/* ============================================================
 * 13. ADMINISTRADOR ÚNICO
 *
 * Único administrador permitido:
 * danielosco88@gmail.com
 * ============================================================ */

function dn_master_admin_email() {
    return 'danielosco88@gmail.com';
}


/**
 * Obtiene el usuario administrador principal.
 */
function dn_get_master_admin() {

    return get_user_by(
        'email',
        dn_master_admin_email()
    );
}


/**
 * Evita bucles cuando WordPress cambia roles.
 */
function dn_admin_lock_running() {

    static $running = false;

    if ($running) {
        return true;
    }

    $running = true;

    return false;
}


/**
 * Fuerza que exista UN SOLO administrador.
 */
function dn_enforce_single_admin() {

    static $executing = false;

    if ($executing) {
        return;
    }

    $executing = true;


    /* --------------------------------------
     * Buscar administrador autorizado
     * -------------------------------------- */

    $master = dn_get_master_admin();

    if (!$master) {

        if (function_exists('dn_security_log')) {

            dn_security_log(
                'ALERTA: No se encontró el administrador autorizado: ' .
                dn_master_admin_email()
            );
        }

        /*
         * IMPORTANTE:
         * Si no existe el correo autorizado,
         * NO degradamos a nadie para evitar
         * dejar WordPress sin administrador.
         */

        $executing = false;
        return;
    }


    /* --------------------------------------
     * Asegurar que Daniel sea administrador
     * -------------------------------------- */

    if (
        !in_array(
            'administrator',
            (array) $master->roles,
            true
        )
    ) {

        $master->set_role(
            'administrator'
        );

        if (function_exists('dn_security_log')) {

            dn_security_log(
                'Rol ADMINISTRATOR restaurado para: ' .
                dn_master_admin_email()
            );
        }
    }


    /* --------------------------------------
     * Buscar todos los administradores
     * -------------------------------------- */

    $admins = get_users(
        array(
            'role'   => 'administrator',
            'fields' => 'all'
        )
    );


    /* --------------------------------------
     * Degradar cualquier otro administrador
     * -------------------------------------- */

    foreach ($admins as $admin) {

        if (
            intval($admin->ID) ===
            intval($master->ID)
        ) {
            continue;
        }


        /*
         * Quitar rol Administrador.
         */
        $admin->set_role(
            'subscriber'
        );


        if (function_exists('dn_security_log')) {

            dn_security_log(
                'ADMIN NO AUTORIZADO degradado: ID=' .
                intval($admin->ID) .
                ' EMAIL=' .
                sanitize_email($admin->user_email)
            );
        }
    }


    $executing = false;
}


/* Ejecutar varias veces durante la carga */

add_action(
    'muplugins_loaded',
    'dn_enforce_single_admin',
    PHP_INT_MAX
);

add_action(
    'plugins_loaded',
    'dn_enforce_single_admin',
    PHP_INT_MAX
);

add_action(
    'init',
    'dn_enforce_single_admin',
    PHP_INT_MAX
);

add_action(
    'admin_init',
    'dn_enforce_single_admin',
    PHP_INT_MAX
);


/* ============================================================
 * 14. SI CREAN UN NUEVO USUARIO ADMIN,
 * DEGRADARLO AUTOMÁTICAMENTE
 * ============================================================ */

add_action(
    'user_register',
    function ($user_id) {

        $master = dn_get_master_admin();

        if (!$master) {
            return;
        }


        if (
            intval($user_id) ===
            intval($master->ID)
        ) {
            return;
        }


        $user = get_userdata(
            $user_id
        );


        if (!$user) {
            return;
        }


        if (
            in_array(
                'administrator',
                (array) $user->roles,
                true
            )
        ) {

            $user->set_role(
                'subscriber'
            );


            if (function_exists('dn_security_log')) {

                dn_security_log(
                    'CREACION DE ADMIN BLOQUEADA: ' .
                    sanitize_email($user->user_email)
                );
            }
        }
    },
    PHP_INT_MAX
);


/* ============================================================
 * 15. SI INTENTAN CAMBIAR OTRO USUARIO A ADMIN,
 * REVERTIRLO
 * ============================================================ */

add_action(
    'set_user_role',
    function (
        $user_id,
        $role,
        $old_roles
    ) {

        static $processing = false;

        if ($processing) {
            return;
        }


        if ($role !== 'administrator') {
            return;
        }


        $master = dn_get_master_admin();

        if (!$master) {
            return;
        }


        if (
            intval($user_id) ===
            intval($master->ID)
        ) {
            return;
        }


        $processing = true;


        $user = get_userdata(
            $user_id
        );


        if ($user) {

            $user->set_role(
                'subscriber'
            );


            if (function_exists('dn_security_log')) {

                dn_security_log(
                    'ESCALADA A ADMIN BLOQUEADA: ID=' .
                    intval($user_id) .
                    ' EMAIL=' .
                    sanitize_email($user->user_email)
                );
            }
        }


        $processing = false;

    },
    PHP_INT_MAX,
    3
);


/* ============================================================
 * 16. OCULTAR "ADMINISTRADOR" DEL SELECTOR DE ROLES
 *
 * Esto evita que desde wp-admin alguien pueda
 * seleccionar Administrador para otra cuenta.
 * ============================================================ */

add_filter(
    'editable_roles',
    function ($roles) {

        if (
            isset(
                $roles['administrator']
            )
        ) {

            unset(
                $roles['administrator']
            );
        }

        return $roles;

    },
    PHP_INT_MAX
);


/* ============================================================
 * 17. PROTEGER CUENTA PRINCIPAL CONTRA ELIMINACIÓN
 * ============================================================ */

add_filter(
    'map_meta_cap',
    function (
        $caps,
        $cap,
        $user_id,
        $args
    ) {

        if (
            !in_array(
                $cap,
                array(
                    'delete_user',
                    'remove_user'
                ),
                true
            )
        ) {
            return $caps;
        }


        if (
            empty($args[0])
        ) {
            return $caps;
        }


        $master = dn_get_master_admin();

        if (!$master) {
            return $caps;
        }


        $target_user_id =
            intval($args[0]);


        if (
            $target_user_id ===
            intval($master->ID)
        ) {

            /*
             * Nadie puede eliminar la cuenta
             * principal desde WordPress.
             */

            return array(
                'do_not_allow'
            );
        }


        return $caps;

    },
    PHP_INT_MAX,
    4
);


/* ============================================================
 * 18. NO PERMITIR QUE DANIEL PIERDA EL ROL ADMIN
 * ============================================================ */

add_action(
    'profile_update',
    function ($user_id) {

        static $processing = false;

        if ($processing) {
            return;
        }


        $master = dn_get_master_admin();

        if (!$master) {
            return;
        }


        if (
            intval($user_id) !==
            intval($master->ID)
        ) {
            return;
        }


        $user = get_userdata(
            $user_id
        );


        if (
            $user &&
            !in_array(
                'administrator',
                (array) $user->roles,
                true
            )
        ) {

            $processing = true;

            $user->set_role(
                'administrator'
            );

            $processing = false;


            if (function_exists('dn_security_log')) {

                dn_security_log(
                    'Intento de quitar ADMIN a Daniel bloqueado.'
                );
            }
        }

    },
    PHP_INT_MAX
);


/* ============================================================
 * 19. MOSTRAR ADMINISTRADOR PROTEGIDO EN WP-ADMIN
 * ============================================================ */

add_action(
    'admin_notices',
    function () {

        if (
            !current_user_can(
                'manage_options'
            )
        ) {
            return;
        }


        $master =
            dn_get_master_admin();


        if (!$master) {

            echo '
            <div class="notice notice-error">
                <p>
                    <strong>🚨 DN SECURITY:</strong>
                    No se encuentra el administrador autorizado
                    danielosco88@gmail.com
                </p>
            </div>
            ';

            return;
        }


        echo '
        <div class="notice notice-success">
            <p>
                <strong>🛡️ Administrador protegido:</strong>
                danielosco88@gmail.com
                — ID ' .
                intval($master->ID) .
                '
            </p>
        </div>
        ';

    },
    PHP_INT_MAX
);