<?php
/**
 * Policy for modules that are unsafe to toggle in bulk from the CLI.
 *
 * Bulk operations (`--all`) optimize for convenience, which is dangerous for
 * modules that can lock an administrator out, change public URLs, block APIs,
 * or reroute email. Those modules are excluded from `--all` unless the operator
 * explicitly opts in with `--include-sensitive`.
 *
 * This is a CLI-specific policy, intentionally separate from
 * {@see \WP_PowerSuite\Core\SecurityCriticalModules} (which governs load caps
 * and license gating, a different concern).
 *
 * @package WP_PowerSuite\CLI\Support
 * @since 1.0.7
 */

namespace WP_PowerSuite\CLI\Support;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Sensitive-module allow/deny policy for bulk CLI operations.
 *
 * @since 1.0.7
 */
final class SensitiveModules {

	/**
	 * Modules excluded from `wp powersuite module enable --all` by default.
	 *
	 * Curated (not heuristic) to avoid over-excluding harmless modules whose
	 * slugs merely contain a keyword (e.g. "disable-gutenberg").
	 *
	 * @var list<string>
	 */
	private const SENSITIVE = [
		// Can lock admins out or change the login surface.
		'change-login-url',
		'limit-login-attempts',
		'password-protection',
		'coming-soon-maintenance',
		'maintenance-mode',
		'two-factor-authentication',
		'ip-whitelist-blacklist',
		'temporary-login',
		'login-id-type',
		'disable-password-reset',
		'disable-application-passwords',
		// Can break integrations / public endpoints.
		'disable-rest-api',
		'disable-xmlrpc',
		'force-ssl-admin',
		// Reroutes outbound email — misconfiguration silently drops mail.
		'email-smtp',
		'smtp-email',
		'smtp',
		'email-routing',
		// Federated auth — requires provider config before it is safe to enable.
		'google-sign-in',
		'facebook-sign-in',
		'github-sign-in',
		'cloudflare-turnstile',
	];

	/**
	 * Whether a module is considered sensitive for bulk operations.
	 *
	 * Filterable via {@see 'wp_powersuite_cli_sensitive_modules'} so site owners
	 * can tune the policy without editing plugin code.
	 *
	 * @since 1.0.7
	 * @param string $module_id Module ID.
	 * @return bool
	 */
	public static function isSensitive( string $module_id ): bool {
		$module_id = sanitize_key( $module_id );

		/**
		 * Filter the list of modules excluded from bulk CLI enable operations.
		 *
		 * @since 1.0.7
		 * @param list<string> $modules Sensitive module IDs.
		 */
		$list = apply_filters( 'wp_powersuite_cli_sensitive_modules', self::SENSITIVE );

		if ( ! is_array( $list ) ) {
			$list = self::SENSITIVE;
		}

		return in_array( $module_id, array_map( 'sanitize_key', $list ), true );
	}

	/**
	 * Full sensitive list (post-filter), for messaging.
	 *
	 * @since 1.0.7
	 * @return list<string>
	 */
	public static function all(): array {
		$list = apply_filters( 'wp_powersuite_cli_sensitive_modules', self::SENSITIVE );
		if ( ! is_array( $list ) ) {
			$list = self::SENSITIVE;
		}
		return array_values( array_unique( array_map( 'sanitize_key', $list ) ) );
	}
}
