<?php
/**
 * Authorization helper.
 *
 * Capability-based access gating for admin features. Platform Helm uses
 * standard WordPress capabilities rather than a bespoke "master admin"
 * concept: administrative module screens require `manage_options`. This helper
 * gives ported modules a single, consistent gate.
 *
 * @package Platform\Helm\Core
 */

declare( strict_types = 1 );

namespace Platform\Helm\Core;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class Authorization {

	/** Capability required for Helm admin/management screens. */
	public const ADMIN_CAP = 'manage_options';

	/**
	 * Whether the current user may manage Helm admin features.
	 */
	public static function is_admin_user(): bool {
		return current_user_can( self::ADMIN_CAP );
	}

	/**
	 * Hard gate for a full-page request. Dies with a message if not allowed.
	 */
	public static function require_admin(): void {
		if ( ! self::is_admin_user() ) {
			wp_die( esc_html__( 'You do not have permission to access this page.', 'platform-helm' ) );
		}
	}

	/**
	 * Hard gate for an AJAX request. Sends a JSON error if not allowed.
	 */
	public static function require_admin_ajax(): void {
		if ( ! self::is_admin_user() ) {
			wp_send_json_error( [ 'message' => __( 'Permission denied.', 'platform-helm' ) ], 403 );
		}
	}

	/* ---- Back-compat aliases used by ported modules ---- */

	public static function is_master_admin(): bool {
		return self::is_admin_user();
	}

	public static function require_master_admin(): void {
		self::require_admin();
	}

	public static function require_master_admin_ajax(): void {
		self::require_admin_ajax();
	}
}
