<?php

/**
 * Matomo - free/libre analytics platform
 *
 * @link https://matomo.org
 * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
 */

namespace Piwik\Plugins\TagManager\Input;

use Piwik\Container\StaticContainer;
use Piwik\NoAccessException;
use Piwik\Plugins\TagManager\Access\Capability\PublishLiveContainer;
use Piwik\Plugins\TagManager\Access\Capability\TagManagerWrite;
use Piwik\Plugins\TagManager\Access\Capability\UseCustomTemplates;
use Piwik\Plugins\TagManager\Dao\ContainerReleaseDao;
use Piwik\Plugins\TagManager\Model\Environment;
use Piwik\Piwik;
use Piwik\Plugins\TagManager\SystemSettings;
use Piwik\Site;

class AccessValidator
{
    /**
     * @var SystemSettings
     */
    private $settings;

    /**
     * @var ContainerReleaseDao|null
     */
    private $containerReleaseDao;

    /**
     * @var bool
     */
    private $skipCustomTemplatesCapabilityCheck = false;

    public function __construct(SystemSettings $settings, ?ContainerReleaseDao $containerReleaseDao = null)
    {
        $this->settings = $settings;
        $this->containerReleaseDao = $containerReleaseDao;
    }

    public function runWithoutCustomTemplatesCapabilityCheck(callable $callback)
    {
        $previous = $this->skipCustomTemplatesCapabilityCheck;
        $this->skipCustomTemplatesCapabilityCheck = true;
        try {
            return $callback();
        } finally {
            $this->skipCustomTemplatesCapabilityCheck = $previous;
        }
    }

    public function checkViewPermission($idSite)
    {
        $this->checkSiteExists($idSite);
        Piwik::checkUserHasViewAccess($idSite);
        $this->checkUserHasTagManagerAccess($idSite);
    }

    public function checkWriteCapability($idSite)
    {
        $this->checkSiteExists($idSite);
        Piwik::checkUserHasCapability($idSite, TagManagerWrite::ID);
        $this->checkUserHasTagManagerAccess($idSite);
    }

    public function checkPublishLiveEnvironmentCapability($idSite)
    {
        $this->checkSiteExists($idSite);
        Piwik::checkUserHasCapability($idSite, PublishLiveContainer::ID);
        $this->checkUserHasTagManagerAccess($idSite);
    }

    public function checkUseCustomTemplatesCapability($idSite)
    {
        if ($this->skipCustomTemplatesCapabilityCheck) {
            return;
        }

        $this->checkSiteExists($idSite);

        if ($this->settings->restrictCustomTemplates->getValue() === SystemSettings::CUSTOM_TEMPLATES_SUPERUSER) {
            Piwik::checkUserHasSuperUserAccess();
        } else {
            // no need to check for === disabled as it will be automatically checked because in this case we remove
            // disabled tags/triggers/...

            Piwik::checkUserHasCapability($idSite, UseCustomTemplates::ID);
        }
    }

    public function checkUserHasTagManagerAccess($idSite): void
    {
        // If the user has access, return before the exception is thrown
        if (StaticContainer::get(SystemSettings::class)->doesCurrentUserHaveTagManagerAccess(intval($idSite))) {
            return;
        }

        $minimumRole = StaticContainer::get(SystemSettings::class)->restrictTagManagerAccess->getValue();
        throw new NoAccessException(Piwik::translate('General_ExceptionPrivilegeAccessWebsite', ["'{$minimumRole}'", $idSite]));
    }

    public function hasUseCustomTemplatesCapability($idSite)
    {
        try {
            $this->checkUseCustomTemplatesCapability($idSite);
        } catch (\Exception $e) {
            return false;
        }
        return true;
    }

    public function hasPublishLiveEnvironmentCapability($idSite)
    {
        try {
            $this->checkPublishLiveEnvironmentCapability($idSite);
        } catch (\Exception $e) {
            return false;
        }
        return true;
    }

    public function hasWriteCapability($idSite)
    {
        try {
            $this->checkWriteCapability($idSite);
        } catch (\Exception $e) {
            return false;
        }
        return true;
    }

    public function checkSiteExists($idSite)
    {
        new Site($idSite);
    }

    public function checkWriteCapabilityForContainerVersion($idSite, $idContainer, $idContainerVersion)
    {
        if ($this->hasPublishLiveEnvironmentCapability($idSite)) {
            return;
        }

        $releases = $this->getContainerReleaseDao()->getReleasesForContainerVersion($idSite, $idContainer, $idContainerVersion);
        foreach ($releases as $release) {
            if ($release['environment'] === Environment::ENVIRONMENT_LIVE) {
                $this->checkPublishLiveEnvironmentCapability($idSite);
            }
        }
    }

    private function getContainerReleaseDao(): ContainerReleaseDao
    {
        if (!$this->containerReleaseDao) {
            $this->containerReleaseDao = StaticContainer::get(ContainerReleaseDao::class);
        }

        return $this->containerReleaseDao;
    }
}
