit_others_posts',
			'edit_pages', 'edit_plugins', 'edit_posts', 'edit_private_pages', 'edit_private_posts', 'edit_published_pages',
			'edit_published_posts', 'edit_theme_options', 'edit_themes', 'edit_users', 'export', 'import', 'install_plugins',
			'install_themes', 'level_1', 'level_2', 'level_3', 'level_4', 'level_5', 'level_6', 'level_7', 'level_8', 'level_9',
			'level_10', 'list_users', 'manage_categories', 'manage_links', 'manage_options', 'moderate_comments',
			'promote_users', 'publish_pages', 'publish_posts', 'read_private_pages', 'read_private_posts', 'remove_users',
			'switch_themes', 'unfiltered_html', 'unfiltered_upload', 'update_core', 'update_plugins', 'update_themes',
			'upload_files', 'customize',
		);

		
		const MANUAL_ONLY = array( 'price_viewer' );

		
		public static function manual_only() {
			
			$roles = (array) apply_filters( 'aieo_manual_only_roles', self::MANUAL_ONLY );
			return array_values( array_unique( array_filter( array_map( 'strval', $roles ) ) ) );
		}

		
		public static function is_manual_only( $role ) {
			return in_array( (string) $role, self::manual_only(), true );
		}

		
		public static function may_hand_out( $role ) {
			return ! self::is_manual_only( $role ) && self::is_safe( $role );
		}

		
		public static function hand_out_roles() {
			return array_diff_key( self::roles(), array_flip( self::manual_only() ) );
		}

		
		public static function default_role( $role ) {
			if ( ! is_string( $role ) || ! self::is_manual_only( $role ) ) {
				return $role;
			}
			return null !== get_role( 'customer' ) && ! self::is_manual_only( 'customer' ) ? 'customer' : 'subscriber';
		}

		
		public static function safe_caps() {
			$caps = (array) apply_filters( 'aieo_safe_role_capabilities', array( 'read', 'level_0' ) );
			return array_values( array_unique( array_map( 'strval', $caps ) ) );
		}

		
		public static function is_power_cap( $cap ) {
			$cap = strtolower( (string) $cap );
			if ( in_array( $cap, self::CORE_CAPS, true ) ) {
				return true;
			}
			if ( in_array( $cap, self::safe_caps(), true ) ) {
				return false;
			}
			$power = (bool) preg_match( '/(?:^|_)(?:' . implode( '|', self::POWER_WORDS ) . ')(?:_|$)/', $cap );
			
			return (bool) apply_filters( 'aieo_role_power_capability', $power, $cap );
		}

		
		public static function protected_roles() {
			$s = get_option( 'aieo_login_security', array() );
			return is_array( $s ) && isset( $s['roles'] ) ? array_values( array_filter( array_map( 'strval', (array) $s['roles'] ) ) ) : array();
		}

		
		public static function why_not( $role ) {
			$role = (string) $role;
			$obj  = '' === $role ? null : get_role( $role );
			if ( ! $obj ) {
				return array( 'missing' );
			}
			$out = 'administrator' === $role ? array( 'administrator' ) : array();
			if ( in_array( $role, self::protected_roles(), true ) ) {
				$out[] = 'protected';
			}
			foreach ( (array) $obj->capabilities as $cap => $granted ) {
				if ( $granted && self::is_power_cap( (string) $cap ) ) {
					$out[] = (string) $cap;
				}
			}
			return $out;
		}

		
		public static function is_safe( $role ) {
			return array() === self::why_not( $role );
		}

		
		public static function roles() {
			$out = array();
			foreach ( wp_roles()->roles as $slug => $data ) {
				if ( self::is_safe( (string) $slug ) ) {
					$out[ (string) $slug ] = translate_user_role( (string) ( $data['name'] ?? $slug ) );
				}
			}
			return $out;
		}

		
		public static function is_customer_account( $user ) {
			$user = $user instanceof WP_User ? $user : get_userdata( (int) $user );
			if ( ! $user instanceof WP_User || ! $user->exists() ) {
				return false;
			}
			if ( is_multisite() && is_super_admin( $user->ID ) ) {
				return false;
			}
			foreach ( (array) $user->caps as $key => $granted ) {
				if ( ! $granted ) {
					continue;
				}
				if ( wp_roles()->is_role( (string) $key ) ? ! self::is_safe( (string) $key ) : self::is_power_cap( (string) $key ) ) {
					return false;
				}
			}
			return true;
		}

		
		public static function grant( $user_id, $role, $source ) {
			$user = get_userdata( (int) $user_id );
			if ( ! $user instanceof WP_User || ! self::may_hand_out( (string) $role ) ) {
				return false;
			}
			if ( ! in_array( (string) $role, (array) $user->roles, true ) ) {
				$before       = self::$source;
				self::$source = (string) $source;
				$user->add_role( (string) $role );
				self::$source = $before;
			}
			return true;
		}

		
		public static function fallback_role() {
			foreach ( array( (string) get_option( 'default_role', '' ), 'customer', 'subscriber' ) as $role ) {
				if ( '' !== $role && self::may_hand_out( $role ) ) {
					return $role;
				}
			}
			return '';
		}

		
		public static function revoke( $user_id, $role, $source ) {
			$user = get_userdata( (int) $user_id );
			if ( ! $user instanceof WP_User ) {
				return false;
			}
			if ( ! in_array( (string) $role, (array) $user->roles, true ) ) {
				return true;
			}
			if ( ! self::may_hand_out( (string) $role ) ) {
				return false;
			}
			$fallback = array( (string) $role ) === array_values( (array) $user->roles ) ? self::fallback_role() : '';
			if ( $fallback === (string) $role ) {
				return false;
			}
			$before       = self::$source;
			self::$source = (string) $source;
			if ( '' !== $fallback ) {
				$user->add_role( $fallback );
			}
			$user->remove_role( (string) $role );
			self::$source = $before;
			return true;
		}
	}
}