<?php

namespace Drupal\dds_editors\Access;

use Drupal\Core\Access\AccessResult;
use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
use Drupal\Core\Routing\RouteMatch;
use Drupal\Core\Routing\RouteMatchInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\user\Entity\User;
use Symfony\Component\DependencyInjection\ContainerInterface;

/**
 * Class DDSEditorAccessCheck
 * @package Drupal\dds_editors\Access
 */
class DDSEditorsAccessCheck implements ContainerInjectionInterface {

  /**
   * @var \Drupal\Core\Routing\RouteMatch
   */
  private $routeMatch;

  /**
   * DDSEditorsAccessCheck constructor.
   *
   * @param \Drupal\Core\Routing\RouteMatchInterface $routeMatch
   */
  public function __construct(RouteMatchInterface $routeMatch) {
    $this->routeMatch = $routeMatch;
  }

  public static function create(ContainerInterface $container) {
    return new static(
      $container->get('current_route_match')
    );
  }

  public function accessUserEdit(AccountInterface $account) {
    /** @var User $user */
    $user = $this->routeMatch->getParameter('user');

    // user will always be allowed to edit their own profile
    if($user->id() == $account->id()) {
//      return AccessResult::allowed();
    }

    // user will only be allowed to edit profile, if they are allowed to assign all of the users roles
    foreach ($user->getRoles(TRUE) as $role) {
      if(!$account->hasPermission('assign '.$role.' role')) {
        return AccessResult::forbidden();
      }
    }

    return AccessResult::allowed();
  }

}