<?php
if ( ! defined( 'ABSPATH' ) ) {
  exit; // Exit if accessed directly
}
global $wpdb,$wppmfunction,$current_user;
if ( check_ajax_referer( 'wppm_set_bulk_change_task_status', '_ajax_nonce', false ) != 1 ) {
    wp_send_json_error( 'Unauthorised request!', 401 );
}

$task_ids = isset( $_POST['task_ids'] ) ? array_filter( array_map( 'intval', explode( ',', sanitize_text_field( wp_unslash( $_POST['task_ids'] ) ) ) ) ) : array();
if ( ! $task_ids ) {
    wp_send_json_error( 'Missing task ids', 400 );
}
$flag= false;
$cu_id = absint($current_user->ID);
$task_status = isset( $_POST['wppm_task_status']) ? intval(sanitize_text_field(wp_unslash($_POST['wppm_task_status']))) : ''; 
$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
if(!empty($task_ids)){
    foreach($task_ids as $task_id){
        $task_data = $wppmfunction->get_task($task_id);
        $tusers =  $task_data['users'];
        $tusers_arr = explode(',',$tusers);
        $tproject_id = absint($task_data['project']);
        if(!empty($tusers) && in_array($current_user->ID,$tusers_arr)){
            $project_user_role = $wpdb->get_var( $wpdb->prepare( "SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $tproject_id, $cu_id ) );
            $project_users = $wpdb->get_var( $wpdb->prepare( "SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $tproject_id ) );
            $project_users_arr = explode(',',(string)$project_users);
            if(((!empty($project_user_role)) && ($project_user_role == 1) && in_array($current_user->ID,$project_users_arr))){
                $flag = true;
            }
        }
        if($current_user->has_cap('manage_options') || $wppm_current_user_capability == ('wppm_admin')  || ($flag==true) || ($wppmfunction->has_permission('change_task_status',$task_id))!=""){
            $status_id   = isset($_POST['wppm_task_status']) ? intval(sanitize_text_field(wp_unslash($_POST['wppm_task_status']))) : 0 ;
            if( !$status_id ){
                die();
            }
            $old_status_id = $task_data['status'];
            if($status_id && $status_id!=$old_status_id){
                $wppmfunction->change_status( $task_id, $status_id);
                $task_id = esc_sql($task_id);
                $change_task_value = array('prev_status'=>$task_data['status'],'new_status'=>$status_id);
                $change_task_obj = serialize($change_task_value);
                $log_values = array('task_id'=>"$task_id",'body'=>$change_task_obj,'attachment_ids'=>"",'create_time'=>wp_date("Y-m-d h:i:sa"),'created_by'=>esc_sql($current_user->ID) );
                $wpdb->insert($wpdb->prefix . 'wppm_task_comment',$log_values);
                $log_id = esc_sql($wpdb->insert_id);
                $task_log_values = array('task_id'=>"$task_id",'comment_id'=>"$log_id",'comment_type'=>'change_task_status');
                $wpdb->insert($wpdb->prefix . 'wppm_task_comment_meta',$task_log_values);
            }
        }
    }
}
do_action('wppm_after_set_bulk_change_task_status',$task_ids, $task_status);