<?php

use WP_CLI\Utils;
use WP_CLI\Formatter;

/**
 * Manages user roles, including creating new roles and resetting to defaults.
 *
 * See references for [Roles and Capabilities](https://codex.wordpress.org/Roles_and_Capabilities) and [WP User class](https://codex.wordpress.org/Class_Reference/WP_User).
 *
 * ## EXAMPLES
 *
 *     # List roles.
 *     $ wp role list --fields=role --format=csv
 *     role
 *     administrator
 *     editor
 *     author
 *     contributor
 *     subscriber
 *
 *     # Check to see if a role exists.
 *     $ wp role exists editor
 *     Success: Role with ID 'editor' exists.
 *
 *     # Create a new role.
 *     $ wp role create approver Approver
 *     Success: Role with key 'approver' created.
 *
 *     # Delete an existing role.
 *     $ wp role delete approver
 *     Success: Role with key 'approver' deleted.
 *
 *     # Reset existing roles to their default capabilities.
 *     $ wp role reset administrator author contributor
 *     Success: Reset 3/3 roles.
 *
 * @package wp-cli
 */
class Role_Command extends WP_CLI_Command {

	/**
	 * List of available fields.
	 *
	 * @var array
	 */
	private $fields = [ 'name', 'role' ];

	/**
	 * Default roles as provided by WordPress Core.
	 *
	 * @var array
	 */
	private $roles = [ 'administrator', 'editor', 'author', 'contributor', 'subscriber' ];

	/**
	 * Lists all roles.
	 *
	 * ## OPTIONS
	 *
	 * [--fields=<fields>]
	 * : Limit the output to specific object fields.
	 *
	 * [--field=<field>]
	 * : Prints the value of a single field.
	 *
	 * [--format=<format>]
	 * : Render output in a particular format.
	 * ---
	 * default: table
	 * options:
	 *   - table
	 *   - csv
	 *   - json
	 *   - count
	 *   - yaml
	 * ---
	 *
	 * ## AVAILABLE FIELDS
	 *
	 * These fields will be displayed by default for each role:
	 *
	 * * name
	 * * role
	 *
	 * There are no optional fields.
	 *
	 * ## EXAMPLES
	 *
	 *     # List roles.
	 *     $ wp role list --fields=role --format=csv
	 *     role
	 *     administrator
	 *     editor
	 *     author
	 *     contributor
	 *     subscriber
	 *
	 * @subcommand list
	 */
	public function list_( $args, $assoc_args ) {
		global $wp_roles;

		$output_roles = array();
		foreach ( $wp_roles->roles as $key => $role ) {
			$output_role = new stdClass();

			$output_role->name = $role['name'];
			$output_role->role = $key;

			$output_roles[] = $output_role;
		}

		$formatter = new Formatter( $assoc_args, $this->fields );
		$formatter->display_items( $output_roles );
	}

	/**
	 * Checks if a role exists.
	 *
	 * Exits with return code 0 if the role exists, 1 if it does not.
	 *
	 * ## OPTIONS
	 *
	 * <role-key>
	 * : The internal name of the role.
	 *
	 * ## EXAMPLES
	 *
	 *     # Check if a role exists.
	 *     $ wp role exists editor
	 *     Success: Role with ID 'editor' exists.
	 */
	public function exists( $args ) {
		global $wp_roles;

		if ( ! in_array( $args[0], array_keys( $wp_roles->roles ), true ) ) {
			WP_CLI::error( "Role with ID '{$args[0]}' does not exist." );
		}

		WP_CLI::success( "Role with ID '{$args[0]}' exists." );
	}

	/**
	 * Creates a new role.
	 *
	 * ## OPTIONS
	 *
	 * <role-key>
	 * : The internal name of the role.
	 *
	 * <role-name>
	 * : The publicly visible name of the role.
	 *
	 * [--clone=<role>]
	 * : Clone capabilities from an existing role.
	 *
	 * ## EXAMPLES
	 *
	 *     # Create role for Approver.
	 *     $ wp role create approver Approver
	 *     Success: Role with key 'approver' created.
	 *
	 *     # Create role for Product Administrator.
	 *     $ wp role create productadmin "Product Administrator"
	 *     Success: Role with key 'productadmin' created.
	 */
	public function create( $args, $assoc_args ) {
		global $wp_roles;

		self::persistence_check();

		$role_key  = array_shift( $args );
		$role_name = array_shift( $args );

		if ( empty( $role_key ) || empty( $role_name ) ) {
			WP_CLI::error( "Can't create role, insufficient information provided." );
		}

		$capabilities = false;
		if ( ! empty( $assoc_args['clone'] ) ) {
			$role_obj = $wp_roles->get_role( $assoc_args['clone'] );
			if ( ! $role_obj ) {
				WP_CLI::error( "'{$assoc_args['clone']}' role not found." );
			}
			$capabilities = array_keys( $role_obj->capabilities );
		}

		if ( add_role( $role_key, $role_name ) ) {
			if ( ! empty( $capabilities ) ) {
				$role_obj = $wp_roles->get_role( $role_key );
				foreach ( $capabilities as $cap ) {
					$role_obj->add_cap( $cap );
				}
				WP_CLI::success( "Role with key '{$role_key}' created. Cloned capabilities from '{$assoc_args['clone']}'." );
			} else {
				WP_CLI::success( "Role with key '{$role_key}' created." );
			}
		} else {
			WP_CLI::error( "Role couldn't be created." );
		}
	}

	/**
	 * Deletes an existing role.
	 *
	 * ## OPTIONS
	 *
	 * <role-key>
	 * : The internal name of the role.
	 *
	 * ## EXAMPLES
	 *
	 *     # Delete approver role.
	 *     $ wp role delete approver
	 *     Success: Role with key 'approver' deleted.
	 *
	 *     # Delete productadmin role.
	 *     $ wp role delete productadmin
	 *     Success: Role with key 'productadmin' deleted.
	 */
	public function delete( $args ) {
		global $wp_roles;

		self::persistence_check();

		$role_key = array_shift( $args );

		if ( empty( $role_key ) || ! isset( $wp_roles->roles[ $role_key ] ) ) {
			WP_CLI::error( 'Role key not provided, or is invalid.' );
		}

		remove_role( $role_key );

		// Note: remove_role() doesn't indicate success or otherwise, so we have to
		// check ourselves
		if ( ! isset( $wp_roles->roles[ $role_key ] ) ) {
			WP_CLI::success( "Role with key '{$role_key}' deleted." );
		} else {
			WP_CLI::error( "Role with key '{$role_key}' could not be deleted." );
		}
	}

	/**
	 * Resets any default role to default capabilities.
	 *
	 * Uses WordPress' `populate_roles()` function to put one or more
	 * roles back into the state they were at in the a fresh
	 * WordPress install. Removes any capabilities that were added,
	 * and restores any capabilities that were removed. Custom roles
	 * are not affected.
	 *
	 * ## OPTIONS
	 *
	 * [<role-key>...]
	 * : The internal name of one or more roles to reset.
	 *
	 * [--all]
	 * : If set, all default roles will be reset.
	 *
	 * ## EXAMPLES
	 *
	 *     # Reset three roles.
	 *     $ wp role reset administrator author contributor
	 *     Restored 1 capability to and removed 0 capabilities from 'administrator' role.
	 *     No changes necessary for 'author' role.
	 *     No changes necessary for 'contributor' role.
	 *     Success: 1 of 3 roles reset.
	 *
	 *     # Reset a custom role.
	 *     $ wp role reset custom_role
	 *     Custom role 'custom_role' not affected.
	 *     Error: Must specify a default role to reset.
	 *
	 *     # Reset all default roles.
	 *     $ wp role reset --all
	 *     Success: All default roles reset.
	 */
	public function reset( $args, $assoc_args ) {

		self::persistence_check();

		if ( ! Utils\get_flag_value( $assoc_args, 'all' ) && empty( $args ) ) {
			WP_CLI::error( 'Role key not provided, or is invalid.' );
		}

		if ( ! function_exists( 'populate_roles' ) ) {
			require_once ABSPATH . 'wp-admin/includes/schema.php';
		}

		global $wp_roles;
		$all_roles     = array_keys( $wp_roles->roles );
		$preserve_args = $args;

		// Get our default roles.
		$default_roles = $this->roles;
		$preserve      = $this->roles;
		$before        = [];

		if ( Utils\get_flag_value( $assoc_args, 'all' ) ) {
			foreach ( $default_roles as $role ) {
				$before[ $role ] = get_role( $role );
				remove_role( $role );
				$args[] = $role;
			}
			populate_roles();
			$not_affected_roles = array_diff( $all_roles, $default_roles );
			if ( ! empty( $not_affected_roles ) ) {
				foreach ( $not_affected_roles as $not_affected_role ) {
					WP_CLI::log( "Custom role '{$not_affected_role}' not affected." );
				}
			}
		} else {

			foreach ( $args as $k => $role_key ) {
				$key = array_search( $role_key, $default_roles, true );
				if ( false !== $key ) {
					unset( $preserve[ $key ] );
					$before[ $role_key ] = get_role( $role_key );
					remove_role( $role_key );
				} else {
					unset( $args[ $k ] );
				}
			}

			$not_affected_roles = array_diff( $preserve_args, $default_roles );
			if ( ! empty( $not_affected_roles ) ) {
				foreach ( $not_affected_roles as $not_affected_role ) {
					WP_CLI::log( "Custom role '{$not_affected_role}' not affected." );
				}
			}

			// No roles were unset, bail.
			if ( count( $default_roles ) === count( $preserve ) ) {
				WP_CLI::error( 'Must specify a default role to reset.' );
			}

			// For the roles we're not resetting.
			foreach ( $preserve as $k => $role ) {
				/* save roles
				 * if get_role is null
				 * save role name for re-removal
				 */
				$roleobj        = get_role( $role );
				$preserve[ $k ] = is_null( $roleobj ) ? $role : $roleobj;

				remove_role( $role );
			}

			// Put back all default roles and capabilities.
			populate_roles();

			// Restore the preserved roles.
			foreach ( $preserve as $k => $roleobj ) {
				// Re-remove after populating.
				if ( is_a( $roleobj, 'WP_Role' ) ) {
					remove_role( $roleobj->name );
					add_role( $roleobj->name, ucwords( $roleobj->name ), $roleobj->capabilities );
				} else {
					// When not an object, that means the role didn't exist before.
					remove_role( $roleobj );
				}
			}
		}

		$num_reset    = 0;
		$args         = array_unique( $args );
		$num_to_reset = count( $args );
		foreach ( $args as $role_key ) {
			$after[ $role_key ] = get_role( $role_key );

			// phpcs:ignore Universal.Operators.StrictComparisons -- Object instances won't be same, strict check will fail here.
			if ( $after[ $role_key ] != $before[ $role_key ] ) {
				++$num_reset;
				$before_capabilities = isset( $before[ $role_key ] ) ? $before[ $role_key ]->capabilities : [];
				$restored_cap        = array_diff_key( $after[ $role_key ]->capabilities, $before_capabilities );
				$removed_cap         = array_diff_key( $before_capabilities, $after[ $role_key ]->capabilities );
				$restored_cap_count  = count( $restored_cap );
				$removed_cap_count   = count( $removed_cap );
				$restored_text       = ( 1 === $restored_cap_count ) ? '%d capability' : '%d capabilities';
				$removed_text        = ( 1 === $removed_cap_count ) ? '%d capability' : '%d capabilities';
				$message             = "Restored {$restored_text} to and removed {$removed_text} from '%s' role.";
				WP_CLI::log( sprintf( $message, $restored_cap_count, $removed_cap_count, $role_key ) );
			} else {
				WP_CLI::log( "No changes necessary for '{$role_key}' role." );
			}
		}
		if ( $num_reset ) {
			if ( 1 === count( $args ) ) {
				WP_CLI::success( 'Role reset.' );
			} else {
				WP_CLI::success( "{$num_reset} of {$num_to_reset} roles reset." );
			}
		} elseif ( 1 === count( $args ) ) {
				WP_CLI::success( 'Role didn\'t need resetting.' );
		} else {
			WP_CLI::success( 'No roles needed resetting.' );
		}
	}

	/**
	 * Assert that the roles are persisted to the database.
	 *
	 * @throws \WP_CLI\ExitException If the roles are not persisted to the
	 *                               database.
	 */
	private static function persistence_check() {
		global $wp_roles;

		if ( ! $wp_roles->use_db ) {
			WP_CLI::error( 'Role definitions are not persistent.' );
		}
	}
}