<?php

namespace DisableApplicationPasswords;

use WP_PowerSuite\Core\AbstractModule;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Module extends AbstractModule {

	private const MODULE_ID = 'disable-application-passwords';
	private const MODULE_VERSION = '1.1.0';

	/**
	 * High priority so this filter runs after most plugins; same-priority callbacks still depend on registration order.
	 */
	private const FILTER_PRIORITY_LATE = \PHP_INT_MAX;

	public function getId(): string {
		return self::MODULE_ID;
	}

	public function getName(): string {
		return __( 'Disable Application Passwords', 'wp-powersuite' );
	}

	public function getVersion(): string {
		return self::MODULE_VERSION;
	}

	public function getDescription(): string {
		return __(
			'Disables WordPress application passwords site-wide: blocks REST/XML-RPC login with app tokens and hides the profile UI. Normal account passwords and logged-in REST access are unaffected. Existing tokens remain stored but cannot authenticate until this module is off. May break mobile apps, headless sites, and automation that rely on application passwords.',
			'wp-powersuite'
		);
	}

	public function getContext(): string|array {
		// Every context where Application Passwords may be validated or managed. Omit `cron`
		// — nothing in WP core checks app passwords during a normal cron request.
		return [ 'admin', 'frontend', 'ajax', 'rest' ];
	}

	protected function registerHooks(): void {
		add_filter(
			'wp_is_application_passwords_available',
			[ self::class, 'filterApplicationPasswordsUnavailable' ],
			self::FILTER_PRIORITY_LATE
		);
	}

	public static function filterApplicationPasswordsUnavailable( bool $available ): bool {
		return false;
	}
}
