<?php
/**
 * Revoke User Capability Tool.
 *
 * Revokes a specific capability from an individual user. Uses WP_User::remove_cap()
 * to remove capability from user meta.
 *
 * @package   Agenistrator
 * @since     1.0.0
 * @author    Alex Ruban <alex@maximum.guru>
 * @author    Maximum Software Inc <contact@maximum.software>
 * @license   GPL-3.0-only
 * @link      https://agenistrator.com/
 *
 * SPDX-FileCopyrightText: 2025-2026 Alex Ruban <alex@maximum.guru>
 * SPDX-FileCopyrightText: 2025-2026 Maximum Software Inc <contact@maximum.software>
 * SPDX-License-Identifier: GPL-3.0-only
 */

namespace Agenistrator;

// Direct access prevention
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Revoke_User_Capability_Tool class.
 */
class Revoke_User_Capability_Tool extends Tool {

	/**
	 * Get the tool ID.
	 *
	 * @return string The tool ID.
	 * @since     1.0.0
	 */
	public function get_id() {
		return 'revoke_user_capability';
	}

	/**
	 * Get the tool name.
	 *
	 * @return string The tool name.
	 * @since     1.0.0
	 */
	public function get_name() {
		return __( 'Revoke User Capability', 'agenistrator' );
	}

	/**
	 * Get the tool description.
	 *
	 * @return string The tool description.
	 * @since     1.0.0
	 */
	public function get_description() {
		return 'Revoke a specific capability from an individual user (removes user-level capability grant).';
	}

	/**
	 * Get the parameters schema for this tool.
	 *
	 * @return array Parameters schema in JSON Schema format.
	 * @since     1.0.0
	 */
	public function get_parameters() {
		return array(
			'type'       => 'object',
			'properties' => array(
				'user_id'    => array(
					'type'        => 'integer',
					'description' => 'The user ID to revoke the capability from',
				),
				'capability' => array(
					'type'        => 'string',
					'description' => 'The capability to revoke',
				),
			),
			'required'   => array( 'user_id', 'capability' ),
		);
	}

	/**
	 * Check if the current user can execute this tool.
	 *
	 * @return bool True if the current user has permission.
	 * @since     1.0.0
	 */
	public function current_user_can_execute() {
		return current_user_can( 'edit_users' );
	}

	/**
	 * Check if this tool is read-only.
	 *
	 * @return bool True if the tool only reads data.
	 * @since     1.0.0
	 */
	public function is_read_only() {
		return false;
	}

	/**
	 * Execute the tool with the given arguments.
	 *
	 * @param array $args The tool arguments.
	 *
	 * @return array The tool execution result.
	 * @since     1.0.0
	 */
	protected function execute( $args ) {
		$user_id    = absint( $args['user_id'] );
		$capability = sanitize_key( $args['capability'] );

		$user = get_user_by( 'ID', $user_id );
		if ( ! $user ) {
			return $this->error_response( 'User not found: ' . $user_id );
		}

		// Check if current user can edit this specific user
		if ( ! WordPress_Utils::can_edit_user( $user_id ) ) {
			return $this->error_response( 'You do not have permission to modify this user' );
		}

		// Check if user has this capability as a user-level grant
		$user_caps          = $user->caps;
		$had_user_level_cap = isset( $user_caps[ $capability ] );

		$user->remove_cap( $capability );

		return $this->success_response(
			'Capability revoked from user successfully',
			array(
				'user_id'                   => $user_id,
				'username'                  => $user->user_login,
				'capability'                => $capability,
				'had_user_level_capability' => $had_user_level_cap,
				'note'                      => 'User may still have this capability through their role',
			)
		);
	}
}
