<?php
/**
 * Plugin Name: Bloxby Access Levels
 * Description: Restrict installation and activation of unsafe and non compatible plugins.
 * Author: Bloxby
 * Author URI: https://bloxby.io/
 * Version: 1.0
 * Network: true
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit; // Exit if accessed directly
}

/**
 * List of restricted plugins (folder/plugin.php format).
 */
function bloxby_restricted_plugins_list() {
    return array(
        // Theme Builders
        'elementor/elementor.php',
        'beaver-builder-lite-version/fl-builder.php',
        'siteorigin-panels/siteorigin-panels.php',
        'divi-builder/divi-builder.php',
        'wpbakery/js_composer.php',
        'brizy/brizy.php',
        'oxygen/functions.php',
        'nicepage/nicepage.php',
        'seedprod-coming-soon-pro/seedprod-coming-soon-pro.php',
        'themify-builder/themify-builder.php',

        // File Managers
        'wp-file-manager/file_folder_manager.php',
        'file-manager/file_manager.php',
        'advanced-file-manager/advanced-file-manager.php',
        'filebird/filebird.php',
        'real-media-library/index.php',
        'filester/filester.php',
        'elfinder/elfinder.php',
        'xplorer/xplorer.php',

        // Backup / Migration
        'updraftplus/updraftplus.php',
        'duplicator/duplicator.php',
        'all-in-one-wp-migration/all-in-one-wp-migration.php',
        'backupbuddy/backupbuddy.php',
        'wpvivid-backuprestore/wpvivid-backuprestore.php',
        'jetpack-backup/jetpack-backup.php',
        'backwpup/backwpup.php',
        'total-upkeep/boldgrid-backup.php',
        'super-backup/super-backup.php',
        'snapshot/snapshot.php',
    );
}

/**
 * Prevent activation of restricted plugins.
 */
function bloxby_restrict_plugin_activation() {
    $restricted_plugins = bloxby_restricted_plugins_list();
    $active_plugins     = get_option( 'active_plugins', array() );

    foreach ( $active_plugins as $plugin ) {
        if ( in_array( $plugin, $restricted_plugins, true ) ) {
            deactivate_plugins( $plugin );
            wp_die( sprintf(
                'Installation of the plugin <strong>%s</strong> is restricted and has been deactivated.',
                esc_html( $plugin )
            ) );
        }
    }

    if ( isset( $_GET['plugin'] ) && in_array( $_GET['plugin'], $restricted_plugins, true ) ) {
        wp_die( 'You are not allowed to activate this plugin.' );
    }
}
add_action( 'admin_init', 'bloxby_restrict_plugin_activation' );

/**
 * Prevent installation of restricted plugins (from repo or upload).
 */
function bloxby_restrict_plugin_install( $reply, $package, $upgrader ) {
    $restricted_plugins = bloxby_restricted_plugins_list();

    foreach ( $restricted_plugins as $plugin ) {
        $slug = dirname( $plugin ); // e.g. "elementor"
        if ( strpos( $package, $slug ) !== false ) {
            return new WP_Error(
                'plugin_restricted',
                sprintf(
                    'Installation of this plugin is restricted.',
                    esc_html( $slug )
                )
            );
        }
    }

    return $reply;
}
add_filter( 'upgrader_pre_download', 'bloxby_restrict_plugin_install', 10, 3 );

/**
 * Custom WP Role: bloxby-user
 * */
function bloxby_add_custom_role() {
    // Remove if exists (to refresh caps on plugin update)
    remove_role( 'bloxby-user' );

    // Copy Administrator capabilities
    $admin_role = get_role( 'administrator' );
    if ( ! $admin_role ) {
        return;
    }

    $caps = $admin_role->capabilities;

    // Remove unwanted capabilities
    unset( $caps['edit_themes'] );
    unset( $caps['edit_plugins'] ); // disables plugin editor only
    unset( $caps['install_themes'] );
    unset( $caps['switch_themes'] );

    // Keep plugin installation but not themes
    $caps['install_plugins'] = true;
    $caps['activate_plugins'] = true;

    // Add new role
    add_role(
        'bloxby-user',
        'Bloxby User',
        $caps
    );
}
register_activation_hook( __FILE__, 'bloxby_add_custom_role' );

// For MU-plugin (no activation hook), ensure role exists on load
add_action( 'init', function() {
    if ( ! get_role( 'bloxby-user' ) ) {
        bloxby_add_custom_role();
    }
});


/**
 * Remove higher roles from the role dropdown for bloxby-user.
 */
function bloxby_filter_editable_roles( $roles ) {
    if ( current_user_can( 'bloxby-user' ) || current_user_can( 'bloxby_user' ) ) {
        // Roles to block assigning
        unset( $roles['administrator'] );
    }
    return $roles;
}
add_filter( 'editable_roles', 'bloxby_filter_editable_roles' );


/**
 * Prevent role escalation on user creation/update.
 */
function bloxby_prevent_role_escalation( $caps, $cap, $user_id, $args ) {
    if ( in_array( $cap, array( 'create_users', 'edit_user', 'promote_user' ), true ) ) {
        $current_user = wp_get_current_user();
        if ( in_array( 'bloxby-user', $current_user->roles, true ) ) {
            if ( ! empty( $args[0] ) && isset( $args[1] ) ) {
                $new_role = $args[1];
                if ( in_array( $new_role, array( 'administrator' ), true ) ) {
                    $caps[] = 'do_not_allow';
                }
            }
        }
    }
    return $caps;
}
add_filter( 'map_meta_cap', 'bloxby_prevent_role_escalation', 10, 4 );