<?php
/**
 * Capabilities — AI-SiteArk custom capability names and role mapping.
 *
 * @package AI_SiteArk
 * Copyright (c) 2026 AtoZ INFOWAY INC.
 * Licensed under the GNU General Public License, version 2 or later.
 */

namespace AtoZ\SiteArk\Helpers;

defined( 'ABSPATH' ) || exit;

/**
 * Class Capabilities
 *
 * MANAGE = create/download backups. ADMIN = the destructive/config surface
 * (restore, migrate, schedules, destinations, delete).
 */
class Capabilities {

	const MANAGE = 'aisiteark_manage';
	const ADMIN  = 'aisiteark_admin';

	/**
	 * All AI-SiteArk capabilities.
	 *
	 * @return string[]
	 */
	public static function all() {
		return array( self::MANAGE, self::ADMIN );
	}

	/**
	 * Grant capabilities to the administrator role on install.
	 *
	 * @return void
	 */
	public static function add_to_roles() {
		$admin = get_role( 'administrator' );
		if ( $admin ) {
			foreach ( self::all() as $cap ) {
				$admin->add_cap( $cap );
			}
		}
	}


	/**
	 * Current grant level for a role: 'full' | 'backup' | 'none'.
	 *
	 * @param string $role_slug Role slug.
	 * @return string
	 */
	public static function grant_level( $role_slug ) {
		$role = get_role( $role_slug );
		if ( ! $role ) {
			return 'none';
		}
		if ( $role->has_cap( self::ADMIN ) ) {
			return 'full';
		}
		if ( $role->has_cap( self::MANAGE ) ) {
			return 'backup';
		}
		return 'none';
	}

	/**
	 * Remove all capabilities from every role (used on uninstall).
	 *
	 * @return void
	 */
	public static function remove_from_roles() {
		$roles = wp_roles();
		if ( ! $roles ) {
			return;
		}
		foreach ( array_keys( $roles->roles ) as $role_name ) {
			$role = get_role( $role_name );
			if ( ! $role ) {
				continue;
			}
			foreach ( self::all() as $cap ) {
				$role->remove_cap( $cap );
			}
		}
	}
}