<?php
/**
 * Teacher (bw_staff) access model.
 *
 * 151 teachers have accounts purely so they can maintain their own staff
 * profile. They sign in with their Brentwood Google account, so they never need
 * a password reset, a dashboard, or WordPress's own user-profile screen.
 *
 * The intent: **log in → land on your own staff profile editor → nothing else.**
 *
 * So for the bw_staff role this file:
 *   1. redirects to /my-profile after login (including via Google),
 *   2. bounces any wp-admin request back to /my-profile (AJAX excepted, since
 *      the profile editor posts to admin-ajax.php),
 *   3. hides the admin bar, and
 *   4. adds a Log out link to the profile page (the admin bar was the only way
 *      out, so hiding it without this would strand them).
 *
 * Note this is about the STAFF PROFILE (the `staff` post type), not the
 * WordPress user profile — /my-profile edits the staff post itself
 * (see inc/bw-my-profile.php).
 *
 * Everything keys off the role, so promoting a teacher to Site Editor simply
 * removes these restrictions. Their staff post is authored by them, so they
 * keep the ability to edit it at the higher role too.
 *
 * @package Kadence-Child
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/** Is this user a teacher-only (bw_staff) account? */
function bw_staff_is_profile_only( $user = null ) {
	$user = $user ? $user : wp_get_current_user();
	if ( ! $user || ! $user->exists() ) {
		return false;
	}
	// Only ever restrict when bw_staff is their ONLY role, so an upgraded
	// account (e.g. bw_staff + editor) is never locked out.
	$roles = (array) $user->roles;
	if ( array( 'bw_staff' ) !== array_values( $roles ) ) {
		return false;
	}
	// A teacher holding an access grant (a page they may edit, or a whole
	// section — see inc/bw-access.php) needs wp-admin and the admin bar: the
	// "Edit Page" link in that bar is how they reach their page at all.
	if ( function_exists( 'bw_access_user_has_any_grant' ) && bw_access_user_has_any_grant( $user->ID ) ) {
		return false;
	}
	return true;
}

/**
 * After login, send teachers straight to their profile editor.
 *
 * Deliberately keyed on the ROLE alone (not bw_staff_is_profile_only), so a
 * teacher who holds an access grant still lands on the page they know. The
 * grant only lifts the wp-admin lockout — it shouldn't change where logging
 * in takes them.
 */
add_filter(
	'login_redirect',
	function ( $redirect_to, $requested, $user ) {
		if ( $user instanceof WP_User && array( 'bw_staff' ) === array_values( (array) $user->roles ) ) {
			return bw_profile_page_url();
		}
		return $redirect_to;
	},
	10,
	3
);

/**
 * Keep teachers out of wp-admin — except the guides.
 *
 * The documentation is genuinely for them (how to edit your own profile, what
 * the buttons do), and it lives at an admin URL, so the lockout has to make
 * room for it. Everything else in wp-admin still bounces.
 */
add_action(
	'admin_init',
	function () {
		// The profile editor saves over admin-ajax.php — never block that.
		if ( wp_doing_ajax() ) {
			return;
		}
		if ( ! is_user_logged_in() || ! bw_staff_is_profile_only() ) {
			return;
		}
		// Reading the guides. Checked on the SCREEN, not on whether we happen to
		// be standing in for a capability: once BW Guides ships its own read
		// capability the borrow retires itself, and keying the exemption off the
		// borrow would have quietly locked teachers out of the documentation the
		// day the plugin improved.
		if ( function_exists( 'bw_access_is_guides_screen' ) && bw_access_is_guides_screen() ) {
			return;
		}
		if ( function_exists( 'bw_access_current_proxy' ) && bw_access_current_proxy() ) {
			return; // another proxied screen (see inc/bw-access.php).
		}
		wp_safe_redirect( bw_profile_page_url() );
		exit;
	}
);

/** Teachers get the admin bar back while reading the guides, so they can get out again. */
add_filter(
	'show_admin_bar',
	function ( $show ) {
		if ( is_admin() && function_exists( 'bw_access_is_guides_screen' ) && bw_access_is_guides_screen() ) {
			return true;
		}
		if ( is_admin() && function_exists( 'bw_access_current_proxy' ) && bw_access_current_proxy() ) {
			return true;
		}
		return $show;
	},
	11
);

/** No admin bar for teachers — the profile page is the whole experience. */
add_filter(
	'show_admin_bar',
	function ( $show ) {
		return bw_staff_is_profile_only() ? false : $show;
	}
);

/**
 * Give teachers a way to sign out, since the admin bar (which normally carries
 * Log Out) is hidden above. Appended to the /my-profile page only.
 */
add_filter(
	'the_content',
	function ( $content ) {
		if ( is_admin() || ! in_the_loop() || ! is_main_query() ) {
			return $content;
		}
		if ( ! is_user_logged_in() || ! bw_staff_is_profile_only() ) {
			return $content;
		}
		if ( ! function_exists( 'bw_profile_page_url' ) ) {
			return $content;
		}
		// Only on the profile page itself.
		$profile_id = url_to_postid( bw_profile_page_url() );
		if ( $profile_id && get_queried_object_id() !== $profile_id ) {
			return $content;
		}
		$link = '<p class="bw-profile-logout" style="margin-top:2rem">'
			. '<a href="' . esc_url( wp_logout_url( home_url( '/' ) ) ) . '">'
			. esc_html__( 'Log out', 'kadence-child' ) . '</a></p>';
		return $content . $link;
	},
	99
);