<?php
/**
 * AP Family Archive - privacy gate.
 *
 * SINGLE evaluation point for what this plugin may render (spec-00 Section 7,
 * the core privacy floor). Every public-facing query and template goes
 * through this class; nothing renders a living or private person unless the
 * viewer is privileged. The gate FAILS CLOSED: unknown rows are treated as
 * private.
 *
 * The floor, as this plugin applies it:
 *  - living = 1: never rendered to unprivileged viewers - no name, no dates,
 *    no places, no events, no link. In family/child listings the row appears
 *    only as a neutral "Living" placeholder (existence without identity, the
 *    TNG convention); in indexes and search it is excluded entirely.
 *  - private = 1: same treatment, for authenticated non-privileged viewers too.
 *  - Privileged = the apfaar_view_private_cap capability (default manage_options,
 *    deliberately strict until AP Access refines tiers).
 *
 * @package    APFAAR_Family_Archive
 * @subpackage APFAAR_Family_Archive/includes
 * @since      0.1.0
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Privacy floor evaluation.
 *
 * @since 0.1.0
 */
class APFAAR_Privacy {

	/**
	 * Whether the current viewer may see living/private people.
	 *
	 * @return bool
	 */
	public static function viewer_is_privileged() {
		/**
		 * Capability required to view living/private people on the front end.
		 *
		 * Default is deliberately strict (manage_options). AP Access will
		 * refine viewer tiers later; the floor stays enforced here regardless.
		 *
		 * @since 0.1.0
		 * @param string $cap Capability name.
		 */
		$cap = apply_filters( 'apfaar_view_private_cap', 'manage_options' );
		return is_user_logged_in() && current_user_can( $cap );
	}

	/**
	 * May the current viewer see this person/family row in full?
	 *
	 * Fails closed: a null/malformed row is never viewable.
	 *
	 * @param  object|null $row Core row with living/private properties.
	 * @return bool
	 */
	public static function can_view( $row ) {
		if ( ! is_object( $row ) ) {
			return false;
		}
		if ( empty( $row->living ) && empty( $row->private ) ) {
			return true;
		}
		return self::viewer_is_privileged();
	}

	/**
	 * The neutral placeholder label for a row the viewer may not see.
	 *
	 * @param  object|null $row Core row (private=1 reads "Private", else "Living").
	 * @return string
	 */
	public static function placeholder_label( $row = null ) {
		if ( is_object( $row ) && ! empty( $row->private ) ) {
			return __( 'Private', 'ap-family-archive' );
		}
		return __( 'Living', 'ap-family-archive' );
	}
}
