/**
 * Rename the access choices.
 *
 * @param array $options → Associative array of access key => label.
 *
 * @return array → The modified options.
 */
add_filter( 'deadbolt_access_options', function( $options ) {
    // Change the label of an existing choice
    $options[ 'logged-in' ] = __( 'Members Only', 'my-plugin' );
    $options[ 'logged-out' ] = __( 'Guests Only', 'my-plugin' );

    // Keys that do not already exist are ignored, so these two lines have no effect
    $options[ 'staff' ] = __( 'Staff Only', 'my-plugin' );
    unset( $options[ 'everyone' ] );

    return $options;
} );

/**
 * Adjust the access rule for a post.
 *
 * $rule properties:
 *  - 'access' => string, 'everyone', 'logged-in', 'logged-out' or 'url-param'
 *  - 'param'  => array, only for 'url-param': [ 'name', 'operator', 'value' ]
 *  - 'roles'  => array, role slugs (empty means any logged-in user)
 *  - 'users'  => array, user IDs
 *  - 'source' => string, 'post', 'post_type' or 'disabled'
 *
 * @param array $rule    → The parsed rule for the post.
 * @param int   $post_id → The post ID.
 *
 * @return array → The modified rule.
 */
add_filter( 'deadbolt_access_rule', function( $rule, $post_id ) {
    // Change: events are always public, no matter what the post says
    if ( 'event' === get_post_type( $post_id ) ) {
        return [ 'access' => 'everyone', 'roles' => [], 'users' => [], 'source' => 'post' ];
    }

    if ( 'logged-in' === $rule[ 'access' ] && ! empty( $rule[ 'roles' ] ) ) {
        // Add: let editors in on every rule that is limited to specific roles
        if ( ! in_array( 'editor', $rule[ 'roles' ], true ) ) {
            $rule[ 'roles' ][] = 'editor';
        }

        // Remove: take the subscriber role off every rule, as long as other roles remain
        $remaining = array_values( array_diff( $rule[ 'roles' ], [ 'subscriber' ] ) );

        if ( ! empty( $remaining ) ) {
            $rule[ 'roles' ] = $remaining;
        }
    }

    return $rule;
}, 10, 2 );

/**
 * Grant or revoke access after the rule has been checked.
 *
 * $rule properties:
 *  - 'access' => string, 'everyone', 'logged-in' or 'logged-out'
 *  - 'roles'  => array, role slugs
 *  - 'users'  => array, user IDs
 *  - 'source' => string, 'post', 'post_type' or 'disabled'
 *
 * @param bool  $has_access → Whether the user can view the post.
 * @param int   $post_id    → The post ID.
 * @param int   $user_id    → The user ID, or 0 for logged-out visitors.
 * @param array $rule       → The parsed rule for the post.
 * @param array $query_args → The visitor's query string arguments, as sanitized key => value pairs. Used by URL Parameter access.
 *
 * @return bool → Whether the user can view the post.
 */
add_filter( 'deadbolt_user_has_access', function( $has_access, $post_id, $user_id, $rule ) {
    // Grant: anyone with an active membership can view posts that need a login
    if ( ! $has_access && $user_id && 'logged-in' === $rule[ 'access' ] && get_user_meta( $user_id, 'membership_active', true ) ) {
        return true;
    }

    // Revoke: suspended accounts lose access to everything except the No Access Page
    $no_access_page = (int) get_option( 'deadbolt_no_access_page' );

    if ( $has_access && $user_id && $post_id !== $no_access_page && get_user_meta( $user_id, 'account_suspended', true ) ) {
        return false;
    }

    return $has_access;
}, 10, 4 );

/**
 * Decide who bypasses restrictions.
 *
 * @param bool $bypass  → Whether the user bypasses restrictions.
 * @param int  $user_id → The user ID, or 0 for logged-out visitors.
 *
 * @return bool → Whether the user bypasses restrictions.
 */
add_filter( 'deadbolt_bypass', function( $bypass, $user_id ) {
    $user = $user_id ? get_userdata( $user_id ) : false;

    if ( ! $user ) {
        return $bypass;
    }

    // Add: support staff can always view everything
    if ( in_array( 'support_agent', (array) $user->roles, true ) ) {
        return true;
    }

    // Remove: this administrator is a test account and should see the site like everyone else
    if ( 'tester@example.com' === $user->user_email ) {
        return false;
    }

    return $bypass;
}, 10, 2 );

/**
 * Run code after a post's access rule changes.
 *
 * @param int    $post_id → The post ID.
 * @param string $raw     → The stored rule, such as 'logged-in,editor,user:5', or an empty string when the rule was cleared.
 */
add_action( 'deadbolt_access_updated', function( $post_id, $raw ) {
    // Clear the cached copy of the post so the new rule is used right away
    clean_post_cache( $post_id );

    // Keep a record of changes
    if ( '' === $raw ) {
        error_log( sprintf( 'Access rule cleared for post %d.', $post_id ) );
    } else {
        error_log( sprintf( 'Access rule for post %d is now "%s".', $post_id, $raw ) );
    }
}, 10, 2 );

/**
 * Change the redirect URL.
 *
 * @param string $url     → The redirect URL.
 * @param int    $post_id → The restricted post ID.
 * @param string $reason  → 'login_required', 'missing_access', 'logout_required' or 'param_required'.
 *
 * @return string → The modified URL.
 */
add_filter( 'deadbolt_redirect_url', function( $url, $post_id, $reason ) {
    // Change: send logged-out visitors straight to the login page and return them afterward
    if ( 'login_required' === $reason && 'course' === get_post_type( $post_id ) ) {
        return wp_login_url( get_permalink( $post_id ) );
    }

    // Add: tag the redirect so it can be tracked in analytics
    return add_query_arg( 'source', 'deadbolt', $url );
}, 10, 3 );

/**
 * Count how many times each page has denied a visitor.
 *
 * @param int    $post_id → The restricted post ID.
 * @param string $reason  → 'login_required', 'missing_access', 'logout_required' or 'param_required'.
 */
add_action( 'deadbolt_before_redirect', function( $post_id, $reason ) {
    $count = (int) get_post_meta( $post_id, '_denied_count', true );

    update_post_meta( $post_id, '_denied_count', $count + 1 );

    if ( 'missing_access' === $reason ) {
        error_log( sprintf( 'User %d was denied access to post %d.', get_current_user_id(), $post_id ) );
    }
}, 10, 2 );

/**
 * Change which query string arguments are carried to the No Access Page.
 *
 * @param array $carry → Associative array of sanitized key => value pairs.
 *
 * @return array → The modified arguments.
 */
add_filter( 'deadbolt_carry_query_args', function( $carry ) {
    // Remove: do not carry tracking parameters
    unset( $carry[ 'utm_source' ], $carry[ 'utm_medium' ], $carry[ 'utm_campaign' ] );

    // Add: tell the No Access Page which language the visitor was using
    $carry[ 'lang' ] = sanitize_key( get_locale() );

    return $carry;
} );

/**
 * Turn hiding options on or off.
 *
 * @param bool   $enabled   → Whether the option is on.
 * @param string $context   → 'archives', 'search', 'feeds', 'rest', 'nav_menus', 'adjacent' or 'sitemaps'.
 * @param string $post_type → The post type, or an empty string.
 *
 * @return bool → Whether the option is on.
 */
add_filter( 'deadbolt_hide_context', function( $enabled, $context, $post_type ) {
    // Add: always hide restricted content from feeds
    if ( 'feeds' === $context ) {
        return true;
    }

    // Remove: leave the REST API alone for products so the mobile app keeps working
    if ( 'rest' === $context && 'product' === $post_type ) {
        return false;
    }

    // Change: only hide from search on the front end
    if ( 'search' === $context && is_admin() ) {
        return false;
    }

    return $enabled;
}, 10, 3 );

/**
 * Change what is excluded for a user and context.
 *
 * $restrictions properties:
 *  - 'denied_types' => array, post types the user cannot view at all
 *  - 'exceptions'   => array, post IDs in a denied type that the user can still view
 *  - 'denied_ids'   => array, individual post IDs the user cannot view
 *
 * @param array  $restrictions → The restrictions.
 * @param int    $user_id      → The user ID, or 0 for logged-out visitors.
 * @param string $context      → 'archives', 'search', 'feeds', 'rest', 'adjacent' or 'sitemaps'.
 *
 * @return array → The modified restrictions.
 */
add_filter( 'deadbolt_query_restrictions', function( $restrictions, $user_id, $context ) {
    // Add: always hide a post from search results
    if ( 'search' === $context ) {
        $restrictions[ 'denied_ids' ][] = 123;
    }

    // Remove: never hide the pricing page from archives
    if ( 'archives' === $context ) {
        $restrictions[ 'denied_ids' ] = array_values( array_diff( $restrictions[ 'denied_ids' ], [ 456 ] ) );
    }

    // Change: keep one post visible even though its whole post type is hidden
    if ( in_array( 'resource', $restrictions[ 'denied_types' ], true ) ) {
        $restrictions[ 'exceptions' ][] = 789;
    }

    return $restrictions;
}, 10, 3 );

/**
 * Change which posts are removed from XML sitemaps.
 *
 * @param array $ids → Post IDs that logged-out visitors cannot view.
 *
 * @return array → The modified post IDs.
 */
add_filter( 'deadbolt_sitemap_excluded_ids', function( $ids ) {
    // Add: also keep thank-you pages out of sitemaps
    $thank_you = get_posts( [
        'post_type'      => 'page',
        'post_status'    => 'publish',
        'meta_key'       => '_is_thank_you_page',
        'meta_value'     => '1',
        'fields'         => 'ids',
        'posts_per_page' => -1,
    ] );

    $ids = array_merge( $ids, $thank_you );

    // Remove: keep the members landing page in sitemaps so it can be found in search
    $ids = array_diff( $ids, [ 321 ] );

    return array_values( array_unique( $ids ) );
} );

/**
 * Choose a template.
 *
 * @param int    $template_id → The template ID found by scope, or 0 for the built-in default.
 * @param int    $post_id     → The restricted post ID.
 * @param string $condition   → 'login_required', 'missing_access', 'logout_required' or 'param_required'.
 *
 * @return int → The template ID to use, or 0 for the built-in default.
 */
add_filter( 'deadbolt_template_id', function( $template_id, $post_id, $condition ) {
    // Change: posts in the Members category use their own template
    if ( 'login_required' === $condition && has_term( 'members', 'category', $post_id ) ) {
        return 482;
    }

    // Remove: courses always show the built-in default message
    if ( 'course' === get_post_type( $post_id ) ) {
        return 0;
    }

    return $template_id;
}, 10, 3 );

/**
 * Change the finished template output.
 *
 * @param string $html        → The rendered template.
 * @param int    $template_id → The template ID, or 0 for the built-in default.
 * @param int    $post_id     → The restricted post ID.
 * @param string $condition   → 'login_required', 'missing_access', 'logout_required' or 'param_required'.
 *
 * @return string → The modified HTML.
 */
add_filter( 'deadbolt_template_content', function( $html, $template_id, $post_id, $condition ) {
    // Add: show a support link under the message when the user is logged in but lacks the role
    if ( 'missing_access' === $condition ) {
        $html .= '<p>' . sprintf(
            /* translators: %s: Link to the contact page. */
            esc_html__( 'Think this is a mistake? %s', 'my-plugin' ),
            '<a href="' . esc_url( home_url( '/contact/' ) ) . '">' . esc_html__( 'Contact support', 'my-plugin' ) . '</a>'
        ) . '</p>';
    }

    // Change: wrap the message in a styled container
    $html = '<div class="my-no-access-message">' . $html . '</div>';

    return $html;
}, 10, 4 );

/**
 * Add, change or blank out merge tags.
 *
 * The callback receives a context array:
 *  - 'post_id'     => int, the restricted post ID
 *  - 'condition'   => string, 'login_required', 'missing_access', 'logout_required' or 'param_required'
 *  - 'user_id'     => int, the current user ID, or 0
 *  - 'rule'        => array, the post's access rule
 *  - 'redirect_to' => string, the URL of the restricted page
 *  - 'template_id' => int, the template ID, or 0
 *
 * @param array $tags → Associative array of tag name => [ 'label', 'callback' ].
 *
 * @return array → The modified tags.
 */
add_filter( 'deadbolt_merge_tags', function( $tags ) {
    // Add: {support_email}
    $tags[ 'support_email' ] = [
        'label'    => __( 'Support email address', 'my-plugin' ),
        'callback' => function( $context ) {
            return esc_html( get_option( 'admin_email' ) );
        },
    ];

    // Change: show the first name instead of the display name
    $tags[ 'user_display_name' ][ 'callback' ] = function( $context ) {
        $user = $context[ 'user_id' ] ? get_userdata( $context[ 'user_id' ] ) : false;

        return $user ? esc_html( $user->first_name ) : '';
    };

    // Remove: never show a registration link, but leave nothing behind in the output
    $tags[ 'register_link' ][ 'callback' ] = function( $context ) {
        return '';
    };

    return $tags;
} );

/**
 * Change menu item visibility.
 *
 * $item properties include: ID, title, url, type, object, object_id and classes.
 *
 * @param bool   $visible → Whether the item is shown.
 * @param object $item    → The menu item.
 *
 * @return bool → Whether the item is shown.
 */
add_filter( 'deadbolt_menu_item_visible', function( $visible, $item ) {
    // Add: hide any item with the CSS class "members-only" from logged-out visitors
    if ( ! is_user_logged_in() && in_array( 'members-only', (array) $item->classes, true ) ) {
        return false;
    }

    // Remove: always show the contact page
    if ( 'page' === $item->object && 12 === (int) $item->object_id ) {
        return true;
    }

    return $visible;
}, 10, 2 );

/**
 * Change Navigation block link visibility.
 *
 * $block properties include 'blockName', 'attrs' (label, url, kind, id and className) and 'innerHTML'.
 *
 * @param bool  $visible → Whether the link is shown.
 * @param array $block   → The parsed block.
 *
 * @return bool → Whether the link is shown.
 */
add_filter( 'deadbolt_nav_block_visible', function( $visible, $block ) {
    $attrs = $block[ 'attrs' ] ?? [];

    // Add: hide links with the class "guests-only" from logged-in users
    if ( is_user_logged_in() && false !== strpos( $attrs[ 'className' ] ?? '', 'guests-only' ) ) {
        return false;
    }

    // Remove: always show the link to the pricing page
    if ( '/pricing/' === wp_parse_url( $attrs[ 'url' ] ?? '', PHP_URL_PATH ) ) {
        return true;
    }

    return $visible;
}, 10, 2 );

/**
 * Add, change or remove settings.
 *
 * Each field accepts:
 *  - 'type'     => string, 'int', 'url', 'bool', 'post_types', 'roles', 'contexts' or any other value for text
 *  - 'default'  => mixed, the default value
 *  - 'autoload' => bool, whether the option loads on every request
 *  - 'sanitize' => callable, optional custom sanitize callback
 *
 * @param array $fields → Associative array of setting key => definition.
 *
 * @return array → The modified settings.
 */
add_filter( 'deadbolt_settings_fields', function( $fields ) {
    // Add: a support email address
    $fields[ 'support_email' ] = [
        'type'     => 'text',
        'default'  => get_option( 'admin_email' ),
        'autoload' => false,
        'sanitize' => 'sanitize_email',
    ];

    // Change: make administrators bypass restrictions unless the setting was saved
    $fields[ 'admin_bypass' ][ 'default' ] = 1;

    // Remove: the Register URL setting is not used on this site
    unset( $fields[ 'register_url' ] );

    return $fields;
} );

/**
 * Add a box to the Settings tab.
 */
add_action( 'deadbolt_settings_boxes', function() {
    $email = get_option( 'deadbolt_support_email', '' );
    ?>
    <div class="deadbolt-box">
        <div class="deadbolt-box-header"><h2><?php esc_html_e( 'Support', 'my-plugin' ); ?></h2></div>
        <div class="deadbolt-box-body">
            <div class="deadbolt-field">
                <label for="deadbolt_support_email"><?php esc_html_e( 'Support Email', 'my-plugin' ); ?></label>
                <input type="email" id="deadbolt_support_email" name="deadbolt[support_email]" value="<?php echo esc_attr( $email ); ?>">
            </div>
        </div>
    </div>
    <?php
} );

/**
 * Change the enabled post types.
 *
 * @param array $post_types → Associative array of post type => default access ('everyone', 'logged-in', 'logged-out' or a URL Parameter rule such as 'url-param, param:id, op:is_not, value:').
 *
 * @return array → The modified post types.
 */
add_filter( 'deadbolt_post_types', function( $post_types ) {
    // Add: always enable access controls for courses, and make them Logged-In Only by default
    $post_types[ 'course' ] = 'logged-in';

    // Change: pages are Everyone by default
    if ( isset( $post_types[ 'page' ] ) ) {
        $post_types[ 'page' ] = 'everyone';
    }

    // Remove: never use access controls on products
    unset( $post_types[ 'product' ] );

    return $post_types;
} );

/**
 * Change the roles available in access controls.
 *
 * @param array $roles → Array of role slugs.
 *
 * @return array → The modified role slugs.
 */
add_filter( 'deadbolt_roles', function( $roles ) {
    // Add: include the customer role
    if ( ! in_array( 'customer', $roles, true ) ) {
        $roles[] = 'customer';
    }

    // Remove: do not offer the subscriber role
    $roles = array_values( array_diff( $roles, [ 'subscriber' ] ) );

    return $roles;
} );

/**
 * Only let administrators search for users.
 *
 * @param string $capability → The required capability.
 *
 * @return string → The modified capability.
 */
add_filter( 'deadbolt_user_search_capability', function( $capability ) {
    return 'list_users';
} );

/**
 * Run code after settings are saved.
 *
 * @param array $values → Associative array of setting key => stored value.
 */
add_action( 'deadbolt_settings_saved', function( $values ) {
    // Clear a cache of the menu when the hiding options change
    if ( isset( $values[ 'hide' ] ) ) {
        delete_transient( 'my_plugin_menu_cache' );
    }

    // React to a specific setting
    if ( ! empty( $values[ 'admin_bypass' ] ) ) {
        error_log( 'Administrators now bypass Deadbolt restrictions.' );
    }
} );

/**
 * Run code after settings are reset.
 */
add_action( 'deadbolt_settings_reset', function() {
    // Remove the options added by your own integration
    delete_option( 'deadbolt_support_email' );
    delete_transient( 'my_plugin_menu_cache' );
} );

/**
 * Change the export file.
 *
 * $payload properties:
 *  - 'plugin'         => string, always 'deadbolt'
 *  - 'export_version' => int
 *  - 'plugin_version' => string
 *  - 'exported_at'    => string, UTC date
 *  - 'settings'       => array, setting key => value
 *
 * @param array $payload → The export data.
 *
 * @return array → The modified export data.
 */
add_filter( 'deadbolt_export_payload', function( $payload ) {
    // Add: include your own settings
    $payload[ 'my_plugin' ] = [
        'support_phone' => get_option( 'my_plugin_support_phone', '' ),
    ];

    // Add: record which site the file came from
    $payload[ 'site_url' ] = home_url();

    // Remove: do not include the Login URL, because it is different on each site
    unset( $payload[ 'settings' ][ 'login_url' ] );

    return $payload;
} );

/**
 * Import your own settings from an uploaded file.
 *
 * @param array $payload → The uploaded file's data.
 */
add_action( 'deadbolt_settings_imported', function( $payload ) {
    if ( ! empty( $payload[ 'my_plugin' ][ 'support_phone' ] ) ) {
        update_option( 'my_plugin_support_phone', sanitize_text_field( $payload[ 'my_plugin' ][ 'support_phone' ] ) );
    }
} );

/**
 * Change the header tabs.
 *
 * @param array $tabs → Associative array of key => [ 'label', 'url', 'screen' ].
 *
 * @return array → The modified tabs.
 */
add_filter( 'deadbolt_tabs', function( $tabs ) {
    // Add: a link to your documentation
    $tabs[ 'docs' ] = [
        'label'  => __( 'Documentation', 'my-plugin' ),
        'url'    => 'https://example.com/docs/',
        'screen' => '',
    ];

    // Change: rename the Templates tab
    if ( isset( $tabs[ 'templates' ] ) ) {
        $tabs[ 'templates' ][ 'label' ] = __( 'Messages', 'my-plugin' );
    }

    // Remove: hide the Templates tab from everyone except administrators
    if ( ! current_user_can( 'manage_options' ) ) {
        unset( $tabs[ 'templates' ] );
    }

    return $tabs;
} );

/**
 * Add a button next to the tab title on the Settings tab.
 *
 * @param string $active → The active tab key, such as 'pages', 'templates' or 'settings'.
 */
add_action( 'deadbolt_subheader_left', function( $active ) {
    if ( 'settings' !== $active ) {
        return;
    }
    ?>
    <a href="<?php echo esc_url( admin_url( 'users.php' ) ); ?>" class="deadbolt-button"><?php esc_html_e( 'Manage Users', 'my-plugin' ); ?></a>
    <?php
} );

/**
 * Add a link to the right side of the subheader on every tab.
 *
 * @param string $active → The active tab key, such as 'pages', 'templates' or 'settings'.
 */
add_action( 'deadbolt_subheader_right', function( $active ) {
    ?>
    <a href="https://example.com/support/" class="deadbolt-button" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Get Support', 'my-plugin' ); ?></a>
    <?php
} );

/**
 * Use your own logo in the header.
 *
 * @param string $url → The logo URL.
 *
 * @return string → The modified logo URL.
 */
add_filter( 'deadbolt_logo', function( $url ) {
    return get_stylesheet_directory_uri() . '/images/admin-logo.png';
} );

/**
 * Use the plugin's classes once they are loaded.
 */
add_action( 'deadbolt_loaded', function() {
    if ( ! class_exists( '\PluginRx\Deadbolt\Access' ) ) {
        return;
    }

    // Check access for a specific user and post
    $can_view = \PluginRx\Deadbolt\Access::user_has_access( 123, 5 );

    if ( ! $can_view ) {
        error_log( 'User 5 cannot view post 123.' );
    }
} );

/**
 * Allow an extra tag in templates.
 *
 * @param array $allowed → Allowed tags and attributes, in wp_kses format.
 *
 * @return array → The modified list.
 */
add_filter( 'deadbolt_template_allowed_html', function( $allowed ) {
    $allowed[ 'iframe' ] = [
        'src'             => true,
        'width'           => true,
        'height'          => true,
        'allowfullscreen' => true,
    ];

    return $allowed;
} );