unsupervised-scheduler/src/Auth/StudentAdminGuard.php

<?php
declare(strict_types=1);

namespace Unsupervised\Schedular\Auth;

/**
 * Keeps front-end-only users (students) out of wp-admin entirely.
 *
 * Students authenticate through the front-end login shortcode and do all of
 * their work — booking, viewing lessons, paying — on the site's public pages.
 * They have no reason to see the WordPress dashboard, profile screen, or admin
 * bar, so this guard redirects them to the front end if they reach wp-admin and
 * hides the admin bar for them everywhere.
 *
 * Access is decided by capability, not role: anyone holding a back-office
 * capability (a WordPress administrator, studio admin, or instructor) keeps full
 * wp-admin access, while a user with none of them is treated as front-end only.
 */
class StudentAdminGuard {

	/**
	 * Capabilities that grant a genuine reason to be in wp-admin. A user holding
	 * none of these is front-end only and is kept out of the dashboard.
	 *
	 * @var list<string>
	 */
	private const BACK_OFFICE_CAPS = [
		'manage_options',
		RoleManager::CAP_MANAGE_INSTRUCTORS,
		RoleManager::CAP_MANAGE_STUDENTS,
		RoleManager::CAP_MANAGE_OFFERINGS,
		RoleManager::CAP_MANAGE_QUESTIONS,
		RoleManager::CAP_MANAGE_POLICIES,
		RoleManager::CAP_MANAGE_BILLING,
		RoleManager::CAP_MANAGE_AVAILABILITY,
		RoleManager::CAP_VIEW_ALL_LESSONS,
		RoleManager::CAP_VIEW_ALL_PAYMENTS,
		RoleManager::CAP_VIEW_OWN_PAYMENTS,
		RoleManager::CAP_EXPORT_PAYMENTS,
	];

	public function register(): void {
		add_action( 'admin_init', [ $this, 'redirectFromDashboard' ] );
		add_filter( 'show_admin_bar', [ $this, 'hideAdminBar' ] );
	}

	/**
	 * Redirect a front-end-only user away from any wp-admin page to the site
	 * home, so the dashboard and profile screens are never reachable.
	 */
	public function redirectFromDashboard(): void {
		if ( ! $this->shouldBlockAdminAccess() ) {
			return;
		}

		wp_safe_redirect( home_url( '/' ) );
		exit;
	}

	/**
	 * Whether the current request into wp-admin should be bounced to the front
	 * end. AJAX requests are always allowed through so front-end features that
	 * call admin-ajax keep working.
	 */
	public function shouldBlockAdminAccess(): bool {
		if ( wp_doing_ajax() ) {
			return false;
		}

		if ( ! is_user_logged_in() ) {
			return false;
		}

		return ! $this->hasBackOfficeAccess();
	}

	/**
	 * Hide the admin bar for front-end-only users; leave it untouched for anyone
	 * with back-office access.
	 *
	 * @param bool $show Whether WordPress would otherwise show the admin bar.
	 */
	public function hideAdminBar( bool $show ): bool {
		if ( is_user_logged_in() && ! $this->hasBackOfficeAccess() ) {
			return false;
		}

		return $show;
	}

	/**
	 * Whether the current user holds any capability that warrants wp-admin access.
	 */
	private function hasBackOfficeAccess(): bool {
		foreach ( self::BACK_OFFICE_CAPS as $cap ) {
			if ( current_user_can( $cap ) ) {
				return true;
			}
		}

		return false;
	}
}