<?php

namespace PloverCRM\Common;

/**
 * Permission helpers for the hosted app and REST API.
 */
class Permissions
{
    /**
     * Shared CRM access check for the hosted app and REST API.
     *
     * Access is granted when the current user either:
     * - has CRM access through an assigned role, or
     * - is a WordPress administrator (`manage_options`)
     */
    public static function adminPermissionCheck()
    {
        // Check if user is authenticated
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return new \WP_Error('unauthorized', 'Authentication is required to access this resource', ['status' => 401]);
        }

        // CRM roles are the primary access model. WordPress administrators
        // are also allowed so site owners never lock themselves out.
        if (RoleManager::userHasAccess($user->ID)) {
            return true;
        }

        return new \WP_Error('crm_access_required', 'You do not have access to this CRM workspace. Please contact your administrator.', ['status' => 403]);
    }

    /**
     * Check if current user can perform action on field
     */
    public static function canAccessField(string $field, string $action): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::checkFieldPermission($user->ID, $field, $action);
    }

    /**
     * Check if current user can perform action on entity
     */
    public static function canAccessEntity(string $entity, string $action): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::checkEntityPermission($user->ID, $entity, $action);
    }

    /**
     * Check if current user has a specific workspace capability.
     */
    public static function canAccessCapability(string $capability): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::checkCapabilityPermission($user->ID, $capability);
    }

    /**
     * Check if current user can view or manage a shared workspace setting.
     */
    public static function canAccessSetting(string $settingKey, string $action): bool
    {
        $capability = CapabilityRegistry::getSettingCapabilityOrNull($settingKey, $action);

        if (!$capability) {
            return false;
        }

        return self::canAccessCapability($capability);
    }

    /**
     * Check if current user can delete contacts
     */
    public static function canDeleteContacts(): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::canDeleteContacts($user->ID);
    }

    /**
     * Check if current user can view a specific contact
     * 
     * @param int|null $contactOwnerId Contact owner's user ID
     * @return bool
     */
    public static function canViewContact(?int $contactOwnerId): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::canViewContact($user->ID, $contactOwnerId);
    }

    /**
     * Check if current user can update a specific contact
     * 
     * @param int|null $contactOwnerId Contact owner's user ID
     * @return bool
     */
    public static function canUpdateContact(?int $contactOwnerId): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::canUpdateContact($user->ID, $contactOwnerId);
    }

    /**
     * Check if current user can delete a specific contact
     * 
     * @param int|null $contactOwnerId Contact owner's user ID
     * @return bool
     */
    public static function canDeleteContact(?int $contactOwnerId): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::canDeleteContact($user->ID, $contactOwnerId);
    }

    /**
     * Check if current user can reassign a contact
     * 
     * @param int|null $contactOwnerId Contact owner's user ID
     * @return bool
     */
    public static function canReassignContact(?int $contactOwnerId): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::canReassignContact($user->ID, $contactOwnerId);
    }

    /**
     * Check if current user can claim an unassigned contact
     * 
     * @param int|null $contactOwnerId Contact owner's user ID
     * @return bool
     */
    public static function canClaimContact(?int $contactOwnerId): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::canClaimContact($user->ID, $contactOwnerId);
    }

    /**
     * Get current user's view scope
     * 
     * @return string 'all' or 'owned'
     */
    public static function getViewScope(): string
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return RoleManager::SCOPE_OWNED;
        }

        return RoleManager::getViewScope($user->ID);
    }

    /**
     * Get current user's update scope
     * 
     * @return string 'all' or 'owned'
     */
    public static function getUpdateScope(): string
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return RoleManager::SCOPE_OWNED;
        }

        return RoleManager::getUpdateScope($user->ID);
    }

    /**
     * Check if current user is super admin
     */
    public static function isSuperAdmin(): bool
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return false;
        }

        return RoleManager::isSuperAdmin($user->ID);
    }

    /**
     * Filter contact data based on current user's permissions
     */
    public static function filterContactForUser(array $contact, string $action = 'read'): array
    {
        $user = wp_get_current_user();

        if (!$user || !$user->ID) {
            return [];
        }

        return RoleManager::filterContactData($contact, $user->ID, $action);
    }
}
