<?php
declare(strict_types=1);

namespace Unsupervised\Schedular\Guardian;

use Unsupervised\Schedular\Auth\RoleManager;

/**
 * Keeps child accounts unusable as logins. A child holds the `us_student` role
 * so every `student_id` lookup in the schema keeps working, but nobody is ever
 * given its credentials — this closes the door the role would otherwise leave
 * open:
 *
 * - authentication is refused outright, and
 * - the booking capability is withheld, so nothing that reaches a capability
 *   check on a child's own session (there should be none) can book as them.
 *
 * Both key off the `us_child` meta, so ordinary students are untouched.
 */
class ChildLoginGate {

	public function register(): void {
		add_filter( 'wp_authenticate_user', [ $this, 'blockChildLogin' ], 10, 1 );
		add_filter( 'user_has_cap', [ $this, 'withholdBooking' ], 10, 4 );
	}

	/**
	 * Refuse authentication for a child account. Runs after password
	 * verification, so it holds even if a password were somehow set on one.
	 *
	 * @param \WP_User|\WP_Error $user Authenticating user, or an earlier error.
	 * @return \WP_User|\WP_Error
	 */
	public function blockChildLogin( $user ) {
		if ( $user instanceof \WP_User && GuardianService::isChild( (int) $user->ID ) ) {
			return new \WP_Error(
				'us_child_account',
				esc_html__( 'This is a child account and cannot be signed in to. Please sign in with the parent or guardian account.', 'unsupervised-schedular' )
			);
		}

		return $user;
	}

	/**
	 * Strip the booking capability from a child account, so the only route to a
	 * lesson in their name is their guardian's authorised booking.
	 *
	 * @param array<string, bool> $allcaps All capabilities currently held.
	 * @param array<int, string>  $caps    Required capabilities (unused).
	 * @param array<int, mixed>   $args    Callback args (unused).
	 * @param mixed               $user    The user being checked (a WP_User in practice).
	 * @return array<string, bool>
	 */
	public function withholdBooking( array $allcaps, array $caps, array $args, mixed $user ): array {
		if ( $user instanceof \WP_User && GuardianService::isChild( (int) $user->ID ) ) {
			unset( $allcaps[ RoleManager::CAP_BOOK_LESSON ] );
		}

		return $allcaps;
	}
}