wordpress-theme-aksrt/inc/classes/admin/class-aksrt-admin-permissions-controller.php

<?php
/**
 * AKSRT Admin — Permissions Controller
 *
 * Owns REST routes for the "功能&权限" domain:
 * Captcha, moderation, user permissions.
 *
 * Previously these routes were registered under the User Controller.
 * This controller provides proper domain separation.
 *
 * @package AKSRT
 */

defined('ABSPATH') || exit;

class AKSRT_Admin_Permissions_Controller extends AKSRT_Admin_Controller_Base {

    private static $instance = null;

    public static function get_instance(): self {
        if (null === self::$instance) self::$instance = new self();
        return self::$instance;
    }

    public function register_routes(): void {
        // Capability matrix
        register_rest_route(self::API_NAMESPACE, '/permissions/capabilities', [
            'methods'             => 'GET',
            'callback'            => [$this, 'get_capabilities'],
            'permission_callback' => [$this, 'check_permission'],
        ]);

        register_rest_route(self::API_NAMESPACE, '/permissions/capabilities', [
            'methods'             => 'POST',
            'callback'            => [$this, 'save_capabilities'],
            'permission_callback' => [$this, 'check_permission'],
        ]);
    }

    public function get_capabilities(): WP_REST_Response {
        if (!class_exists('AKSRT_Settings')) {
            return $this->error(__('能力矩阵模块不可用', 'aksrt'), 500);
        }

        $caps    = AKSRT_Settings::get_user_capabilities();
        $defs    = AKSRT_Settings::cap_definitions();
        $columns = AKSRT_Settings::cap_role_columns();

        return $this->success([
            'data' => [
                'columns' => $this->get_capability_column_labels(),
                'groups'  => $this->build_capability_groups($defs, $caps, $columns),
                'summary' => [
                    'cap_count'    => count($defs),
                    'group_count'  => 3,
                    'column_count' => count($columns),
                ],
            ],
        ]);
    }

    public function save_capabilities(WP_REST_Request $request): WP_REST_Response {
        if (!class_exists('AKSRT_Settings')) {
            return $this->error(__('能力矩阵模块不可用', 'aksrt'), 500);
        }

        $params = $this->get_json_params($request);
        $input  = $params['user_caps'] ?? null;

        if (!is_array($input)) {
            return $this->error(__('无效的能力矩阵数据', 'aksrt'), 422);
        }

        $defs    = AKSRT_Settings::cap_definitions();
        $columns = AKSRT_Settings::cap_role_columns();
        $clean   = [];

        foreach ($defs as $cap_id => $def) {
            $row = is_array($input[$cap_id] ?? null) ? $input[$cap_id] : [];
            $clean[$cap_id] = [];

            foreach ($columns as $column) {
                if (in_array($column, ['level', 'vip'], true)) {
                    $value = isset($row[$column]) ? (int) $row[$column] : -1;
                    $max   = $column === 'level' ? 10 : 2;
                    $clean[$cap_id][$column] = max(-1, min($max, $value));
                } else {
                    $clean[$cap_id][$column] = !empty($row[$column]);
                }
            }
        }

        $all = AKSRT_Settings::get_all();
        $all['user_caps'] = $clean;
        update_option('aksrt_settings', $all);
        AKSRT_Settings::flush_settings_cache();

        return $this->success([
            'message' => __('能力矩阵已保存', 'aksrt'),
            'data'    => [
                'user_caps' => $clean,
            ],
        ]);
    }

    private function build_capability_groups(array $defs, array $caps, array $columns): array {
        $buckets = [
            'user' => [
                'key'   => 'user',
                'title' => __('用户治理', 'aksrt'),
                'items' => [],
            ],
            'post' => [
                'key'   => 'post',
                'title' => __('投稿权限', 'aksrt'),
                'items' => [],
            ],
            'comment' => [
                'key'   => 'comment',
                'title' => __('评论权限', 'aksrt'),
                'items' => [],
            ],
        ];

        foreach ($defs as $cap_id => $def) {
            $bucket_key = 'user';
            if (str_starts_with($cap_id, 'comment_')) {
                $bucket_key = 'comment';
            } elseif (str_starts_with($cap_id, 'new_post_')) {
                $bucket_key = 'post';
            }

            $excludes   = $def['exclude_roles'] ?? [];
            $only_roles = $def['roles'] ?? null;
            $values     = $caps[$cap_id] ?? [];

            $visible_columns = [];
            foreach ($columns as $column) {
                if (in_array($column, $excludes, true)) {
                    continue;
                }
                if ($only_roles !== null && !in_array($column, $only_roles, true) && !in_array($column, ['all', 'logged', 'level', 'vip', 'auth'], true)) {
                    continue;
                }
                $visible_columns[] = $column;
            }

            $buckets[$bucket_key]['items'][] = [
                'cap_id'          => $cap_id,
                'label'           => $def['label'],
                'visible_columns' => $visible_columns,
                'values'          => $values,
            ];
        }

        return array_values($buckets);
    }

    private function get_capability_column_labels(): array {
        return [
            'all'           => __('所有人', 'aksrt'),
            'logged'        => __('已登录', 'aksrt'),
            'level'         => __('等级≥', 'aksrt'),
            'vip'           => __('VIP≥', 'aksrt'),
            'auth'          => __('已认证', 'aksrt'),
            'moderator'     => __('版主', 'aksrt'),
            'plate_author'  => __('超级版主', 'aksrt'),
            'cat_moderator' => __('分区版主', 'aksrt'),
        ];
    }
}