<?php
// Rescue for "Sorry, you are not allowed to access this page." on
// PaintOps admin pages (2026-07-24). The licensing SDK registers its
// pricing and account pages only in SOME license states, so an Upgrade
// link rendered in one state can dead-end on WordPress's permission
// error in another. The biggest hot spot is re-activation: a Pro build
// waiting for its license key shows the free-tier cap banner, and that
// banner's Upgrade button used to land on this error.
//
// Instead of routing every button per state (which repeatedly broke the
// premium build generator when attempted in the main file), this hooks
// core's admin_page_access_denied action, which fires just before
// WordPress prints the error, and sends the user to the main PaintOps
// admin page instead. That page always exists, and whenever the SDK
// wants a license entered it shows its license screen right there, so
// the unlicensed-Pro user lands exactly where they can fix things.

// phpcs:disable WordPress.Security.NonceVerification.Recommended -- read-only GET routing: this file only READS which admin page was requested to decide where to send the user; nothing is written or changed.

if (!defined('ABSPATH')) {
    exit;
}

function paintops_admin_access_denied_rescue(): void {
    $paintops_denied_page = isset($_GET['page']) ? sanitize_key(wp_unslash($_GET['page'])) : '';
    if (strpos($paintops_denied_page, 'paintops') !== 0) {
        return; // some other plugin's page, none of our business
    }
    if (!current_user_can('manage_options')) {
        return; // non-admins are legitimately denied, keep the default error
    }
    // Pro build without an active license: the reliable license entry
    // point in EVERY state is the Activate License link the SDK puts on
    // the Plugins page row (the admin.php?page=paintops route only shows
    // the license screen in some states and otherwise continues to the
    // app, which stranded Mike on 2026-07-24). Licensed or free: the
    // main PaintOps page is the right landing.
    if (function_exists('paintops_pro_code_present')
        && function_exists('paintops_pro_active') && !paintops_pro_active()) {
        wp_safe_redirect(admin_url('plugins.php'));
        exit;
    }
    wp_safe_redirect(admin_url('admin.php?page=paintops'));
    exit;
}
add_action('admin_page_access_denied', 'paintops_admin_access_denied_rescue');

/**
 * On a PRO build that is waiting for its license key, the free-tier cap
 * banners and teasers still say "Upgrade to Pro", but the honest action
 * in that state is reactivating the license (Mike 2026-07-24). Detect
 * the state WITHOUT any licensing-SDK calls (the deployment processor
 * has failed on those names): a premium-only FUNCTION existing proves
 * this is the Pro build (the free build ships with it stripped), and
 * paintops_is_pro() false proves no active license. In that state a tiny
 * footer script relabels the upgrade buttons and points them at the
 * PaintOps admin page, where the license screen is showing.
 */
function paintops_relabel_upgrade_buttons_for_reactivation(): void {
    if (!function_exists('paintops_pro_code_present')) {
        return; // free build: nothing to relabel, no upgrade buttons render
    }
    if (function_exists('paintops_pro_active') && paintops_pro_active()) {
        return; // licensed: the upgrade buttons are not rendered anyway
    }
    $paintops_license_page = admin_url('plugins.php');
    // This runs on wp_footer/admin_footer at the default priority (10),
    // which is still before the footer scripts print (priority 20 /
    // admin_print_footer_scripts), so enqueueing here is safe. The static
    // relabel logic lives in assets/js/upgrade-reactivate-relabel.js; only
    // the target URL is passed as config.
    paintops_enqueue_script(
        'upgrade-reactivate-relabel',
        'var paintopsReactivateCfg = ' . wp_json_encode(['url' => $paintops_license_page]) . ';'
    );
}
add_action('wp_footer', 'paintops_relabel_upgrade_buttons_for_reactivation');
add_action('admin_footer', 'paintops_relabel_upgrade_buttons_for_reactivation');
