<?php

defined( 'ABSPATH' ) || exit;

/**
 * Flywheel Application Passwords module.
 *
 * Flywheel's managed-WP environment disables WordPress's Application
 * Passwords feature by hooking `wp_is_application_passwords_available` and
 * returning false. That's reasonable as a hosting default — but anyone
 * integrating an external tool with WP (a desktop client, a build script,
 * a CI deploy, anything that authenticates against the REST API) needs
 * Application Passwords back.
 *
 * This module forces the filter back to true at priority 99, which runs
 * after Flywheel's own callback (priority 10) and overrides the block.
 *
 * Companion to `flywheel_auto_updates` — same pattern, same group, same
 * "no settings, just an on/off via the Modules tab" UX. Enable both on a
 * Flywheel site to get auto-updates + app-password REST clients working.
 *
 * INTERACTION with the Security Hardening module: if both this module and
 * Security Hardening's "Disable Application Passwords" toggle are enabled,
 * THIS module wins (priority 99 > Security Hardening's default 10) and
 * Application Passwords are available. To actually disable Application
 * Passwords site-wide, leave this module off and turn the Security
 * Hardening toggle on.
 *
 * @package BW_Dev
 */
class BW_Dev_Module_Flywheel_App_Passwords implements BW_Dev_Module_Interface {

	public function slug(): string {
		return 'flywheel_app_passwords';
	}

	public function label(): string {
		return __( 'Flywheel Application Passwords', 'bw-dev' );
	}

	public function group(): string {
		return 'core';
	}

	public function default_settings(): array {
		return array();
	}

	public function sanitize( array $data ): array {
		// No settings beyond the master on/off toggle on the Modules tab.
		return array();
	}

	public function register(): void {
		// Priority 99 runs after Flywheel's default-priority block (and
		// after Security Hardening's "Disable Application Passwords"
		// callback if that's also active) — last filter callback wins.
		add_filter( 'wp_is_application_passwords_available', '__return_true', 99 );
	}

	public function uninstall(): void {
		// No persisted state.
	}

	public function render_tab(): void {
		?>
		<p class="description">
			<?php esc_html_e( 'Re-enables WordPress\'s Application Passwords feature on Flywheel-hosted sites. Flywheel blocks Application Passwords at the hosting level by filtering wp_is_application_passwords_available to false; this module hooks the same filter at a later priority and forces it back to true. Safe on non-Flywheel hosts — it just makes sure Application Passwords are available regardless of who else filtered them.', 'bw-dev' ); ?>
		</p>

		<p>
			<?php esc_html_e( 'There are no settings — enable on the Modules tab and it just works.', 'bw-dev' ); ?>
			<?php esc_html_e( 'After enabling, log in as a user with Application-Password access and go to Users → Profile → "Application Passwords" to issue a new password for your tool.', 'bw-dev' ); ?>
		</p>

		<div class="notice notice-warning inline" style="margin:14px 0; padding:10px 14px;">
			<p style="margin:0; font-weight:600;">
				<?php esc_html_e( 'Interaction with Security Hardening', 'bw-dev' ); ?>
			</p>
			<p style="margin:6px 0 0;">
				<?php esc_html_e( 'If both this module AND the Security Hardening module\'s "Disable Application Passwords" toggle are active, THIS module wins (it filters at priority 99, after Security Hardening\'s default priority 10) and Application Passwords are available. To actually disable Application Passwords site-wide, leave this module off on the Modules tab and turn Security Hardening\'s "Disable Application Passwords" toggle on.', 'bw-dev' ); ?>
			</p>
		</div>
		<?php
	}
}
