| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentSupport\App\Modules\MCP\Support; |
| 4 |
|
| 5 |
use FluentSupport\App\Modules\PermissionManager; |
| 6 |
use FluentSupport\App\Services\Helper; |
| 7 |
|
| 8 |
/** |
| 9 |
* MCP on/off state and the transport gate. Permissions reuse PermissionManager, |
| 10 |
* the same fst_* checks the admin REST routes use. Per-ability checks run on top. |
| 11 |
*/ |
| 12 |
class PermissionGate |
| 13 |
{ |
| 14 |
const OPTION_KEY = '_mcp_settings'; |
| 15 |
|
| 16 |
/** |
| 17 |
* Runs on every MCP request: MCP must be on and the user must have ticket access. |
| 18 |
* |
| 19 |
* @param mixed $request |
| 20 |
* @return true|\WP_Error |
| 21 |
*/ |
| 22 |
public static function transport($request = null) |
| 23 |
{ |
| 24 |
if (!self::isEnabled()) { |
| 25 |
return new \WP_Error( |
| 26 |
'fluent_support_mcp_disabled', |
| 27 |
__('Fluent Support MCP is disabled. Enable it in Settings → MCP.', 'fluent-support') |
| 28 |
); |
| 29 |
} |
| 30 |
|
| 31 |
// canAccessTicketRoutes() covers this too, but a separate code tells the |
| 32 |
// agent "not logged in" apart from "no Fluent Support access". |
| 33 |
if (!is_user_logged_in()) { |
| 34 |
return new \WP_Error( |
| 35 |
'fluent_support_mcp_unauthorized', |
| 36 |
__('Authentication required to access the Fluent Support MCP server.', 'fluent-support') |
| 37 |
); |
| 38 |
} |
| 39 |
|
| 40 |
// Same check AgentTicketPolicy uses for ticket routes. |
| 41 |
if (!PermissionManager::canAccessTicketRoutes()) { |
| 42 |
return new \WP_Error( |
| 43 |
'fluent_support_mcp_forbidden', |
| 44 |
__('Your account does not have Fluent Support access.', 'fluent-support') |
| 45 |
); |
| 46 |
} |
| 47 |
|
| 48 |
return true; |
| 49 |
} |
| 50 |
|
| 51 |
/** |
| 52 |
* Off by default. |
| 53 |
*/ |
| 54 |
public static function isEnabled() |
| 55 |
{ |
| 56 |
$settings = Helper::getOption(self::OPTION_KEY, []); |
| 57 |
|
| 58 |
return is_array($settings) && isset($settings['active']) && $settings['active'] === 'yes'; |
| 59 |
} |
| 60 |
|
| 61 |
/** |
| 62 |
* Re-checks manage_options because the FluentHub toggle path leaves auth to |
| 63 |
* another plugin. |
| 64 |
* |
| 65 |
* @param bool $enabled |
| 66 |
* @return bool |
| 67 |
*/ |
| 68 |
public static function setEnabled($enabled) |
| 69 |
{ |
| 70 |
if (!current_user_can('manage_options')) { |
| 71 |
return false; |
| 72 |
} |
| 73 |
|
| 74 |
$settings = Helper::getOption(self::OPTION_KEY, []); |
| 75 |
if (!is_array($settings)) { |
| 76 |
$settings = []; |
| 77 |
} |
| 78 |
|
| 79 |
$settings['active'] = $enabled ? 'yes' : 'no'; |
| 80 |
Helper::updateOption(self::OPTION_KEY, $settings); |
| 81 |
|
| 82 |
return (bool) $enabled; |
| 83 |
} |
| 84 |
|
| 85 |
/** |
| 86 |
* SLA thresholds used by getSupportContext and getSupportInsights. |
| 87 |
* |
| 88 |
* @return array{first_response_hours: int, resolution_hours: int} |
| 89 |
*/ |
| 90 |
public static function getSlaSettings() |
| 91 |
{ |
| 92 |
$settings = Helper::getOption(self::OPTION_KEY, []); |
| 93 |
$sla = isset($settings['sla']) && is_array($settings['sla']) ? $settings['sla'] : []; |
| 94 |
|
| 95 |
return [ |
| 96 |
'first_response_hours' => min(max((int) ($sla['first_response_hours'] ?? 4), 1), 720), |
| 97 |
'resolution_hours' => min(max((int) ($sla['resolution_hours'] ?? 24), 1), 8760), |
| 98 |
]; |
| 99 |
} |
| 100 |
|
| 101 |
/** |
| 102 |
* AI guidelines for getSupportContext. Sanitized on read, since older |
| 103 |
* values may have been stored raw. |
| 104 |
* |
| 105 |
* @return string Up to 2000 characters, no HTML. |
| 106 |
*/ |
| 107 |
public static function getAiGuidelines() |
| 108 |
{ |
| 109 |
$settings = Helper::getOption(self::OPTION_KEY, []); |
| 110 |
$raw = isset($settings['ai_guidelines']) ? (string) $settings['ai_guidelines'] : ''; |
| 111 |
|
| 112 |
return mb_substr(wp_strip_all_tags($raw), 0, 2000); |
| 113 |
} |
| 114 |
} |
| 115 |
|
