<?php
/**
 * IT must not be able to reconfigure or purge lead data.
 *
 * Models BW Lead AI 1.10.0's real semantics — including administrator_floor(),
 * which grants BOTH shipped capabilities to any manage_options holder — then
 * checks our override produces the outcome we want. This is the test that
 * proves the restriction, since the plugin itself isn't installed yet.
 */
function t( $l, $ok ) { echo ( $ok ? 'PASS  ' : 'FAIL !' ) . " $l\n"; }

if ( ! class_exists( 'BW_Lead_AI_Caps' ) ) {
	eval( '
	class BW_Lead_AI_Caps {
		const VIEW = "bw_lead_ai_view";
		const MANAGE = "bw_lead_ai_manage";
		public static function view()   { return (string) apply_filters( "bw_lead_ai_view_capability", self::VIEW ); }
		public static function manage() { return (string) apply_filters( "bw_lead_ai_manage_capability", self::MANAGE ); }
		public static function can_view()   { return current_user_can( self::view() ); }
		public static function can_manage() { return current_user_can( self::manage() ); }
	}' );
	// The plugin floors the SHIPPED names for manage_options holders.
	add_filter( "user_has_cap", function ( $allcaps ) {
		if ( ! empty( $allcaps["manage_options"] ) ) {
			$allcaps[ BW_Lead_AI_Caps::VIEW ]   = true;
			$allcaps[ BW_Lead_AI_Caps::MANAGE ] = true;
		}
		return $allcaps;
	}, 9 );
}

t( 'our filter renames the manage capability', 'bw_lead_ai_manage_site' === BW_Lead_AI_Caps::manage() );
t( 'view is left as the shipped name',         'bw_lead_ai_view' === BW_Lead_AI_Caps::view() );

// The IT team: build one here rather than trust the environment — the real
// grants live on dev, and a test that silently finds nothing would "pass".
$it = get_userdata( wp_insert_user( array(
	'user_login' => 'bw_it_probe',
	'user_pass'  => wp_generate_password( 32 ),
	'user_email' => 'bw-it@example.invalid',
	'role'       => 'bw_staff',
) ) );
bw_access_apply_submission( $it->ID, array( 'bw_admin' => '1' ) );
$it = get_userdata( $it->ID );
wp_set_current_user( 0 ); wp_set_current_user( $it->ID );
t( 'IT: roles are not administrator',         ! in_array( 'administrator', (array) $it->roles, true ) );
t( 'IT: holds manage_options (the grant)',    current_user_can( 'manage_options' ) );
t( 'IT: can activate plugins',                current_user_can( 'activate_plugins' ) );
t( 'IT: CAN read lead reports',               BW_Lead_AI_Caps::can_view() );
t( 'IT: CANNOT manage / purge / reconfigure', ! BW_Lead_AI_Caps::can_manage() );
t( 'IT: the floored shipped name is inert',   ! current_user_can( BW_Lead_AI_Caps::manage() ) );
wp_set_current_user( 0 );
wp_delete_user( $it->ID );

// A real administrator must keep full control.
$admin = get_users( array( 'role' => 'administrator', 'number' => 1 ) );
if ( $admin ) {
	wp_set_current_user( 0 ); wp_set_current_user( $admin[0]->ID );
	t( 'admin: can view',   BW_Lead_AI_Caps::can_view() );
	t( 'admin: can manage', BW_Lead_AI_Caps::can_manage() );
}

// An admissions officer (view grant only) reads but never manages.
$probe = get_userdata( wp_insert_user( array(
	'user_login' => 'bw_admissions_probe',
	'user_pass'  => wp_generate_password( 32 ),
	'user_email' => 'bw-adm@example.invalid',
	'role'       => 'bw_staff',
) ) );
$probe->add_cap( 'bw_lead_ai_view' );
wp_set_current_user( 0 ); wp_set_current_user( $probe->ID );
t( 'admissions: can view',      BW_Lead_AI_Caps::can_view() );
t( 'admissions: cannot manage', ! BW_Lead_AI_Caps::can_manage() );
t( 'admissions: no manage_options', ! current_user_can( 'manage_options' ) );

wp_set_current_user( 0 );
wp_delete_user( $probe->ID );
echo "\nprobe deleted\n";