<?php
/**
 * Add Capability to Role Tool.
 *
 * Adds a capability to an existing role. Can add custom or existing capabilities
 * with validation against WordPress core role objects.
 *
 * @package   Agenistrator
 * @since     1.0.0
 * @author    Alex Ruban <alex@maximum.guru>
 * @author    Maximum Software Inc <contact@maximum.software>
 * @license   GPL-3.0-only
 * @link      https://agenistrator.com/
 *
 * SPDX-FileCopyrightText: 2025-2026 Alex Ruban <alex@maximum.guru>
 * SPDX-FileCopyrightText: 2025-2026 Maximum Software Inc <contact@maximum.software>
 * SPDX-License-Identifier: GPL-3.0-only
 */

namespace Agenistrator;

// Direct access prevention
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Add_Capability_To_Role_Tool class.
 */
class Add_Capability_To_Role_Tool extends Tool {

	/**
	 * Get the tool ID.
	 *
	 * @return string The tool ID.
	 * @since     1.0.0
	 */
	public function get_id() {
		return 'add_capability_to_role';
	}

	/**
	 * Get the tool name.
	 *
	 * @return string The tool name.
	 * @since     1.0.0
	 */
	public function get_name() {
		return __( 'Add Capability to Role', 'agenistrator' );
	}

	/**
	 * Get the tool description.
	 *
	 * @return string The tool description.
	 * @since     1.0.0
	 */
	public function get_description() {
		return 'Add a capability to an existing role.';
	}

	/**
	 * Get the parameters schema for this tool.
	 *
	 * @return array Parameters schema in JSON Schema format.
	 * @since     1.0.0
	 */
	public function get_parameters() {
		return array(
			'type'       => 'object',
			'properties' => array(
				'role'       => array(
					'type'        => 'string',
					'description' => 'The role slug to modify',
				),
				'capability' => array(
					'type'        => 'string',
					'description' => 'The capability to add',
				),
			),
			'required'   => array( 'role', 'capability' ),
		);
	}

	/**
	 * Check if the current user can execute this tool.
	 *
	 * @return bool True if the current user has permission.
	 * @since     1.0.0
	 */
	public function current_user_can_execute() {
		return current_user_can( 'manage_options' );
	}

	/**
	 * Check if this tool is read-only.
	 *
	 * @return bool True if the tool only reads data.
	 * @since     1.0.0
	 */
	public function is_read_only() {
		return false;
	}

	/**
	 * Execute the tool with the given arguments.
	 *
	 * @param array $args The tool arguments.
	 *
	 * @return array The tool execution result.
	 * @since     1.0.0
	 */
	protected function execute( $args ) {
		$role_slug  = sanitize_key( $args['role'] );
		$capability = sanitize_key( $args['capability'] );

		// Check if capability requires super admin in multisite
		if ( ! WordPress_Utils::can_grant_capability( $capability ) ) {
			return $this->error_response( 'This capability requires super admin privileges to grant: ' . $capability );
		}

		$role = get_role( $role_slug );
		if ( ! $role ) {
			return $this->error_response( 'Role not found: ' . $role_slug );
		}

		if ( $role->has_cap( $capability ) ) {
			return $this->success_response(
				'Role already has this capability',
				array(
					'role'        => $role_slug,
					'capability'  => $capability,
					'already_had' => true,
				)
			);
		}

		$role->add_cap( $capability );

		// Verify the capability was added
		$role = get_role( $role_slug );
		if ( ! $role->has_cap( $capability ) ) {
			return $this->error_response( 'Failed to add capability to role' );
		}

		return $this->success_response(
			'Capability added to role successfully',
			array(
				'role'        => $role_slug,
				'capability'  => $capability,
				'already_had' => false,
			)
		);
	}
}
