Content Control

Signed-off-by: Jeff <jeff@gotenzing.com>

+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M21.8611 8.50354L19.7251 10.6395C20.1421 11.16 20.4841 11.6355 20.7286 12C19.5886 13.695 16.4536 17.73 12.3871 17.9775L9.66455 20.7C10.4086 20.886 11.1856 21 12.0001 21C19.0606 21 23.6161 13.074 23.8066 12.738C24.0631 12.282 24.0646 11.724 23.8081 11.268C23.7376 11.1405 23.0581 9.94654 21.8611 8.50354Z" fill="red"/>
+<path d="M0.439696 23.5606C0.732196 23.8531 1.1162 24.0001 1.5002 24.0001C1.8842 24.0001 2.2682 23.8531 2.5607 23.5606L23.5607 2.56063C24.1472 1.97413 24.1472 1.02613 23.5607 0.439631C22.9742 -0.146869 22.0262 -0.146869 21.4397 0.439631L17.3222 4.55713C15.7727 3.64663 13.9967 3.00013 12.0002 3.00013C4.8677 3.00013 0.376696 10.9336 0.189196 11.2711C-0.0643035 11.7256 -0.0628035 12.2791 0.192196 12.7336C0.297196 12.9211 1.7582 15.4366 4.2317 17.6476L0.438196 21.4411C-0.146804 22.0261 -0.146804 22.9741 0.439696 23.5606ZM3.2717 11.9986C4.4372 10.2526 7.7192 6.00013 12.0002 6.00013C13.1132 6.00013 14.1557 6.30163 15.1172 6.76213L12.7682 9.11113C12.5222 9.04363 12.2672 9.00013 12.0002 9.00013C10.3427 9.00013 9.0002 10.3426 9.0002 12.0001C9.0002 12.2671 9.0437 12.5221 9.1112 12.7681L6.3602 15.5191C4.9277 14.2651 3.8387 12.8431 3.2717 11.9986Z" fill="red"/>
+</svg>

+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="26" height="26" viewBox="0 0 26 26" fill="none">
+  <path d="M13 2C6.92487 2 2 6.92487 2 13C2 15.249 2.67495 17.3404 3.83333 19.0826M20.3333 4.80094C22.5837 6.81512 24 9.74217 24 13C24 19.0751 19.0751 24 13 24C11.7143 24 10.4802 23.7794 9.33333 23.3741M13 9.33333V16.6667" stroke="#007CBA" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"></path>
+</svg>

+<?php
+/**
+ * Plugin container.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Base;
+
+defined( 'ABSPATH' ) || exit;
+
+use ContentControl\Vendor\Pimple\Container as Base;
+
+/**
+ * Localized container class.
+ */
+class Container extends Base {
+	/**
+	 * Get item from container
+	 *
+	 * @param string $id Key for the item.
+	 *
+	 * @return mixed Current value of the item.
+	 */
+	public function get( $id ) {
+		return $this->offsetGet( $id );
+	}
+
+	/**
+	 * Set item in container
+	 *
+	 * @param string $id Key for the item.
+	 * @param mixed  $value Value to be set.
+	 *
+	 * @return void
+	 */
+	public function set( $id, $value ) {
+		$this->offsetSet( $id, $value );
+	}
+}

+<?php
+/**
+ * Plugin controller.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Base;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Localized container class.
+ */
+abstract class Controller implements \ContentControl\Interfaces\Controller {
+
+	/**
+	 * Plugin Container.
+	 *
+	 * @var \ContentControl\Plugin\Core
+	 */
+	public $container;
+
+	/**
+	 * Initialize based on dependency injection principles.
+	 *
+	 * @param \ContentControl\Plugin\Core $container Plugin container.
+	 * @return void
+	 */
+	public function __construct( $container ) {
+		$this->container = $container;
+	}
+
+	/**
+	 * Check if controller is enabled.
+	 *
+	 * @return bool
+	 */
+	public function controller_enabled() {
+		return true;
+	}
+}

+<?php
+/**
+ * Plugin controller.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Base;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * HTTP Stream class.
+ */
+class Stream {
+
+	/**
+	 * Stream name.
+	 *
+	 * @var string
+	 */
+	protected $stream_name;
+
+	/**
+	 * Version.
+	 *
+	 * @var string
+	 */
+	const VERSION = '1.0.0';
+
+	/**
+	 * Stream constructor.
+	 *
+	 * @param string $stream_name Stream name.
+	 */
+	public function __construct( $stream_name = 'stream' ) {
+		$this->stream_name = $stream_name;
+	}
+
+	/**
+	 * Start SSE stream.
+	 *
+	 * @return void
+	 */
+	public function start() {
+		if ( headers_sent() ) {
+			// Do not start the stream if headers have already been sent.
+			return;
+		}
+
+		// Disable default disconnect checks.
+		ignore_user_abort( true );
+
+		// phpcs:disable WordPress.PHP.IniSet.Risky, WordPress.PHP.NoSilencedErrors.Discouraged
+		@ini_set( 'zlib.output_compression', '0' );
+		@ini_set( 'implicit_flush', '1' );
+		@ini_set( 'log_limit', '8096' );
+
+		@ob_end_clean();
+		set_time_limit( 0 );
+		// phpcs:enable WordPress.PHP.IniSet.Risky, WordPress.PHP.NoSilencedErrors.Discouraged
+
+		$this->send_headers();
+	}
+
+	/**
+	 * Send SSE headers.
+	 *
+	 * @return void
+	 */
+	public function send_headers() {
+		header( 'Content-Type: text/event-stream' );
+		header( 'Stream-Name: ' . $this->stream_name );
+		header( 'Cache-Control: no-cache' );
+		header( 'Connection: keep-alive' );
+		// Nginx: unbuffered responses suitable for Comet and HTTP streaming applications.
+		header( 'X-Accel-Buffering: no' );
+		$this->flush_buffers();
+	}
+
+	/**
+	 * Flush buffers.
+	 *
+	 * Uses a micro delay to prevent the stream from flushing too quickly.
+	 *
+	 * @return void
+	 */
+	protected function flush_buffers() {
+		// This is for the buffer achieve the minimum size in order to flush data.
+
+		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+		echo str_repeat( ' ', 1024 * 8 ) . PHP_EOL;
+
+		flush(); // Unless both are called. Some browsers will still cache.
+
+		// Neccessary to prevent the stream from flushing too quickly.
+		usleep( 1000 );
+	}
+
+	/**
+	 * Send general message/data to the client.
+	 *
+	 * @param mixed $data Data to send.
+	 *
+	 * @return void
+	 */
+	public function send_data( $data ) {
+		$data = is_string( $data ) ? $data : \wp_json_encode( $data );
+
+		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+		echo "data: {$data}" . PHP_EOL;
+		echo PHP_EOL;
+
+		$this->flush_buffers();
+	}
+
+	/**
+	 * Send an event to the client.
+	 *
+	 * @param string $event Event name.
+	 * @param mixed  $data Data to send.
+	 *
+	 * @return void
+	 */
+	public function send_event( $event, $data = '' ) {
+		$data = is_string( $data ) ? $data : \wp_json_encode( $data );
+
+		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+		echo "event: {$event}" . PHP_EOL;
+		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+		echo "data: {$data}" . PHP_EOL;
+		echo PHP_EOL;
+
+		$this->flush_buffers();
+	}
+
+	/**
+	 * Send an error to the client.
+	 *
+	 * @param array{message:string}|string $error Error message.
+	 *
+	 * @return void
+	 */
+	public function send_error( $error ) {
+		$this->send_event( 'error', $error );
+	}
+
+	/**
+	 * Check if the connection should abort.
+	 *
+	 * @return bool
+	 */
+	public function should_abort() {
+		return (bool) connection_aborted();
+	}
+}

+<?php
+/**
+ * Plugin controller.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Base;
+
+defined( 'ABSPATH' ) || exit;
+
+use Closure;
+use stdClass;
+
+/**
+ * Base Upgrade class.
+ */
+abstract class Upgrade implements \ContentControl\Interfaces\Upgrade {
+
+	/**
+	 * Type.
+	 *
+	 * @var string Uses data versioning types.
+	 */
+	const TYPE = '';
+
+	/**
+	 * Version.
+	 *
+	 * @var int
+	 */
+	const VERSION = 1;
+
+	/**
+	 * Stream.
+	 *
+	 * @var \ContentControl\Services\UpgradeStream|null
+	 */
+	public $stream;
+
+	/**
+	 * Upgrade constructor.
+	 */
+	public function __construct() {
+	}
+
+	/**
+	 * Upgrade label
+	 *
+	 * @return string
+	 */
+	abstract public function label();
+
+	/**
+	 * Return full description for this upgrade.
+	 *
+	 * @return string
+	 */
+	public function description() {
+		return '';
+	}
+
+	/**
+	 * Check if the upgrade is required.
+	 *
+	 * @return bool
+	 */
+	public function is_required() {
+		$current_version = \ContentControl\get_data_version( static::TYPE );
+		return $current_version && $current_version < static::VERSION;
+	}
+
+	/**
+	 * Get the type of upgrade.
+	 *
+	 * @return string
+	 */
+	public function get_type() {
+		return static::TYPE;
+	}
+
+	/**
+	 * Check if the prerequisites are met.
+	 *
+	 * @return bool
+	 */
+	public function prerequisites_met() {
+		return true;
+	}
+
+	/**
+	 * Get the dependencies for this upgrade.
+	 *
+	 * @return string[]
+	 */
+	public function get_dependencies() {
+		return [];
+	}
+
+	/**
+	 * Run the upgrade.
+	 *
+	 * @return void|\WP_Error|false
+	 */
+	abstract public function run();
+
+	/**
+	 * Run the upgrade.
+	 *
+	 * @param \ContentControl\Services\UpgradeStream $stream Stream.
+	 *
+	 * @return bool|\WP_Error
+	 */
+	public function stream_run( $stream ) {
+		$this->stream = $stream;
+
+		$return = $this->run();
+
+		unset( $this->stream );
+
+		if ( is_bool( $return ) || is_wp_error( $return ) ) {
+			return $return;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Return the stream.
+	 *
+	 * If no stream is available it returns a mock object with no-op methods to prevent errors.
+	 *
+	 * @return \ContentControl\Services\UpgradeStream|(object{
+	 *      send_event: Closure,
+	 *      send_error: Closure,
+	 *      send_data: Closure,
+	 *      update_status: Closure,
+	 *      update_task_status: Closure,
+	 *      start_upgrades: Closure,
+	 *      complete_upgrades: Closure,
+	 *      start_task: Closure,
+	 *      update_task_progress:Closure,
+	 *      complete_task: Closure
+	 * }&\stdClass) Stream.
+	 */
+	public function stream() {
+		$noop =
+		/**
+		 * No-op.
+		 *
+		 * @return void
+		 */
+		function () {};
+
+		return is_a( $this->stream, '\ContentControl\Services\UpgradeStream' ) ? $this->stream : (object) [
+			'send_event'           => $noop,
+			'send_error'           => $noop,
+			'send_data'            => $noop,
+			'update_status'        => $noop,
+			'update_task_status'   => $noop,
+			'start_upgrades'       => $noop,
+			'complete_upgrades'    => $noop,
+			'start_task'           => $noop,
+			'update_task_progress' => $noop,
+			'complete_task'        => $noop,
+		];
+	}
+}

+<?php
+/**
+ * Admin controller.
+ *
+ * @copyright (c) 2022, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+use ContentControl\Controllers\Admin\Reviews;
+use ContentControl\Controllers\Admin\SettingsPage;
+use ContentControl\Controllers\Admin\Upgrades;
+use ContentControl\Controllers\Admin\UserExperience;
+use ContentControl\Controllers\Admin\WidgetEditor;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Admin controller  class.
+ *
+ * @package ContentControl
+ */
+class Admin extends Controller {
+
+	/**
+	 * Initialize admin controller.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		$this->container->register_controllers( [
+			'Admin\Reviews'        => new Reviews( $this->container ),
+			'Admin\Settings'       => new SettingsPage( $this->container ),
+			'Admin\Upgrades'       => new Upgrades( $this->container ),
+			'Admin\UserExperience' => new UserExperience( $this->container ),
+			'Admin\WidgetEditor'   => new WidgetEditor( $this->container ),
+		] );
+	}
+}

+<?php
+/**
+ * Settings Page Controller Class.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Admin;
+
+use ContentControl\Base\Controller;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Settings Page Controller.
+ *
+ * @package ContentControl\Admin
+ */
+class SettingsPage extends Controller {
+
+	/**
+	 * Initialize the settings page.
+	 */
+	public function init() {
+		add_action( 'admin_menu', [ $this, 'register_page' ], 999 );
+		add_action( 'admin_enqueue_scripts', [ $this, 'enqueue_scripts' ] );
+		// These are here to listen for incoming webhooks from the Upgrader service when user chooses to install Pro.
+		add_action( 'wp_ajax_content_control_connect_verify_connection', [ $this, 'process_verify_connection' ] );
+		add_action( 'wp_ajax_nopriv_content_control_connect_verify_connection', [ $this, 'process_verify_connection' ] );
+		add_action( 'wp_ajax_content_control_connect_webhook', [ $this, 'process_webhook' ] );
+		add_action( 'wp_ajax_nopriv_content_control_connect_webhook', [ $this, 'process_webhook' ] );
+	}
+
+	/**
+	 * Register admin options pages.
+	 *
+	 * @return void
+	 */
+	public function register_page() {
+		add_options_page(
+			__( 'Content Control', 'content-control' ),
+			__( 'Content Control', 'content-control' ),
+			'manage_options',
+			'content-control-settings',
+			[ $this, 'render_page' ]
+		);
+	}
+
+	/**
+	 * Render settings page title & container.
+	 *
+	 * @return void
+	 */
+	public function render_page() {
+		?>
+			<div id="content-control-root-container"></div>
+			<script>jQuery(() => window.contentControl.settingsPage.init());</script>
+		<?php
+	}
+
+	/**
+	 * Enqueue assets for the settings page.
+	 *
+	 * @param string $hook Page hook name.
+	 *
+	 * @return void
+	 */
+	public function enqueue_scripts( $hook ) {
+		if ( 'settings_page_content-control-settings' !== $hook ) {
+			return;
+		}
+
+		wp_enqueue_editor();
+		wp_tinymce_inline_scripts();
+
+		wp_enqueue_script( 'content-control-settings-page' );
+	}
+
+	/**
+	 * Verify the connection.
+	 *
+	 * @return void
+	 */
+	public function process_verify_connection() {
+		$this->container->get( 'connect' )->process_verify_connection();
+	}
+
+	/**
+	 * Listen for incoming secure webhooks from the API server.
+	 *
+	 * @return void
+	 */
+	public function process_webhook() {
+		$this->container->get( 'connect' )->process_webhook();
+	}
+}

+<?php
+/**
+ * Admin User Experience controller.
+ *
+ * @package ContentControl\Admin
+ * @copyright (c) 2023 Code Atlantic LLC
+ */
+
+namespace ContentControl\Controllers\Admin;
+
+use ContentControl\Base\Controller;
+
+/**
+ * UserExperience controller class.
+ */
+class UserExperience extends Controller {
+
+	/**
+	 * Initialize widget editor UX.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_filter( 'plugin_action_links', [ $this, 'plugin_action_links' ], 10, 2 );
+		add_action( "after_plugin_row_{$this->container->get('basename')}", [
+			$this,
+			'after_plugin_row',
+		], 10, 2 );
+	}
+
+	/**
+	 * Render plugin action links.
+	 *
+	 * @param array<string,string> $links Existing links.
+	 * @param string               $file Plugin file path.
+	 *
+	 * @return mixed
+	 */
+	public function plugin_action_links( $links, $file ) {
+		$basename = $this->container->get( 'basename' );
+
+		if ( $file === $basename ) {
+			$plugin_action_links = apply_filters(
+				'content_control/plugin_action_links',
+				[
+					'upgrade'  => '<a target="_blank" href="https://contentcontrolplugin.com/pricing/?utm_campaign=upgrade-to-pro&utm_source=plugins-page&utm_medium=plugin-ui&utm_content=action-links-upgrade-text">' . __( 'Upgrade to Pro', 'content-control' ) . '</a>',
+					'settings' => '<a href="' . admin_url( 'options-general.php?page=content-control-settings' ) . '">' . __( 'Settings', 'content-control' ) . '</a>',
+				]
+			);
+
+			if ( $this->container->is_license_active() || $this->container->is_pro_active() ) {
+				unset( $plugin_action_links['upgrade'] );
+			}
+
+			if ( substr( get_locale(), 0, 2 ) === 'en' ) {
+				$plugin_action_links = array_merge( [ 'translate' => '<a href="' . sprintf( 'https://translate.wordpress.org/locale/%s/default/wp-plugins/content-control/', substr( get_locale(), 0, 2 ) ) . '" target="_blank">' . __( 'Translate', 'content-control' ) . '</a>' ], $plugin_action_links );
+			}
+
+			foreach ( $plugin_action_links as $link ) {
+				array_unshift( $links, $link );
+			}
+		}
+
+		return $links;
+	}
+
+	/**
+	 * Add a row to the plugin list table.
+	 *
+	 * @param string                   $file Plugin file path.
+	 * @param array<string,string|int> $plugin_data Plugin data.
+	 *
+	 * @return void
+	 */
+	public function after_plugin_row( $file, $plugin_data ) {
+		$plugin_slug = $this->container->get( 'slug' );
+
+		if ( $plugin_slug !== $plugin_data['slug'] ) {
+			return;
+		}
+
+		$plugin_url = $this->container->get( 'url' );
+
+		?>
+		<!-- <tr class="plugin-update-tr active">
+			<td colspan="3" class="plugin-update colspanchange">
+				<div class="update-message notice inline notice-warning notice-alt">
+					<p>
+						<?php
+						printf(
+							/* translators: %1$s: Plugin name, %2$s: Plugin URL */
+							esc_html__( 'You are using the %1$s plugin. Please visit the %2$s to learn how to use it.', 'content-control' ),
+							'<strong>' . esc_html__( 'Content Control', 'content-control' ) . '</strong>',
+							'<a href="' . esc_url( $plugin_url ) . '" target="_blank">' . esc_html__( 'plugin website', 'content-control' ) . '</a>'
+						);
+						?>
+					</p>
+				</div>
+			</td>
+		</tr> -->
+
+		<?php
+	}
+}

+<?php
+/**
+ * Admin Widget Editor controller.
+ *
+ * @note This is only used for the old WP -4.9 widget editor.
+ *
+ * @package ContentControl\Admin
+ * @copyright (c) 2023 Code Atlantic LLC
+ */
+
+namespace ContentControl\Controllers\Admin;
+
+use WP_Widget;
+use ContentControl\Base\Controller;
+
+use function ContentControl\Rules\allowed_user_roles;
+use function ContentControl\Widgets\parse_options as parse_widget_options;
+
+/**
+ * WidgetEditor controller class.
+ */
+class WidgetEditor extends Controller {
+
+	/**
+	 * Initialize widget editor UX.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_action( 'admin_enqueue_scripts', [ $this, 'enqueue_assets' ] );
+		add_action( 'in_widget_form', [ $this, 'fields' ], 5, 3 );
+		add_filter( 'widget_update_callback', [ $this, 'save' ], 5, 3 );
+	}
+
+	/**
+	 * Enqueue v1 admin scripts.
+	 *
+	 * @param mixed $hook Admin page hook name.
+	 *
+	 * @return void
+	 */
+	public function enqueue_assets( $hook ) {
+		if ( 'widgets.php' === $hook ) {
+			wp_enqueue_style( 'content-control-widget-editor' );
+			wp_enqueue_script( 'content-control-widget-editor' );
+		}
+	}
+
+	/**
+	 * Renders additional widget option fields.
+	 *
+	 * @param \WP_Widget          $widget Widget instance.
+	 * @param bool                $ret Whether to return the output.
+	 * @param array<string,mixed> $instance Widget instance options.
+	 *
+	 * @return void
+	 */
+	public function fields( $widget, $ret, $instance ) {
+		$allowed_user_roles = allowed_user_roles();
+
+		wp_nonce_field( 'content-control-widget-editor-nonce', 'content-control-widget-editor-nonce' );
+
+		$which_users_options = [
+			''           => __( 'Everyone', 'content-control' ),
+			'logged_out' => __( 'Logged Out Users', 'content-control' ),
+			'logged_in'  => __( 'Logged In Users', 'content-control' ),
+		];
+
+		$instance = parse_widget_options( $instance );
+
+		?>
+		<p class="widget_options-which_users">
+			<label for="<?php echo esc_attr( $widget->get_field_id( 'which_users' ) ); ?>">
+				<?php esc_html_e( 'Who can see this widget?', 'content-control' ); ?><br />
+				<select name="<?php echo esc_attr( $widget->get_field_name( 'which_users' ) ); ?>" id="<?php echo esc_attr( $widget->get_field_id( 'which_users' ) ); ?>" class="widefat">
+					<?php foreach ( $which_users_options as $option => $label ) : ?>
+						<option value="<?php echo esc_attr( $option ); ?>" <?php selected( $option, $instance['which_users'] ); ?>>
+							<?php echo esc_html( $label ); ?>
+						</option>
+					<?php endforeach; ?>
+				</select>
+			</label>
+		</p>
+
+		<p class="widget_options-roles">
+			<?php esc_html_e( 'Choose which roles can see this widget', 'content-control' ); ?><br />
+			<?php foreach ( $allowed_user_roles as $option => $label ) : ?>
+				<label>
+					<input type="checkbox" name="<?php echo esc_attr( $widget->get_field_name( 'roles' ) ); ?>[]" value="<?php echo esc_attr( $option ); ?>" <?php checked( in_array( $option, $instance['roles'], true ), true ); ?>/>
+					<?php echo esc_html( $label ); ?>
+				</label>
+			<?php endforeach; ?>
+		</p>
+		<?php
+	}
+
+	/**
+	 * Validates & saves additional widget options.
+	 *
+	 * @param array<string,mixed> $instance Widget instance options.
+	 * @param array<string,mixed> $new_instance New widget instance options.
+	 * @param array<string,mixed> $old_instance Old widget instance options.
+	 *
+	 * @return array<string,mixed>|bool
+	 */
+	public function save( $instance, $new_instance, $old_instance ) {
+		if ( isset( $_POST['content-control-widget-editor-nonce'] ) && wp_verify_nonce( wp_unslash( sanitize_key( $_POST['content-control-widget-editor-nonce'] ) ), 'content-control-widget-editor-nonce' ) ) {
+			$new_instance            = parse_widget_options( $new_instance );
+			$instance['which_users'] = $new_instance['which_users'];
+			$instance['roles']       = $new_instance['roles'];
+
+			if ( 'logged_in' === $instance['which_users'] ) {
+				$allowed_roles = allowed_user_roles();
+
+				// Validate chosen roles and remove non-allowed roles.
+				foreach ( (array) $instance['roles'] as $key => $role ) {
+					if ( ! array_key_exists( $role, $allowed_roles ) ) {
+						unset( $instance['roles'][ $key ] );
+					}
+				}
+			} else {
+				unset( $instance['roles'] );
+			}
+		} else {
+			// Failed validation, use old instance.
+			$old_instance            = parse_widget_options( $old_instance );
+			$instance['which_users'] = $old_instance['which_users'];
+
+			if ( empty( $old_instance['roles'] ) ) {
+				unset( $instance['roles'] );
+			} else {
+				$instance['roles'] = $old_instance['roles'];
+			}
+		}
+
+		return $instance;
+	}
+}

+<?php
+/**
+ * Plugin assets controller.
+ *
+ * @package ContentControl\Admin
+ * @copyright (c) 2023 Code Atlantic LLC.
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+
+use function ContentControl\get_all_plugin_options;
+use function ContentControl\Rules\allowed_user_roles;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Admin assets controller.
+ *
+ * @package ContentControl\Admin
+ */
+class Assets extends Controller {
+
+	/**
+	 * Initialize the assets controller.
+	 */
+	public function init() {
+		add_action( 'wp_enqueue_scripts', [ $this, 'register_scripts' ], 0 );
+		add_action( 'admin_enqueue_scripts', [ $this, 'register_scripts' ], 0 );
+		add_action( 'wp_print_scripts', [ $this, 'autoload_styles_for_scripts' ], 0 );
+		add_action( 'admin_print_scripts', [ $this, 'autoload_styles_for_scripts' ], 0 );
+	}
+
+	/**
+	 * Get list of plugin packages.
+	 *
+	 * @return array<string,array<string,mixed>>
+	 */
+	public function get_packages() {
+		$permissions = $this->container->get_permissions();
+
+		foreach ( $permissions as $permission => $cap ) {
+			$permissions[ $permission ] = current_user_can( $cap );
+		}
+
+		$wp_version = get_bloginfo( 'version' );
+		// Strip last number from version as they won't be breaking changes.
+		$wp_version = preg_replace( '/\.\d+$/', '', $wp_version );
+
+		$is_pro_installed = \ContentControl\is_plugin_installed( 'content-control-pro/content-control-pro.php' );
+
+		$packages = [
+			'block-editor'  => [
+				'handle'   => 'content-control-block-editor',
+				'styles'   => true,
+				'varsName' => 'contentControlBlockEditor',
+				'vars'     => [
+					'adminUrl'       => admin_url(),
+					'wpVersion'      => $wp_version,
+					'pluginUrl'      => $this->container->get_url(),
+					'advancedMode'   => $this->container->get_option( 'advanced_mode', false ),
+					'allowedBlocks'  => [],
+					'userRoles'      => allowed_user_roles(),
+					'excludedBlocks' => array_merge( $this->container->get_option( 'excludedBlocks', [] ), [
+						'core/nextpage',
+						'core/freeform',
+					] ),
+					'permissions'    => $permissions,
+				],
+			],
+			'components'    => [
+				'handle' => 'content-control-components',
+				'styles' => true,
+				'deps'   => [
+					// This is required for tinymce components.
+					'wp-tinymce',
+					// This is required for all tinyMCE plugins.
+					'wp-block-library',
+				],
+			],
+			'core-data'     => [
+				'handle'   => 'content-control-core-data',
+				'deps'     => [
+					'wp-api',
+				],
+				'varsName' => 'contentControlCoreData',
+				'vars'     => [
+					'currentSettings' => get_all_plugin_options(),
+				],
+			],
+			'data'          => [
+				'handle' => 'content-control-data',
+			],
+			'fields'        => [
+				'handle' => 'content-control-fields',
+			],
+			'icons'         => [
+				'handle' => 'content-control-icons',
+				'styles' => true,
+			],
+			'rule-engine'   => [
+				'handle'   => 'content-control-rule-engine',
+				'varsName' => 'contentControlRuleEngine',
+				'vars'     => [
+					'adminUrl'        => admin_url(),
+					'registeredRules' => $this->container->get( 'rules' )->get_block_editor_rules(),
+				],
+				'styles'   => true,
+			],
+			'settings-page' => [
+				'handle'   => 'content-control-settings-page',
+				'varsName' => 'contentControlSettingsPage',
+				'vars'     => [
+					'pluginUrl'      => $this->container->get( 'url' ),
+					'wpVersion'      => $wp_version,
+					'adminUrl'       => admin_url(),
+					'restBase'       => 'content-control/v2',
+					'userRoles'      => allowed_user_roles(),
+					'logUrl'         => current_user_can( 'manage_options' ) ? $this->container->get( 'logging' )->get_file_url() : false,
+					'rolesAndCaps'   => wp_roles()->roles,
+					'version'        => $this->container->get( 'version' ),
+					'permissions'    => $permissions,
+					'isProInstalled' => $is_pro_installed,
+					'isProActivated' => $is_pro_installed && is_plugin_active( 'content-control-pro/content-control-pro.php' ),
+				],
+				'styles'   => true,
+			],
+			'utils'         => [
+				'handle' => 'content-control-utils',
+			],
+			'widget-editor' => [
+				'handle' => 'content-control-widget-editor',
+				'styles' => true,
+			],
+		];
+
+		return $packages;
+	}
+
+	/**
+	 * Register all package scripts & styles.
+	 *
+	 * @return void
+	 */
+	public function register_scripts() {
+		$packages = $this->get_packages();
+
+		// Register front end block styles.
+		wp_register_style( 'content-control-block-styles', $this->container->get_url( 'dist/style-block-editor.css' ), [], $this->container->get( 'version' ) );
+
+		foreach ( $packages as $package => $package_data ) {
+			$handle = $package_data['handle'];
+			$meta   = $this->get_asset_meta( $package );
+
+			$js_deps = isset( $package_data['deps'] ) ? $package_data['deps'] : [];
+
+			wp_register_script( $handle, $this->container->get_url( "dist/$package.js" ), array_merge( $meta['dependencies'], $js_deps ), $meta['version'], true );
+
+			if ( isset( $package_data['styles'] ) && $package_data['styles'] ) {
+				wp_register_style( $handle, $this->container->get_url( "dist/$package.css" ), [ 'wp-components', 'wp-block-editor', 'dashicons' ], $meta['version'] );
+			}
+
+			if ( isset( $package_data['varsName'] ) && ! empty( $package_data['vars'] ) ) {
+				$localized_vars = apply_filters( "content_control/{$package}_localized_vars", $package_data['vars'] );
+				wp_localize_script( $handle, $package_data['varsName'], $localized_vars );
+			}
+
+			/**
+			 * May be extended to wp_set_script_translations( 'my-handle', 'my-domain',
+			 * plugin_dir_path( MY_PLUGIN ) . 'languages' ) ). For details see
+			 * https://make.wordpress.org/core/2018/11/09/new-javascript-i18n-support-in-wordpress/
+			 */
+			wp_set_script_translations( $handle, 'content-control' );
+		}
+	}
+
+	/**
+	 * Auto load styles if scripts are enqueued.
+	 *
+	 * @return void
+	 */
+	public function autoload_styles_for_scripts() {
+		$packages = $this->get_packages();
+
+		foreach ( $packages as $package => $package_data ) {
+			if ( wp_script_is( $package_data['handle'], 'enqueued' ) ) {
+				if ( isset( $package_data['styles'] ) && $package_data['styles'] ) {
+					wp_enqueue_style( $package_data['handle'] );
+				}
+			}
+		}
+	}
+
+	/**
+	 * Get asset meta from generated files.
+	 *
+	 * @param string $package Package name.
+	 * @return array{dependencies:string[],version:string}
+	 */
+	public function get_asset_meta( $package ) {
+		$meta_path = $this->container->get_path( "dist/$package.asset.php" );
+		return file_exists( $meta_path ) ? require $meta_path : [
+			'dependencies' => [],
+			'version'      => $this->container->get( 'version' ),
+		];
+	}
+}

+<?php
+/**
+ * Frontend general setup.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class BlockEditor
+ *
+ * @version 2.0.0
+ */
+class BlockEditor extends Controller {
+
+	/**
+	 * Initiate hooks & filter.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_action( 'enqueue_block_editor_assets', [ $this, 'enqueue_assets' ] );
+		add_action( 'enqueue_block_assets', [ $this, 'enqueue_block_assets' ] );
+	}
+
+	/**
+	 * Enqueue block editor assets.
+	 *
+	 * @return void
+	 */
+	public function enqueue_assets() {
+		wp_enqueue_script( 'content-control-block-editor' );
+	}
+
+	/**
+	 * Enqueue block assets.
+	 *
+	 * @return void
+	 */
+	public function enqueue_block_assets() {
+		wp_enqueue_style( 'content-control-block-styles' );
+	}
+}

+<?php
+/**
+ * Compatibility controller.
+ *
+ * @copyright (c) 2022, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+use ContentControl\Controllers\Compatibility\BetterDocs;
+use ContentControl\Controllers\Compatibility\Divi;
+use ContentControl\Controllers\Compatibility\Elementor;
+use ContentControl\Controllers\Compatibility\QueryMonitor;
+use ContentControl\Controllers\Compatibility\TheEventsCalendar;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Admin controller  class.
+ *
+ * @package ContentControl
+ */
+class Compatibility extends Controller {
+
+	/**
+	 * Initialize admin controller.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		$this->container->register_controllers( [
+			'Compatibility\BetterDocs'        => new BetterDocs( $this->container ),
+			'Compatibility\Divi'              => new Divi( $this->container ),
+			'Compatibility\Elementor'         => new Elementor( $this->container ),
+			'Compatibility\QueryMonitor'      => new QueryMonitor( $this->container ),
+			'Compatibility\TheEventsCalendar' => new TheEventsCalendar( $this->container ),
+		] );
+	}
+}

+<?php
+/**
+ * BetterDocs controller class.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Compatibility;
+
+use ContentControl\Base\Controller;
+
+/**
+ * BetterDocs controller class.
+ */
+class BetterDocs extends Controller {
+
+	/**
+	 * Initiate hooks & filter.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_filter( 'content_control/get_rest_api_intent', [ $this, 'get_rest_api_intent' ], 10 );
+	}
+
+	/**
+	 * Check if controller is enabled.
+	 *
+	 * @return bool
+	 */
+	public function controller_enabled() {
+		return defined( 'BETTERDOCS_PLUGIN_FILE' );
+	}
+
+	/**
+	 * Get intent for BetterDocs.
+	 *
+	 * @param array<string,mixed> $intent Intent.
+	 *
+	 * @return array<string,mixed>
+	 */
+	public function get_rest_api_intent( $intent ) {
+		global $wp;
+
+		$rest_route     = $wp->query_vars['rest_route'];
+		$endpoint_parts = explode( '/', str_replace( '/wp/v2/', '', $rest_route ) );
+
+		// Set the custom search intent.
+		if ( isset( $wp->query_vars['search'] ) ) {
+			$intent['search'] = sanitize_title( $wp->query_vars['search'] );
+		}
+
+		if ( 'unknown' === $intent['type'] && 'docs' === $intent['name'] ) {
+			// If we have a post type or taxonomy, the name is the first part (posts, categories).
+			$post_type = sanitize_key( $endpoint_parts[0] );
+
+			if ( 'docs' === $post_type ) {
+				$intent['type'] = 'post_type';
+			}
+		}
+
+		// phpcs:disable WordPress.Security.NonceVerification.Recommended
+		if ( isset( $_REQUEST['post_type'] ) ) {
+			$post_type = sanitize_text_field( wp_unslash( $_REQUEST['post_type'] ) );
+
+			// Check if any ct_forced_* request aregs are set. If so we should use the post type intent.
+			if ( strpos( $post_type, 'ct_forced_' ) !== false ) {
+				$intent['type'] = 'post_type';
+
+				$post_type = str_replace( 'ct_forced_', '', $post_type );
+
+				$intent['name'] = explode( ':', $post_type );
+			}
+		}
+		// phpcs:enable WordPress.Security.NonceVerification.Recommended
+
+		return $intent;
+	}
+}

+<?php
+/**
+ * Divi compatibility controller.
+ *
+ * @package ContentControl\Admin
+ * @copyright (c) 2023 Code Atlantic LLC
+ */
+
+namespace ContentControl\Controllers\Compatibility;
+
+use ContentControl\Base\Controller;
+
+/**
+ * Divi controller class.
+ */
+class Divi extends Controller {
+
+	/**
+	 * Initialize widget editor UX.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_filter( 'content_control/protection_is_disabled', [ $this, 'protection_is_disabled' ] );
+	}
+
+	/**
+	 * Check if controller is enabled.
+	 *
+	 * @return bool
+	 */
+	public function controller_enabled() {
+		return defined( 'ET_CORE_VERSION' );
+	}
+
+	/**
+	 * Conditionally disable Content Control for Divi builder.
+	 *
+	 * @param boolean $protection_is_disabled Whether protection is disabled.
+	 * @return boolean
+	 */
+	public function protection_is_disabled( $protection_is_disabled ) {
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		if ( isset( $_GET['et_fb'] ) && ! empty( $_GET['et_fb'] ) ) {
+			return true;
+		}
+
+		return $protection_is_disabled;
+	}
+}

+<?php
+/**
+ * Elementor compatibility controller.
+ *
+ * @package ContentControl\Admin
+ * @copyright (c) 2023 Code Atlantic LLC
+ */
+
+namespace ContentControl\Controllers\Compatibility;
+
+use ContentControl\Base\Controller;
+
+/**
+ * Elementor controller class.
+ */
+class Elementor extends Controller {
+
+	/**
+	 * Initialize widget editor UX.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_filter( 'content_control/post_types_to_ignore', [ $this, 'post_types_to_ignore' ] );
+		add_filter( 'content_control/protection_is_disabled', [ $this, 'protection_is_disabled' ] );
+	}
+
+	/**
+	 * Check if controller is enabled.
+	 *
+	 * @return bool
+	 */
+	public function controller_enabled() {
+		return class_exists( '\Elementor\Plugin' ) || did_action( 'elementor/loaded' );
+	}
+
+	/**
+	 * Conditionally disable Content Control for Elementor builder.
+	 *
+	 * @param boolean $is_disabled Whether protection is disabled.
+	 * @return boolean
+	 */
+	public function protection_is_disabled( $is_disabled ) {
+		// If already disabled, no reason to continue.
+		if ( $is_disabled || ! did_action( 'elementor/loaded' ) ) {
+			return $is_disabled;
+		}
+
+		return $this->elementor_builder_is_active();
+	}
+
+	/**
+	 * Add Elementor font post type to ignored post types.
+	 *
+	 * @param string[] $post_types Post types to ignore.
+	 * @return string[]
+	 */
+	public function post_types_to_ignore( $post_types ) {
+		$post_types[] = 'elementor_font';
+		$post_types[] = 'elementor_icons';
+		$post_types[] = 'elementor_library';
+		$post_types[] = 'elementor_snippet';
+
+		return $post_types;
+	}
+
+	/**
+	 * Check if Elementor builder is active.
+	 *
+	 * @return boolean
+	 */
+	public function elementor_builder_is_active() {
+		// Check if this is the admin theme builder app.
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended Simple & direct string comparison.
+		if (
+			is_admin() &&
+			// Disable notices as this is a generic string comparison to prevent doing a lot of work.
+			// phpcs:disable WordPress.Security.NonceVerification.Recommended
+			! empty( $_GET['page'] ) &&
+			'elementor-app' === $_GET['page']
+			// phpcs:enable WordPress.Security.NonceVerification.Recommended
+		) {
+			return true;
+		}
+
+		if ( ! class_exists( '\Elementor\Plugin' ) || ! isset( \Elementor\Plugin::$instance ) ) {
+			return false;
+		}
+
+		/**
+		 * Elementor instance.
+		 *
+		 * @var \Elementor\Plugin $elementor
+		 */
+		$elementor = \Elementor\Plugin::$instance;
+
+		/**
+		 * Elementor preview instance.
+		 *
+		 * @var \Elementor\Preview|(object{is_preview_mod:\Closure}&\stdClass)|false $preview
+		 */
+		$preview = isset( $elementor->preview ) ? $elementor->preview : false;
+
+		if ( false === $preview || ! method_exists( $preview, 'is_preview_mode' ) ) {
+			return false;
+		}
+
+		// Check if the page builder is active.
+		return $preview->is_preview_mode();
+	}
+}

+<?php
+/**
+ * QueryMonitor
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Compatibility;
+
+use ContentControl\Base\Controller;
+use ContentControl\QueryMonitor\Output;
+use ContentControl\QueryMonitor\Collector;
+use QM_Collectors;
+
+use function ContentControl\is_frontend;
+
+/**
+ * QueryMonitor
+ */
+class QueryMonitor extends Controller {
+
+	/**
+	 * Initialize the class
+	 *
+	 * @return void
+	 */
+	public function init() {
+		$this->register_collector();
+		add_filter( 'qm/outputter/html', [ $this, 'register_output_html' ], 10 );
+	}
+
+	/**
+	 * Check if controller is enabled.
+	 *
+	 * @return bool
+	 */
+	public function controller_enabled() {
+		return class_exists( 'QueryMonitor' );
+	}
+
+	/**
+	 * Register collector.
+	 *
+	 * @return void
+	 */
+	public function register_collector() {
+		QM_Collectors::add( new Collector() );
+	}
+
+	/**
+	 * Add Query Monitor outputter.
+	 *
+	 * @param array<string,\QM_Output_Html> $output Outputters.
+	 * @return array<string,\QM_Output_Html> Outputters.
+	 */
+	public function register_output_html( $output ) {
+		if ( ! is_frontend() ) {
+			return $output;
+		}
+
+		$collector = QM_Collectors::get( 'content-control' );
+
+		if ( $collector ) {
+			$output['content-control'] = new Output( $collector );
+		}
+
+		return $output;
+	}
+}

+<?php
+/**
+ * The Events Calendar
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Compatibility;
+
+use ContentControl\Base\Controller;
+
+/**
+ * TheEventsCalendar controller class.
+ */
+class TheEventsCalendar extends Controller {
+
+	/**
+	 * Initiate hooks & filter.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		// 'wp_redirect'
+		add_action( 'content_control/restrict_main_query', [ $this, 'restrict_main_query' ], 10 );
+	}
+
+	/**
+	 * Check if controller is enabled.
+	 *
+	 * @return bool
+	 */
+	public function controller_enabled() {
+		return class_exists( '\Tribe__Events__Main' ) && defined( 'TRIBE_EVENTS_FILE' );
+	}
+
+	/**
+	 * Handle restrictions on the main query.
+	 *
+	 * When the main query is set to be redirected, TEC was cancelling the redirect. Returing true will allow the redirect to happen.
+	 *
+	 * @return void
+	 */
+	public function restrict_main_query() {
+		// If during the main query, a redirect is called on the events page, we need to allow it to happen.
+		add_filter( 'wp_redirect', function ( $location ) {
+			// Only call this filter within the redirect filter. Limiting the scope of the filter.
+			add_filter( 'tec_events_views_v2_redirected', '__return_true' );
+			return $location;
+		}, 0 );
+	}
+}

+<?php
+/**
+ * Frontend general setup.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+
+use ContentControl\Controllers\Frontend\Blocks;
+use ContentControl\Controllers\Frontend\Restrictions;
+use ContentControl\Controllers\Frontend\Widgets;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class Frontend
+ */
+class Frontend extends Controller {
+
+	/**
+	 * Initialize Hooks & Filters
+	 */
+	public function init() {
+		$this->container->register_controllers([
+			'Frontend\Blocks'       => new Blocks( $this->container ),
+			'Frontend\Restrictions' => new Restrictions( $this->container ),
+			'Frontend\Widgets'      => new Widgets( $this->container ),
+		]);
+
+		$this->hooks();
+	}
+
+	/**
+	 * Register general frontend hooks.
+	 *
+	 * @return void
+	 */
+	public function hooks() {
+		$this->replicate_core_content_filters();
+
+		add_filter( 'content_control/restricted_post_content', '\ContentControl\append_post_excerpts', 9, 2 );
+		add_filter( 'content_control/restricted_post_excerpt', '\ContentControl\append_post_excerpts', 9, 2 );
+	}
+
+	/**
+	 * Replicate core content filters.
+	 *
+	 * @return void
+	 */
+	private function replicate_core_content_filters() {
+		/**
+		 * Instance of WP_Embed class.
+		 *
+		 * @var \WP_Embed $wp_embed
+		 */
+		global $wp_embed;
+
+		$the_content = 'content_control/restricted_post_content';
+		$the_excerpt = 'content_control/restricted_post_excerpt';
+
+		// These all follow WP core's `the_content` filter.
+		add_filter( $the_content, 'do_blocks', 9 );
+		add_filter( $the_content, 'wptexturize' );
+		add_filter( $the_content, 'convert_smilies', 20 );
+		add_filter( $the_content, 'wpautop' );
+		add_filter( $the_content, 'shortcode_unautop' );
+		add_filter( $the_content, 'prepend_attachment' );
+		add_filter( $the_content, 'wp_replace_insecure_home_url' );
+		add_filter( $the_content, 'do_shortcode', 11 ); // AFTER wpautop().
+		add_filter( $the_content, 'wp_filter_content_tags', 12 ); // Runs after do_shortcode().
+		add_filter( $the_content, 'capital_P_dangit', 11 );
+		add_filter( $the_content, [ $wp_embed, 'run_shortcode' ], 8 );
+		add_filter( $the_content, [ $wp_embed, 'autoembed' ], 8 );
+
+		// These all follow WP core's `the_excerpt` filter.
+		add_filter( $the_excerpt, 'wptexturize' );
+		add_filter( $the_excerpt, 'convert_smilies' );
+		add_filter( $the_excerpt, 'convert_chars' );
+		add_filter( $the_excerpt, 'wpautop' );
+		add_filter( $the_excerpt, 'shortcode_unautop' );
+		add_filter( $the_excerpt, 'wp_replace_insecure_home_url' );
+		add_filter( $the_excerpt, 'wp_filter_content_tags', 12 );
+		add_filter( $the_excerpt, 'capital_P_dangit', 11 );
+	}
+}

+<?php
+/**
+ * Frontend restrictions setup.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Frontend;
+
+use ContentControl\Base\Controller;
+use ContentControl\Controllers\Frontend\Restrictions\MainQuery;
+use ContentControl\Controllers\Frontend\Restrictions\QueryPosts;
+use ContentControl\Controllers\Frontend\Restrictions\PostContent;
+use ContentControl\Controllers\Frontend\Restrictions\QueryTerms;
+use ContentControl\Controllers\Frontend\Restrictions\RestAPI;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class for handling global restrictions.
+ *
+ * @package ContentControl
+ */
+class Restrictions extends Controller {
+
+	/**
+	 * Initiate functionality.
+	 */
+	public function init() {
+		$this->container->register_controllers( [
+			'Frontend\Restrictions\MainQuery'   => new MainQuery( $this->container ),
+			'Frontend\Restrictions\QueryPosts'  => new QueryPosts( $this->container ),
+			'Frontend\Restrictions\QueryTerms'  => new QueryTerms( $this->container ),
+			'Frontend\Restrictions\PostContent' => new PostContent( $this->container ),
+			'Frontend\Restrictions\RestAPI'     => new RestAPI( $this->container ),
+		] );
+	}
+}

+<?php
+/**
+ * Frontend main query restrictions.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Frontend\Restrictions;
+
+use ContentControl\Base\Controller;
+
+use function ContentControl\redirect;
+use function ContentControl\get_main_wp_query;
+use function ContentControl\set_query_to_page;
+use function ContentControl\reset_query_context;
+use function ContentControl\query_can_be_ignored;
+use function ContentControl\content_is_restricted;
+use function ContentControl\override_query_context;
+use function ContentControl\protection_is_disabled;
+use function ContentControl\get_applicable_restriction;
+use function ContentControl\get_restriction_matches_for_queried_posts;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class for handling global restrictions of the Main Query.
+ *
+ * @package ContentControl
+ */
+class MainQuery extends Controller {
+
+	/**
+	 * Initiate functionality.
+	 */
+	public function init() {
+		// This can be done no later than template_redirect, and no sooner than send_headers (when conditional tags are available).
+		// Can be done on send_headers, posts_selection, or wp as well.
+		add_action( 'template_redirect', [ $this, 'restrict_main_query' ], 10 );
+	}
+
+	/**
+	 * Handle a restriction on the main query.
+	 *
+	 * NOTE: This is only for redirecting or replacing pages and
+	 *       should not be used to filter or hide post contents.
+	 *
+	 * @return void
+	 */
+	public function restrict_main_query() {
+		if ( ! \is_main_query() || protection_is_disabled() ) {
+			return;
+		}
+
+		$this->check_main_query();
+		$this->check_main_query_posts();
+	}
+
+	/**
+	 * Handle restrictions on the main query.
+	 *
+	 * NOTE: This is only for redirecting or replacing archives and
+	 *       should not be used to filter or hide post contents.
+	 *
+	 * @return void
+	 */
+	public function check_main_query() {
+		// Bail if we didn't match any restrictions.
+		if ( content_is_restricted() ) {
+			$restriction = get_applicable_restriction();
+
+			/**
+			 * Use this filter to prevent a post from being restricted, or to handle it yourself.
+			 *
+			 * @param null|mixed                              $pre        Whether to prevent the post from being restricted.
+			 * @param null|\ContentControl\Models\Restriction $restriction Restriction object.
+			 * @return null|mixed
+			 */
+			if ( null !== apply_filters( 'content_control/pre_restrict_main_query', null, $restriction ) ) {
+				return;
+			}
+
+			/**
+			 * Fires when a post is restricted, but before the restriction is handled.
+			 *
+			 * @param \ContentControl\Models\Restriction $restriction Restriction object.
+			 */
+			do_action( 'content_control/restrict_main_query', $restriction );
+
+			$method = $restriction->get_setting( 'protectionMethod' );
+
+			switch ( $method ) {
+				case 'redirect':
+					redirect( $restriction->get_setting( 'redirectType' ), $restriction->get_setting( 'redirectUrl' ) );
+					return;
+
+				case 'replace':
+					if ( 'page' === $restriction->get_setting( 'replacementType' ) ) {
+						set_query_to_page( $restriction->get_setting( 'replacementPage' ) );
+						return;
+					}
+			}
+		}
+	}
+
+	/**
+	 * Handle restrictions on the main query posts.
+	 *
+	 * NOTE: This is only for redirecting or replacing archives and
+	 *       should not be used to filter or hide post contents.
+	 *
+	 * @return void
+	 */
+	public function check_main_query_posts() {
+		$query = get_main_wp_query();
+
+		if ( query_can_be_ignored( $query ) ) {
+			return;
+		}
+
+		// Ensure rules are checked in the correct context.
+		override_query_context( 'main/posts' );
+
+		// Get restrictions for the queried posts.
+		$post_restrictions = get_restriction_matches_for_queried_posts( $query );
+
+		// Reset query context.
+		reset_query_context();
+
+		if ( ! $post_restrictions ) {
+			return;
+		}
+
+		// Only the highest priority restriction is needed with redirect or replace handling.
+		$restriction_match = false;
+
+		// Find the highest priority restriction with redirect or replace handling.
+		foreach ( $post_restrictions as $post_restriction ) {
+			/**
+			 * Restriction object.
+			 *
+			 * @var \ContentControl\Models\Restriction
+			 */
+			$restriction = $post_restriction['restriction'];
+
+			if ( 'redirect' === $restriction->get_setting( 'archiveHandling' ) || 'replace_archive_page' === $restriction->get_setting( 'archiveHandling' ) ) {
+				$restriction_match = $post_restriction;
+				break;
+			}
+		}
+
+		if ( false === $restriction_match ) {
+			return;
+		}
+
+		/**
+		 * Restriction object.
+		 *
+		 * @var \ContentControl\Models\Restriction
+		 */
+		$restriction = $restriction_match['restriction'];
+		$post_ids    = $restriction_match['post_ids'];
+
+		/**
+		 * Use this filter to prevent a post from being restricted, or to handle it yourself.
+		 *
+		 * @param null|mixed                              $pre         Whether to prevent the post from being restricted.
+		 * @param null|\ContentControl\Models\Restriction $restriction Restriction object.
+		 * @param int[]                                   $post_id     Post ID.
+		 *
+		 * @return null|mixed
+		 */
+		if ( null !== apply_filters( 'content_control/pre_restrict_main_query_post', null, $restriction, $post_ids ) ) {
+			return;
+		}
+
+		/**
+		 * Fires when a post is restricted, but before the restriction is handled.
+		 *
+		 * @param \ContentControl\Models\Restriction $restriction Restriction object.
+		 * @param int[]                              $post_id     Post ID.
+		 */
+		do_action( 'content_control/restrict_main_query_post', $restriction, $post_ids );
+
+		switch ( $restriction->get_setting( 'archiveHandling' ) ) {
+			case 'replace_archive_page':
+				set_query_to_page( $restriction->get_setting( 'archiveReplacementPage' ) );
+				break;
+			case 'redirect':
+				redirect( $restriction->get_setting( 'archiveRedirectType' ), $restriction->get_setting( 'archiveRedirectUrl' ) );
+				break;
+		}
+	}
+}

+<?php
+/**
+ * Frontend post content restrictions.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Frontend\Restrictions;
+
+use ContentControl\Base\Controller;
+
+use function ContentControl\content_is_restricted;
+use function ContentControl\protection_is_disabled;
+use function ContentControl\get_applicable_restriction;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class for handling global restrictions of the post contents.
+ *
+ * @package ContentControl
+ */
+class PostContent extends Controller {
+
+	/**
+	 * Initiate functionality.
+	 */
+	public function init() {
+		$this->enable_filters();
+	}
+
+	/**
+	 * Enable filters.
+	 *
+	 * @return void
+	 */
+	public function enable_filters() {
+		add_filter( 'the_content', [ $this, 'filter_the_content_if_restricted' ], 1000 );
+		add_filter( 'get_the_excerpt', [ $this, 'filter_the_excerpt_if_restricted' ], 1000, 2 );
+		// phpcs:disable Squiz.PHP.CommentedOutCode.Found, Squiz.Commenting.InlineComment.InvalidEndChar -- These are for future use.
+		// add_filter( 'the_title', [ $this, 'filter_the_title_if_restricted'], 1000, 2 );
+		// add_filter( 'get_the_excerpt', [ $this, 'filter_the_excerpt_if_restricted' ], 1000, 2 );
+		// add_filter( 'post_class', [ $this, 'filter_post_class_if_restricted' ], 1000, 3 );
+		// add_filter( 'post_password_required', [ $this, 'require_password_if_restricted' ], 1000, 2 );
+		// add_filter( 'the_password_form', [ $this, 'filter_password_form_if_restricted' ], 1000, 2 );
+		// phpcs:enable Squiz.PHP.CommentedOutCode.Found, Squiz.Commenting.InlineComment.InvalidEndChar
+	}
+
+	/**
+	 * Disable filters.
+	 *
+	 * @return void
+	 */
+	public function disable_filters() {
+		remove_filter( 'the_content', [ $this, 'filter_the_content_if_restricted' ], 1000 );
+		remove_filter( 'get_the_excerpt', [ $this, 'filter_the_excerpt_if_restricted' ], 1000 );
+	}
+
+	/**
+	 * Filter post content when needed.
+	 *
+	 * NOTE: If we got this far with restricted content, this is the last attempt to protect
+	 * it. This serves as the default fallback protection method if all others fail.
+	 *
+	 * @param string $content Content of post being checked.
+	 *
+	 * @return string
+	 */
+	public function filter_the_content_if_restricted( $content ) {
+		$filter_name = 'content_control/restricted_post_content';
+
+		// If this isn't a post type that can be restricted, bail.
+		if ( protection_is_disabled() ) {
+			return $content;
+		}
+
+		if ( ! content_is_restricted() ) {
+			return $content;
+		}
+
+		// Ensure we don't get into an infinite loop.
+		if ( doing_filter( $filter_name ) || doing_filter( 'get_the_excerpt' ) ) {
+			return $content;
+		}
+
+		$restriction = get_applicable_restriction();
+
+		if ( false === $restriction ) {
+			return $content;
+		}
+
+		// If this is a replacement page, bail.
+		if (
+			( 'replace' === $restriction->get_setting( 'protectionMethod' ) && 'page' === $restriction->get_setting( 'replacementType' ) && is_page( $restriction->get_setting( 'replacementPage' ) ) ) ||
+			( 'replace_archive_page' === $restriction->get_setting( 'archiveHandling' ) && is_page( $restriction->get_setting( 'archiveReplacementPage' ) ) )
+		) {
+			return $content;
+		}
+
+		$message = \ContentControl\get_default_denial_message();
+
+		/**
+		 * If the restriction has a custom message, use it.
+		 *
+		 * We could check $restriction->replacement_type, but we need a safe default for
+		 * all cases. Further we do content filtering for all sub queries and currently
+		 * don't offer a way to override the message for those.
+		 *
+		 * In this way currently users can change to content replacement, set the override
+		 * message, then change back to page replacement and the override message will still
+		 * be used for the post in sub queries.
+		 */
+		if ( $restriction->get_setting( 'overrideMessage' ) ) {
+			$message = $restriction->get_message();
+		}
+
+		/**
+		 * Filter the message to display when a post is restricted.
+		 *
+		 * @param string $message     Message to display.
+		 * @param object $restriction Restriction object.
+		 *
+		 * @return string
+		 */
+		return apply_filters(
+			$filter_name,
+			// If the default message is empty, show a generic message.
+			! empty( $message ) ? $message : __( 'This content is restricted.', 'content-control' ),
+			$restriction
+		);
+	}
+
+	/**
+	 * Filter post excerpt when needed.
+	 *
+	 * @param string   $post_excerpt The post excerpt.
+	 * @param \WP_Post $post         Post object.
+	 *
+	 * @return string
+	 */
+	public function filter_the_excerpt_if_restricted( $post_excerpt, $post = null ) {
+		$filter_name = 'content_control/restricted_post_excerpt';
+
+		// If this isn't a post type that can be restricted, bail.
+		if ( protection_is_disabled() ) {
+			return $post_excerpt;
+		}
+
+		if ( ! content_is_restricted( $post->ID ) ) {
+			return $post_excerpt;
+		}
+
+		if ( doing_filter( $filter_name ) ) {
+			return $post_excerpt;
+		}
+
+		$restriction = get_applicable_restriction();
+
+		/**
+		 * Filter the excerpt to display when a post is restricted.
+		 *
+		 * @param string $message     Message to display.
+		 * @param object $restriction Restriction object.
+		 *
+		 * @return string
+		 */
+		return apply_filters(
+			$filter_name,
+			$restriction->get_message(),
+			$restriction
+		);
+	}
+}

+<?php
+/**
+ * Frontend query post restrictions.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Frontend\Restrictions;
+
+use ContentControl\Base\Controller;
+
+use function ContentControl\query_can_be_ignored;
+use function ContentControl\protection_is_disabled;
+use function ContentControl\get_restriction_matches_for_queried_posts;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class for handling global restrictions of the query posts.
+ *
+ * @package ContentControl
+ */
+class QueryPosts extends Controller {
+
+	/**
+	 * Initiate functionality.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		// We delay this until functions.php is loaded, so that users can use the content_control/query_filter_init_hook filter.
+		// The assumption is that most code should be registered by init 999999, so we'll use that as the default.
+		add_action( 'init', [ $this, 'register_hooks' ], 999999 );
+	}
+
+	/**
+	 * Register hooks.
+	 *
+	 * @return void
+	 */
+	public function register_hooks() {
+		/**
+		 * Use this filter to change the hook used to add query post filtering.
+		 *
+		 * This only applies to alternate queries, not the main query, and is used for removing
+		 * posts from the query that are restricted.
+		 *
+		 * - Register earlier for more restriction coverage.
+		 * - Register later for more compatibility with other plugins that late register post types.
+		 *
+		 * @param null|string $init_hook The hook to use to add the query post filtering.
+		 * @return null|string The hook to use, should be: wp_loaded, or maybe even parse_query or wp (if you know what you're doing).
+		 */
+		$init_hook = apply_filters( 'content_control/query_filter_init_hook', null );
+
+		/**
+		 * Use this filter to change the priority used to add query post filtering.
+		 *
+		 * @param int $init_priority The priority to use to add the query post filtering.
+		 * @return int The priority to use. Default: 999.
+		 */
+		$init_priority = apply_filters( 'content_control/query_filter_init_priority', 999 );
+
+		if ( is_null( $init_hook ) || ! did_action( $init_hook ) ) {
+			// If the user has not specified a hook, we'll use the default (now).
+			$this->enable_query_filtering();
+			return;
+		}
+
+		add_action( (string) $init_hook, [ $this, 'enable_query_filtering' ], (int) $init_priority );
+	}
+
+	/**
+	 * Late hooks.
+	 *
+	 * @return void
+	 */
+	public function enable_query_filtering() {
+		add_filter( 'the_posts', [ $this, 'restrict_query_posts' ], 10, 2 );
+	}
+
+	/**
+	 * Handle restricted content appropriately.
+	 *
+	 * NOTE. This is only for filtering posts, and should not
+	 *       be used to redirect or replace the entire page.
+	 *
+	 * @param \WP_Post[] $posts Array of post objects.
+	 * @param \WP_Query  $query The WP_Query instance (passed by reference).
+	 *
+	 * @return \WP_Post[]
+	 */
+	public function restrict_query_posts( $posts, $query ) {
+		if ( query_can_be_ignored( $query ) ) {
+			return $posts;
+		}
+
+		if ( protection_is_disabled() ) {
+			return $posts;
+		}
+
+		$post_restrictions = get_restriction_matches_for_queried_posts( $query );
+
+		if ( false === $post_restrictions ) {
+			return $posts;
+		}
+
+		// If we have restrictions on the queried posts, handle them top down.
+		foreach ( $post_restrictions as $match ) {
+			$post_id     = $match['post_ids'];
+			$restriction = $match['restriction'];
+
+			/**
+			 * Use this filter to prevent a post from being restricted, or to handle it yourself.
+			 *
+			 * @param null|mixed                              $pre         Whether to prevent the post from being restricted.
+			 * @param null|\ContentControl\Models\Restriction $restriction Restriction object.
+			 * @param int[]                                   $post_id     Post ID.
+			 * @return null|mixed
+			 */
+			if ( null !== apply_filters( 'content_control/pre_restrict_archive_post', null, $restriction, $post_id ) ) {
+				continue;
+			}
+
+			/**
+			 * Fires when a post is restricted, but before the restriction is handled.
+			 *
+			 * @param \ContentControl\Models\Restriction $restriction Restriction object.
+			 * @param int[]                          $post_id     Post ID.
+			 */
+			do_action( 'content_control/restrict_archive_post', $restriction, $post_id );
+
+			$handling = $query->is_main_query() ? $restriction->get_setting( 'archiveHandling' ) : $restriction->get_setting( 'additionalQueryHandling' );
+
+			switch ( $handling ) {
+				case 'filter_post_content':
+					// Filter the title/excerpt/contents of the restricted items.
+					break;
+				case 'hide':
+					foreach ( $posts as $key => $post ) {
+						if ( in_array( $post->ID, $post_id, true ) ) {
+							unset( $posts[ $key ] );
+						}
+					}
+
+					// Update the query's post count.
+					$query->post_count = count( $posts );
+					// Reset post indexes.
+					$posts = array_values( $posts );
+					break;
+			}
+		}
+
+		return $posts;
+	}
+}

+<?php
+/**
+ * Frontend query post restrictions.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Frontend\Restrictions;
+
+use ContentControl\Base\Controller;
+
+use function ContentControl\query_can_be_ignored;
+use function ContentControl\protection_is_disabled;
+use function ContentControl\get_restriction_matches_for_queried_terms;
+use function ContentControl\is_rest;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class for handling global restrictions of the query posts.
+ *
+ * @package ContentControl
+ */
+class QueryTerms extends Controller {
+
+	/**
+	 * Initiate functionality.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		// We delay this until functions.php is loaded, so that users can use the content_control/query_filter_init_hook filter.
+		// The assumption is that most code should be registered by init 999999, so we'll use that as the default.
+		add_action( 'init', [ $this, 'register_hooks' ], 999999 );
+	}
+
+	/**
+	 * Register hooks.
+	 *
+	 * @return void
+	 */
+	public function register_hooks() {
+		/**
+		 * Use this filter to change the hook used to add query post filtering.
+		 *
+		 * This only applies to alternate queries, not the main query, and is used for removing
+		 * posts from the query that are restricted.
+		 *
+		 * - Register earlier for more restriction coverage.
+		 * - Register later for more compatibility with other plugins that late register post types.
+		 *
+		 * @param null|string $init_hook The hook to use to add the query post filtering.
+		 * @return null|string The hook to use, should be: wp_loaded, or maybe even parse_query or wp (if you know what you're doing).
+		 */
+		$init_hook = apply_filters( 'content_control/query_filter_init_hook', null );
+
+		/**
+		 * Use this filter to change the priority used to add query post filtering.
+		 *
+		 * @param int $init_priority The priority to use to add the query post filtering.
+		 * @return int The priority to use. Default: 999.
+		 */
+		$init_priority = apply_filters( 'content_control/query_filter_init_priority', 999 );
+
+		if ( is_null( $init_hook ) || ! did_action( $init_hook ) ) {
+			// If the user has not specified a hook, we'll use the default (now).
+			$this->enable_query_filtering();
+			return;
+		}
+
+		add_action( (string) $init_hook, [ $this, 'enable_query_filtering' ], (int) $init_priority );
+	}
+
+	/**
+	 * Late hooks.
+	 *
+	 * @return void
+	 */
+	public function enable_query_filtering() {
+		add_filter( 'get_terms', [ $this, 'restrict_query_terms' ], 10, 4 );
+	}
+
+	/**
+	 * Handle restricted content appropriately.
+	 *
+	 * NOTE. This is only for filtering terms, and should not
+	 *       be used to redirect or replace the entire page.
+	 *
+	 * @param \WP_Term[]          $terms      Array of terms to filter.
+	 * @param string              $taxonomy   The taxonomy.
+	 * @param array<string,mixed> $query_vars Array of query vars.
+	 * @param \WP_Term_Query      $query The WP_Query instance (passed by reference).
+	 *
+	 * @return \WP_Term[]
+	 */
+	public function restrict_query_terms( $terms, $taxonomy, $query_vars, $query ) {
+		if ( query_can_be_ignored( $query ) ) {
+			return $terms;
+		}
+
+		if ( protection_is_disabled() ) {
+			return $terms;
+		}
+
+		$term_restrictions = get_restriction_matches_for_queried_terms( $query );
+
+		if ( false === $term_restrictions ) {
+			return $terms;
+		}
+
+		// If we have restrictions on the queried terms, handle them top down.
+		foreach ( $term_restrictions as $match ) {
+			$term_id     = $match['term_ids'];
+			$restriction = $match['restriction'];
+
+			/**
+			 * Use this filter to prevent a term from being restricted, or to handle it yourself.
+			 *
+			 * @param null|mixed                              $pre         Whether to prevent the term from being restricted.
+			 * @param null|\ContentControl\Models\Restriction $restriction Restriction object.
+			 * @param int[]                                   $term_id     Term ID.
+			 * @return null|mixed
+			 */
+			if ( null !== apply_filters( 'content_control/pre_restrict_archive_term', null, $restriction, $term_id ) ) {
+				continue;
+			}
+
+			/**
+			 * Fires when a term is restricted, but before the restriction is handled.
+			 *
+			 * @param \ContentControl\Models\Restriction $restriction Restriction object.
+			 * @param int[]                          $term_id     Perm ID.
+			 */
+			do_action( 'content_control/restrict_archive_term', $restriction, $term_id );
+
+			$handling = $restriction->get_setting( 'additionalQueryHandling' );
+
+			switch ( $handling ) {
+				case 'hide':
+					foreach ( $terms as $key => $term ) {
+						if ( in_array( $term->term_id, $term_id, true ) ) {
+							unset( $terms[ $key ] );
+						}
+					}
+
+					// Reset term indexes.
+					$query->terms = array_values( $terms );
+					break;
+			}
+		}
+
+		return $terms;
+	}
+}

+<?php
+/**
+ * Frontend Rest API query restrictions.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Frontend\Restrictions;
+
+use ContentControl\Base\Controller;
+
+use function ContentControl\content_is_restricted;
+use function ContentControl\protection_is_disabled;
+use function ContentControl\get_applicable_restriction;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class for handling global restrictions of the Rest API.
+ *
+ * @package ContentControl
+ */
+class RestAPI extends Controller {
+
+	/**
+	 * Initiate functionality.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_filter( 'rest_pre_dispatch', [ $this, 'pre_dispatch' ], 1, 3 );
+	}
+
+	/**
+	 * Handle a restriction on the rest api via pre_dispatch.
+	 *
+	 * @param mixed $result  Response to replace the requested resource with. Can be anything a normal endpoint can return, or null to not hijack the request.
+	 * @param mixed $server  Server instance.
+	 * @param mixed $request Request used to generate the response.
+	 *
+	 * @return mixed
+	 */
+	public function pre_dispatch( $result, $server, $request ) { // phpcs:ignore
+		if ( protection_is_disabled() ) {
+			return $result;
+		}
+
+		if ( content_is_restricted() ) {
+			$restriction = get_applicable_restriction();
+
+			/**
+			 * Fires when a post is restricted, but before the restriction is handled.
+			 *
+			 * @param \ContentControl\Models\Restriction $restriction Restriction object.
+			 */
+			do_action( 'content_control/restrict_rest_query', $restriction );
+
+			$method = $restriction->get_setting( 'restApiQueryHandling', 'forbidden' );
+
+			switch ( $method ) {
+				// If we got here, the default is to return a rest_forbidden response.
+				case 'forbidden':
+					// Mimic a rest_forbidden response.
+					return new \WP_Error(
+						'rest_forbidden',
+						$restriction->get_setting( 'restApiQueryMessage', __( 'You do not have permission to do this.', 'content-control' ), ),
+						[ 'status' => 403 ]
+					);
+			}
+		}
+
+		return $result;
+	}
+}

+<?php
+/**
+ * Frontend feed setup.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers\Frontend;
+
+defined( 'ABSPATH' ) || exit;
+
+use ContentControl\Base\Controller;
+
+use WP_Customize_Manager;
+
+use function ContentControl\is_rest;
+use function ContentControl\protection_is_disabled;
+use function ContentControl\user_meets_requirements;
+use function ContentControl\Widgets\get_options as get_widget_options;
+
+/**
+ * Class ContentControl\Frontend\Widgets
+ */
+class Widgets extends Controller {
+
+	/**
+	 * Initialize Widgets Frontend.
+	 */
+	public function init() {
+		add_filter( 'sidebars_widgets', [ $this, 'exclude_widgets' ] );
+	}
+
+	/**
+	 * Checks for and excludes widgets based on their chosen options.
+	 *
+	 * @param array<string,array<string>> $widget_areas An array of widget areas and their widgets.
+	 *
+	 * @return array<string,array<string>> The modified $widget_area array.
+	 */
+	public function exclude_widgets( $widget_areas ) {
+		if ( is_rest() || protection_is_disabled() || $this->is_customize_preview() ) {
+			return $widget_areas;
+		}
+
+		foreach ( $widget_areas as $widget_area => $widgets ) {
+			if ( ! empty( $widgets ) && 'wp_inactive_widgets' !== $widget_area ) {
+				foreach ( $widgets as $position => $widget_id ) {
+					$options = get_widget_options( $widget_id );
+
+					// If no options, then skip this one.
+					if ( empty( $options['which_users'] ) ) {
+						continue;
+					}
+
+					// If not accessible then exclude this item.
+
+					/**
+					 * Filter whether to exclude a widget.
+					 *
+					 * @param bool   $exclude   Whether to exclude the widget.
+					 * @param array  $options   Widget options.
+					 * @param string $widget_id Widget ID.
+					 *
+					 * @return bool
+					 */
+					$exclude = apply_filters(
+						'content_control/should_exclude_widget',
+						! user_meets_requirements( $options['which_users'], $options['roles'] ),
+						$options,
+						$widget_id
+					);
+
+					// unset non-visible item.
+					if ( $exclude ) {
+						unset( $widget_areas[ $widget_area ][ $position ] );
+					}
+				}
+			}
+		}
+
+		return $widget_areas;
+	}
+
+	/**
+	 * Is customizer.
+	 *
+	 * @return boolean
+	 */
+	public function is_customize_preview() {
+		global $wp_customize;
+
+		return ( $wp_customize instanceof WP_Customize_Manager ) && $wp_customize->is_preview();
+	}
+}

+<?php
+/**
+ * Post type setup.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+
+/**
+ * Post type controller.
+ */
+class PostTypes extends Controller {
+
+	/**
+	 * Init controller.
+	 *
+	 * @return void
+	 */
+	public function init() {
+		add_action( 'init', [ $this, 'register_post_type' ] );
+		add_action( 'init', [ $this, 'register_rest_fields' ] );
+		add_action( 'save_post_cc_restriction', [ $this, 'save_post' ], 10, 3 );
+		add_filter( 'rest_pre_dispatch', [ $this, 'rest_pre_dispatch' ], 10, 3 );
+		add_filter( 'content_control/sanitize_restriction_settings', [ $this, 'sanitize_restriction_settings' ], 10, 2 );
+		add_filter( 'content_control/validate_restriction_settings', [ $this, 'validate_restriction_settings' ], 10, 2 );
+	}
+
+	/**
+	 * Register `restriction` post type.
+	 *
+	 * @return void
+	 */
+	public function register_post_type() {
+		/**
+		 * Post Type: Restrictions.
+		 */
+		$labels = [
+			'name'          => __( 'Restrictions', 'content-control' ),
+			'singular_name' => __( 'Restriction', 'content-control' ),
+		];
+
+		$args = [
+			'label'               => __( 'Restrictions', 'content-control' ),
+			'labels'              => $labels,
+			'description'         => '',
+			'public'              => false,
+			'publicly_queryable'  => false,
+			'show_ui'             => false,
+			'show_in_rest'        => true,
+			'rest_base'           => 'restrictions',
+			'rest_namespace'      => 'content-control/v2',
+			'has_archive'         => false,
+			'show_in_menu'        => false,
+			'show_in_nav_menus'   => false,
+			'delete_with_user'    => false,
+			'exclude_from_search' => true,
+			'map_meta_cap'        => true,
+			'hierarchical'        => false,
+			'can_export'          => true,
+			'rewrite'             => false,
+			'query_var'           => false,
+			'supports'            => [
+				'title',
+				'excerpt',
+				// 'editor',
+			],
+			'show_in_graphql'     => false,
+			'capabilities'        => [
+				'create_posts' => $this->container->get_permission( 'edit_restrictions' ),
+				'edit_posts'   => $this->container->get_permission( 'edit_restrictions' ),
+				'delete_posts' => $this->container->get_permission( 'edit_restrictions' ),
+			],
+		];
+
+		register_post_type( 'cc_restriction', $args );
+	}
+
+	/**
+	 * Registers custom REST API fields for cc_restrictions post type.
+	 *
+	 * @return void
+	 */
+	public function register_rest_fields() {
+		register_rest_field( 'cc_restriction', 'settings', [
+			'get_callback'        => function ( $obj, $field, $request ) {
+				$settings = get_post_meta( $obj['id'], 'restriction_settings', true );
+
+				// Backfill from content if empty.
+				if ( empty( $settings['customMessage'] ) ) {
+					$settings['customMessage'] = get_post_field( 'post_content', $obj['id'], 'raw' );
+				}
+
+				if ( ! empty( $settings['customMessage'] ) ) {
+					// Change output based on context.
+					$settings['customMessage'] = 'edit' === $request->get_param( 'context' ) ?
+						sanitize_post_field( 'post_content', $settings['customMessage'], $obj['id'], 'raw' ) :
+						sanitize_post_field( 'post_content', $settings['customMessage'], $obj['id'], 'display' );
+				}
+
+				return $settings;
+			},
+			'update_callback'     => function ( $value, $obj ) {
+				$custom_message = ! empty( $value['customMessage'] ) ? $value['customMessage'] : '';
+
+				// Save custom message to restriction content for now.
+				wp_update_post( [
+					'ID'           => $obj->ID,
+					'post_content' => $custom_message,
+				] );
+
+				// Update the field/meta value.
+				update_post_meta( $obj->ID, 'restriction_settings', $value );
+			},
+			'schema'              => [
+				'type'        => 'object',
+				'arg_options' => [
+					'sanitize_callback' => function ( $settings, $request ) {
+						/**
+						 * Sanitize the restriction settings.
+						 *
+						 * @param array<string,mixed> $settings The settings to sanitize.
+						 * @param int   $id       The restriction ID.
+						 * @param \WP_REST_Request $request The request object.
+						 *
+						 * @return array<string,mixed> The sanitized settings.
+						 */
+						return apply_filters( 'content_control/sanitize_restriction_settings', $settings, $request->get_param( 'id' ), $request );
+					},
+					'validate_callback' => function ( $settings, $request ) {
+						/**
+						 * Validate the restriction settings.
+						 *
+						 * @param array<string,mixed> $settings The settings to validate.
+						 * @param int   $id       The restriction ID.
+						 * @param \WP_REST_Request $request The request object.
+						 *
+						 * @return bool|\WP_Error True if valid, WP_Error if not.
+						 */
+						return apply_filters( 'content_control/validate_restriction_settings', $settings, $request->get_param( 'id' ), $request );
+					},
+				],
+			],
+			'permission_callback' => function () {
+				return current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
+			},
+		] );
+
+		register_rest_field( 'cc_restriction', 'priority', [
+			'get_callback'        => function ( $obj ) {
+				return (int) get_post_field( 'menu_order', $obj['id'], 'raw' );
+			},
+			'update_callback'     => function ( $value, $obj ) {
+				wp_update_post( [
+					'ID'         => $obj->ID,
+					'menu_order' => $value,
+				] );
+			},
+			'permission_callback' => function () {
+				return current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
+			},
+			'schema'              => [
+				'type'        => 'integer',
+				'arg_options' => [
+					'sanitize_callback' => function ( $priority ) {
+						return absint( $priority );
+					},
+					'validate_callback' => function ( $priority ) {
+						return is_int( $priority );
+					},
+				],
+			],
+		] );
+
+		register_rest_field( 'cc_restriction', 'data_version', [
+			'get_callback'        => function ( $obj ) {
+				return get_post_meta( $obj['id'], 'data_version', true );
+			},
+			'update_callback'     => function ( $value, $obj ) {
+				// Update the field/meta value.
+				update_post_meta( $obj->ID, 'data_version', $value );
+			},
+			'permission_callback' => function () {
+				return current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
+			},
+		] );
+	}
+
+	/**
+	 * Sanitize restriction settings.
+	 *
+	 * @param array<string,mixed> $settings The settings to sanitize.
+	 * @param int                 $id       The restriction ID.
+	 *
+	 * @return array<string,mixed> The sanitized settings.
+	 */
+	public function sanitize_restriction_settings( $settings, $id ) {
+
+		// Sanitize custom message.
+		if ( ! empty( $settings['customMessage'] ) ) {
+			$settings['customMessage'] = sanitize_post_field( 'post_content', $settings['customMessage'], $id, 'db' );
+		}
+
+		return $settings;
+	}
+
+	/**
+	 * Validate restriction settings.
+	 *
+	 * @param array<string,mixed> $settings The settings to validate.
+	 * @param int                 $id       The restriction ID.
+	 *
+	 * @return bool|\WP_Error True if valid, WP_Error if not.
+	 */
+	public function validate_restriction_settings( $settings, $id ) {
+		// TODO Validate all known settings by type.
+		return true;
+	}
+
+
+	/**
+	 * Add data version meta to new restrictions.
+	 *
+	 * @param int      $post_id Post ID.
+	 * @param \WP_Post $post    Post object.
+	 * @param bool     $update  Whether this is an existing post being updated or not.
+	 *
+	 * @return void
+	 */
+	public function save_post( $post_id, $post, $update ) {
+		if ( $update ) {
+			return;
+		}
+
+		add_post_meta( $post_id, 'data_version', 1 );
+	}
+
+	/**
+	 * Prevent access to restrictions endpoint.
+	 *
+	 * @param mixed                                 $result Response to replace the requested version with.
+	 * @param \WP_REST_Server                       $server Server instance.
+	 * @param \WP_REST_Request<array<string,mixed>> $request  Request used to generate the response.
+	 * @return mixed
+	 */
+	public function rest_pre_dispatch( $result, $server, $request ) {
+		// Get the route being requested.
+		$route = $request->get_route();
+
+		// Only proceed if we're creating a user.
+		if ( false === strpos( $route, '/content-control/v2/restrictions' ) ) {
+			return $result;
+		}
+
+		$current_user_can = current_user_can( $this->container->get_permission( 'edit_restrictions' ) );
+
+		// Prevent discovery of the endpoints data from unauthorized users.
+		if ( ! $current_user_can ) {
+			return new \WP_Error(
+				'rest_forbidden',
+				__( 'Access to this endpoint requires authorization.', 'content-control' ),
+				[
+					'status' => rest_authorization_required_code(),
+				]
+			);
+		}
+
+		// Return data to the client to parse.
+		return $result;
+	}
+}

+<?php
+/**
+ * RestAPI blocks setup.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+defined( 'ABSPATH' ) || exit;
+
+use ContentControl\Base\Controller;
+
+/**
+ * RestAPI function initialization.
+ */
+class RestAPI extends Controller {
+	/**
+	 * Initiate rest api integrations.
+	 */
+	public function init() {
+		add_action( 'rest_api_init', [ $this, 'register_routes' ] );
+	}
+
+	/**
+	 * Register Rest API routes.
+	 *
+	 * @return void
+	 */
+	public function register_routes() {
+		( new \ContentControl\RestAPI\BlockTypes() )->register_routes();
+		( new \ContentControl\RestAPI\License() )->register_routes();
+		( new \ContentControl\RestAPI\ObjectSearch() )->register_routes();
+		( new \ContentControl\RestAPI\Settings() )->register_routes();
+	}
+}

+<?php
+/**
+ * Shortcode setup.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+
+use function ContentControl\user_meets_requirements;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class Shortcodes
+ *
+ * @package ContentControl
+ */
+class Shortcodes extends Controller {
+
+	/**
+	 * Initialize Widgets
+	 */
+	public function init() {
+		add_shortcode( 'content_control', [ $this, 'content_control' ] );
+	}
+
+	/**
+	 * Process the [content_control] shortcode.
+	 *
+	 * @param array<string,string|int|null> $atts Array or shortcode attributes.
+	 * @param string                        $content Content inside shortcode.
+	 *
+	 * @return string
+	 */
+	public function content_control( $atts, $content = '' ) {
+		// Deprecated.
+		$deprecated_atts = shortcode_atts( [
+			'logged_out' => null, // @deprecated 2.0.
+			'roles'      => null, // @deprecated 2.0.
+		], $atts );
+
+		$atts = shortcode_atts( [
+			'status'         => 'logged_in', // 'logged_in' or 'logged_out
+			'allowed_roles'  => null,
+			'excluded_roles' => null,
+			'class'          => '',
+			'message'        => $this->container->get_option( 'defaultDenialMessage', '' ),
+		], $this->normalize_empty_atts( $atts ), 'content_control' );
+
+		// Handle old args.
+		if ( isset( $deprecated_atts['logged_out'] ) ) {
+			$atts['status'] = (bool) $deprecated_atts['logged_out'] ? 'logged_out' : 'logged_in';
+		}
+
+		if ( isset( $deprecated_atts['roles'] ) && ! empty( $deprecated_atts['roles'] ) ) {
+			$atts['allowed_roles'] = $deprecated_atts['roles'];
+		}
+
+		$user_roles = [];
+		$match_type = 'any';
+
+		// Normalize args.
+		if ( ! empty( $atts['excluded_roles'] ) ) {
+			$user_roles = $atts['excluded_roles'];
+			$match_type = 'exclude';
+		} elseif ( ! empty( $atts['allowed_roles'] ) ) {
+			$user_roles = $atts['allowed_roles'];
+			$match_type = 'match';
+		}
+
+		// Convert classes to array.
+		$classes = ! empty( $atts['class'] ) ? explode( ' ', $atts['class'] ) : [];
+
+		$classes[] = 'content-control-container';
+		// @deprecated 2.0.0
+		$classes[] = 'jp-cc';
+
+		if ( user_meets_requirements( $atts['status'], $user_roles, $match_type ) ) {
+			$classes[] = 'content-control-accessible';
+			// @deprecated 2.0.0
+			$classes[] = 'jp-cc-accessible';
+			$container = '<div class="%1$s">%2$s</div>';
+		} else {
+			$classes[] = 'content-control-not-accessible';
+			// @deprecated 2.0.0
+			$classes[] = 'jp-cc-not-accessible';
+			$container = '<div class="%1$s">%3$s</div>';
+		}
+
+		$classes = implode( ' ', $classes );
+
+		return sprintf( $container, esc_attr( $classes ), do_shortcode( $content ), do_shortcode( $atts['message'] ) );
+	}
+
+	/**
+	 * Takes set but empty attributes and sets them to true.
+	 *
+	 * These are typically valueless boolean attributes.
+	 *
+	 * @param array<string|int,string|int|null> $atts Array of shortcode attributes.
+	 *
+	 * @return (int|null|string|true)[]
+	 *
+	 * @psalm-return array<int|string, int|null|string|true>
+	 */
+	public function normalize_empty_atts( $atts = [] ) {
+		if ( ! is_array( $atts ) || empty( $atts ) ) {
+			$atts = [];
+		}
+
+		foreach ( $atts as $attribute => $value ) {
+			if ( is_int( $attribute ) ) {
+				$atts[ strtolower( $value ) ] = true;
+				unset( $atts[ $attribute ] );
+			}
+		}
+
+		return $atts;
+	}
+}

+<?php
+/**
+ * TrustedLogin.
+ *
+ * @copyright (c) 2023, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Controllers;
+
+use ContentControl\Base\Controller;
+use ContentControl\Vendor\TrustedLogin\Client;
+use ContentControl\Vendor\TrustedLogin\Config;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * TrustedLogin.
+ *
+ * @package ContentControl
+ */
+class TrustedLogin extends Controller {
+
+	/**
+	 * TrustedLogin init.
+	 */
+	public function init() {
+		$this->hooks();
+
+		$config = [
+			'auth'        => [
+				'api_key'     => 'f97f5be6e02d1565',
+				'license_key' => $this->container->get( 'license' )->get_license_key(),
+			],
+			'vendor'      => [
+				'namespace'    => 'content-control',
+				'title'        => 'Content Control',
+				'display_name' => 'Content Control Support',
+				'logo_url'     => $this->container->get_url( 'assets/images/logo.svg' ),
+				'email'        => 'support+{hash}@contentcontrolplugin.com',
+				'website'      => 'https://contentcontrolplugin.com?utm_campaign=grant-access&utm_source=plugin-settings-page&utm_medium=plugin-ui&utm_content=grant-access-title-link',
+				'support_url'  => 'https://contentcontrolplugin.com/support/?utm_campaign=grant-access&utm_source=plugin-settings-page&utm_medium=plugin-ui&utm_content=support-footer-link',
+			],
+			'role'        => 'administrator',
+			'caps'        => [
+				'add'    => [
+					$this->container->get_permission( 'manage_settings' ) => __( 'This allows us to check your global restrictions and plugin settings.', 'content-control' ),
+					$this->container->get_permission( 'edit_block_controls' ) => __( 'This allows us to check your block control settings.', 'content-control' ),
+				],
+				'remove' => [
+					'delete_published_pages' => 'Your published posts cannot and will not be deleted by support staff',
+					'manage_woocommerce'     => 'We don\'t need to manage your shop!',
+				],
+			],
+			'decay'       => WEEK_IN_SECONDS,
+			'menu'        => [
+				'slug' => false,
+			],
+			'logging'     => [
+				'enabled' => false,
+			],
+			'require_ssl' => false,
+			'webhook'     => [
+				'url'           => null,
+				'debug_data'    => false,
+				'create_ticket' => false,
+			],
+			'paths'       => [
+				'js'  => $this->container->get_url( 'vendor-prefixed/trustedlogin/client/src/assets/trustedlogin.js' ),
+				'css' => $this->container->get_url( 'dist/settings-page.css' ),
+			],
+		];
+
+		try {
+			new Client(
+				new Config( $config )
+			);
+		} catch ( \Exception $exception ) {
+			// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+			\error_log( $exception->getMessage() );
+		}
+	}
+
+	/**
+	 * Hooks.
+	 *
+	 * @return void
+	 */
+	public function hooks() {
+		add_action( 'admin_menu', [ $this, 'admin_menu' ] );
+	}
+
+	/**
+	 * Admin menu.
+	 *
+	 * @return void
+	 */
+	public function admin_menu() {
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
+		if ( ! isset( $_GET['page'] ) || 'grant-content-control-access' !== $_GET['page'] ) {
+			return;
+		}
+
+		add_options_page(
+			__( 'Content Control Support Access', 'content-control' ),
+			__( 'Content Control Support Access', 'content-control' ),
+			$this->container->get_permission( 'manage_settings' ),
+			'grant-content-control-access',
+			function () {
+				// phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+				do_action( 'trustedlogin/content-control/auth_screen' );
+			}
+		);
+	}
+}

+<?php
+/**
+ * Install_Skin class.
+ *
+ * @package ContentControl
+ * @subpackage Installers
+ * @since 2.0.0
+ */
+
+namespace ContentControl\Installers;
+
+/**
+ * Skin for on-the-fly addon installations.
+ *
+ * @since 1.0.0
+ * @since 2.0.0 Extend PluginSilentUpgraderSkin and clean up the class.
+ */
+class Install_Skin extends PluginSilentUpgraderSkin {
+
+	/**
+	 * Instead of outputting HTML for errors, json_encode the errors and send them
+	 * back to the Ajax script for processing.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string|\WP_Error $errors Array of errors with the install process.
+	 */
+	public function error( $errors ) {
+		if ( ! empty( $errors ) ) {
+			return wp_send_json_error( $errors );
+		}
+
+		return $errors;
+	}
+}

+<?php
+/**
+ * PluginSilentUpgraderSkin class.
+ *
+ * @package ContentControl
+ * @subpackage Installers
+ * @since 2.0.0
+ */
+
+namespace ContentControl\Installers;
+
+/** \WP_Upgrader_Skin class */
+require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader-skin.php';
+
+/**
+ * Class PluginSilentUpgraderSkin.
+ *
+ * @internal Please do not use this class outside of core plugin development. May be removed at any time.
+ *
+ * @since 2.0.0
+ */
+class PluginSilentUpgraderSkin extends \WP_Upgrader_Skin {
+
+	/**
+	 * Empty out the header of its HTML content and only check to see if it has
+	 * been performed or not.
+	 *
+	 * @return void
+	 */
+	public function header() {
+	}
+
+	/**
+	 * Empty out the footer of its HTML contents.
+	 *
+	 * @return void
+	 */
+	public function footer() {
+	}
+
+	/**
+	 * Instead of outputting HTML for errors, just return them.
+	 * Ajax request will just ignore it.
+	 *
+	 * @param string|\WP_Error $errors Array of errors with the install process.
+	 *
+	 * @return string|\WP_Error
+	 */
+	public function error( $errors ) {
+		return $errors;
+	}
+
+	/**
+	 * Empty out JavaScript output that calls function to decrement the update counts.
+	 *
+	 * @param string $type Type of update count to decrement.
+	 *
+	 * @return void
+	 */
+	public function decrement_update_count( $type ) {
+	}
+}

+<?php
+/**
+ * Plugin container.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Interfaces;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Localized controller class.
+ */
+interface Controller {
+
+	/**
+	 * Handle hooks & filters or various other init tasks.
+	 *
+	 * @return void
+	 */
+	public function init();
+
+	/**
+	 * Check if controller is enabled.
+	 *
+	 * @return bool
+	 */
+	public function controller_enabled();
+}

+<?php
+/**
+ * Plugin upgrade.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ *
+ * @package ContentControl
+ */
+
+namespace ContentControl\Interfaces;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Localized controller class.
+ */
+interface Upgrade {
+
+	/**
+	 * Return label for this upgrade.
+	 *
+	 * @return string
+	 */
+	public function label();
+
+	/**
+	 * Return full description for this upgrade.
+	 *
+	 * @return string
+	 */
+	public function description();
+
+	/**
+	 * Check if this upgrade is required.
+	 *
+	 * @return bool
+	 */
+	public function is_required();
+
+	/**
+	 * Check if prerequisites are met.
+	 *
+	 * @return bool
+	 */
+	public function prerequisites_met();
+
+	/**
+	 * Run the upgrade.
+	 *
+	 * @return void|\WP_Error|false
+	 */
+	public function run();
+}

+<?php
+/**
+ * Restriction model.
+ *
+ * @package ContentControl\RuleEngine
+ * @subpackage Models
+ */
+
+namespace ContentControl\Models;
+
+use ContentControl\Models\RuleEngine\Query;
+
+use function ContentControl\fetch_key_from_array;
+use function ContentControl\get_default_restriction_settings;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Model for restriction sets.
+ *
+ * @version 3.0.0
+ * @since   2.1.0
+ *
+ * @package ContentControl\Models
+ */
+class Restriction {
+
+	/**
+	 * Current model version.
+	 *
+	 * @var int
+	 */
+	const MODEL_VERSION = 3;
+
+	/**
+	 * Post object.
+	 *
+	 * @var \WP_Post
+	 */
+	private $post;
+
+	/**
+	 * Restriction id.
+	 *
+	 * @var int
+	 */
+	public $id = 0;
+
+	/**
+	 * Restriction slug.
+	 *
+	 * @var string
+	 */
+	public $slug;
+
+	/**
+	 * Restriction label.
+	 *
+	 * @var string
+	 */
+	public $title;
+
+	/**
+	 * Restriction description.
+	 *
+	 * @var string|null
+	 */
+	public $description;
+
+	/**
+	 * Restriction Message.
+	 *
+	 * @var string|null
+	 */
+	public $message;
+
+	/**
+	 * Restriction status.
+	 *
+	 * @var string
+	 */
+	public $status;
+
+	/**
+	 * Restriction priority.
+	 *
+	 * @var int
+	 */
+	public $priority;
+
+	/**
+	 * Restriction Condition Query.
+	 *
+	 * @var Query
+	 */
+	public $query;
+
+	/**
+	 * Restriction Settings.
+	 *
+	 * @var array<string,mixed>
+	 */
+	public $settings;
+
+	/**
+	 * Data version.
+	 *
+	 * @var int
+	 */
+	public $data_version;
+
+	/**
+	 * Build a restriction.
+	 *
+	 * @param \WP_Post|array<string,mixed> $restriction Restriction data.
+	 */
+	public function __construct( $restriction ) {
+		if ( ! is_a( $restriction, '\WP_Post' ) ) {
+			$this->setup_v1_restriction( $restriction );
+		} else {
+			$this->post = $restriction;
+
+			/**
+			 * Restriction settings.
+			 *
+			 * @var array<string,mixed>|false $settings
+			 */
+			$settings = get_post_meta( $restriction->ID, 'restriction_settings', true );
+
+			if ( ! $settings ) {
+				$settings = [];
+			}
+
+			$settings = wp_parse_args(
+				$settings,
+				get_default_restriction_settings()
+			);
+
+			$this->settings = $settings;
+
+			$properties = [
+				'id'          => $restriction->ID,
+				'slug'        => $restriction->post_name,
+				'title'       => $restriction->post_title,
+				'status'      => $restriction->post_status,
+				'priority'    => $restriction->menu_order,
+				// We set this late.. on first use.
+				'description' => null,
+				'message'     => null,
+			];
+
+			foreach ( $properties as $key => $value ) {
+				$this->$key = $value;
+			}
+
+			$this->data_version = get_post_meta( $restriction->ID, 'data_version', true );
+
+			if ( ! $this->data_version ) {
+				$this->data_version = 2;
+				update_post_meta( $restriction->ID, 'data_version', 2 );
+			}
+
+			$this->query = new Query( $this->get_setting( 'conditions' ) );
+		}
+	}
+
+	/**
+	 * Map old v1 restriction to new v2 restriction object.
+	 *
+	 * @param array<string,mixed> $restriction Restriction data.
+	 *
+	 * @return void
+	 */
+	public function setup_v1_restriction( $restriction ) {
+		static $index = 0;
+
+		$restriction = \wp_parse_args( $restriction, [
+			'title'                    => '',
+			'who'                      => '',
+			'roles'                    => [],
+			'protection_method'        => 'redirect',
+			'show_excerpts'            => false,
+			'override_default_message' => false,
+			'custom_message'           => '',
+			'redirect_type'            => 'login',
+			'redirect_url'             => '',
+			'conditions'               => '',
+		] );
+
+		$this->data_version = 1;
+
+		$this->id          = 0;
+		$this->slug        = '';
+		$this->title       = $restriction['title'];
+		$this->description = '';
+		$this->status      = 'publish';
+		$this->priority    = $index;
+
+		$user_roles = is_array( $restriction['roles'] ) ? $restriction['roles'] : [];
+
+		$settings = [
+			'userStatus'              => $restriction['who'],
+			'roleMatch'               => count( $user_roles ) > 0 ? 'match' : 'any',
+			'userRoles'               => $user_roles,
+			'protectionMethod'        => 'custom_message' === $restriction['protection_method'] ? 'replace' : 'redirect',
+			'redirectType'            => $restriction['redirect_type'],
+			'redirectUrl'             => $restriction['redirect_url'],
+			'replacementType'         => 'message',
+			'replacementPage'         => 0,
+			'archiveHandling'         => 'filter_post_content',
+			'archiveReplacementPage'  => 0,
+			'archiveRedirectType'     => $restriction['redirect_type'],
+			'archiveRedirectUrl'      => $restriction['redirect_url'],
+			'additionalQueryHandling' => 'filter_post_content',
+			'overrideMessage'         => $restriction['override_default_message'],
+			'customMessage'           => $restriction['custom_message'],
+			'showExcerpts'            => $restriction['show_excerpts'],
+			'conditions'              => \ContentControl\remap_conditions_to_query( $restriction['conditions'] ),
+		];
+
+		$this->settings = $settings;
+
+		$this->query = new Query( $settings['conditions'] );
+
+		++$index;
+	}
+
+	/**
+	 * Get the restriction settings array.
+	 *
+	 * @return array<string,mixed>
+	 */
+	public function get_settings() {
+		return $this->settings;
+	}
+
+	/**
+	 * Get a restriction setting.
+	 *
+	 * Settings are stored in JS based camelCase. But WP prefers snake_case.
+	 *
+	 * This method supports camelCase based dot.notation, as well as snake_case.
+	 *
+	 * @param string $key Setting key.
+	 * @param mixed  $default_value Default value.
+	 *
+	 * @return mixed|false
+	 */
+	public function get_setting( $key, $default_value = false ) {
+		// Support camelCase, snake_case, and dot.notation.
+		// Check for camelKeys & dot.notation.
+		$value = \ContentControl\fetch_key_from_array( $key, $this->settings, 'camelCase' );
+
+		if ( null === $value ) {
+			$value = $default_value;
+		}
+
+		/**
+		 * Filter the option.
+		 *
+		 * @param mixed $value Option value.
+		 * @param string $key Option key.
+		 * @param mixed $default_value Default value.
+		 * @param int $restriction_id Restriction ID.
+		 *
+		 * @return mixed
+		 */
+		return apply_filters( 'content_control/get_restriction_setting', $value, $key, $default_value, $this->id );
+	}
+
+	/**
+	 * Check if this set has JS based rules.
+	 *
+	 * @return bool
+	 */
+	public function has_js_rules() {
+		return $this->query->has_js_rules();
+	}
+
+	/**
+	 * Check this sets rules.
+	 *
+	 * @return bool
+	 */
+	public function check_rules() {
+		if ( ! $this->query->has_rules() ) {
+			// No rules should be treated as no restrictions.
+			return false;
+		}
+
+		return $this->query->check_rules();
+	}
+
+	/**
+	 * Check if this restriction applies to the current user.
+	 *
+	 * @return bool
+	 */
+	public function user_meets_requirements() {
+		// Filter to allow override user status check early.
+		$bypass = \apply_filters( 'content_control/restriction/bypass_user_requirements', null, $this );
+
+		if ( null !== $bypass ) {
+			return $bypass;
+		}
+
+		return \ContentControl\user_meets_requirements( $this->get_setting( 'userStatus' ), $this->get_setting( 'userRoles' ), $this->get_setting( 'roleMatch' ) );
+	}
+
+	/**
+	 * Get the description for this restriction.
+	 *
+	 * @return string
+	 */
+	public function get_description() {
+		if ( ! isset( $this->description ) ) {
+			$this->description = get_the_excerpt( $this->id );
+
+			if ( empty( $this->description ) ) {
+				$this->description = __( 'This content is restricted.', 'content-control' );
+			}
+		}
+
+		return $this->description;
+	}
+
+	/**
+	 * Get the message for this restriction.
+	 *
+	 * @uses \get_the_content()
+	 * @uses \ContentControl\get_default_denial_message()
+	 *
+	 * @param string $context Context. 'display' or 'raw'.
+	 *
+	 * @return string
+	 */
+	public function get_message( $context = 'display' ) {
+		if ( ! isset( $this->message ) ) {
+			$message = '';
+
+			if ( ! empty( $this->get_setting( 'customMessage' ) ) ) {
+				$message = $this->get_setting( 'customMessage' );
+			} elseif ( ! empty( $this->post->post_content ) ) {
+				$message = 'display' === $context
+					? \get_the_content( null, false, $this->id )
+					: $this->post->post_content;
+			}
+
+			$this->message = $message;
+		}
+
+		return sanitize_post_field( 'post_content', $this->message, $this->id, $context );
+	}
+
+	/**
+	 * Whether to show excerpts for posts that are restricted.
+	 *
+	 * @return bool
+	 */
+	public function show_excerpts() {
+		return (bool) $this->get_setting( 'showExcerpts' );
+	}
+
+	/**
+	 * Check if this uses the redirect method.
+	 *
+	 * @return bool
+	 */
+	public function uses_redirect_method() {
+		return 'redirect' === $this->get_setting( 'protectionMethod' );
+	}
+
+	/**
+	 * Check if this uses the replace method.
+	 *
+	 * @return bool
+	 */
+	public function uses_replace_method() {
+		return 'replace' === $this->get_setting( 'protectionMethod' );
+	}
+
+	/**
+	 * Get edit link.
+	 *
+	 * @return string
+	 */
+	public function get_edit_link() {
+		if ( current_user_can( 'edit_post', $this->id ) ) {
+			return admin_url( 'options-general.php?page=content-control-settings&view=restrictions&edit=' . $this->id );
+		}
+
+		return '';
+	}
+
+	/**
+	 * Convert this restriction to an array.
+	 *
+	 * @return array<string,mixed>
+	 */
+	public function to_array() {
+		$settings = $this->get_settings();
+
+		return array_merge( [
+			'id'          => $this->id,
+			'slug'        => $this->slug,
+			'title'       => $this->title,
+			'description' => $this->get_description(),
+			'message'     => $this->get_message(),
+			'status'      => $this->status,
+			'priority'    => $this->priority,
+		], $settings );
+	}
+
+	/**
+	 * Convert this restriction to a v1 array.
+	 *
+	 * @return array<string,mixed>
+	 */
+	public function to_v1_array() {
+		return [
+			'id'                       => $this->id,
+			'title'                    => $this->title,
+			'who'                      => $this->get_setting( 'userStatus' ),
+			'roles'                    => $this->get_setting( 'userRoles' ),
+			'protection_method'        => $this->get_setting( 'protectionMethod' ),
+			'show_excerpts'            => $this->get_setting( 'showExcerpts' ),
+			'override_default_message' => $this->get_setting( 'overrideMessage' ),
+			'custom_message'           => $this->get_setting( 'customMessage' ),
+			'redirect_type'            => $this->get_setting( 'redirectType' ),
+			'redirect_url'             => $this->get_setting( 'redirectUrl' ),
+			'conditions'               => $this->get_setting( 'conditions' ),
+		];
+	}
+}

+<?php
+/**
+ * Rule engine group model.
+ *
+ * @package ContentControl
+ * @subpackage Models
+ */
+
+namespace ContentControl\Models\RuleEngine;
+
+/**
+ * Handler for condition groups.
+ *
+ * @package ContentControl
+ */
+class Group extends Item {
+
+	/**
+	 * Group id.
+	 *
+	 * @var string
+	 */
+	public $id;
+
+	/**
+	 * Group label.
+	 *
+	 * @var string
+	 */
+	public $label;
+
+	/**
+	 * Group query.
+	 *
+	 * @var Query
+	 */
+	public $query;
+
+	/**
+	 * Build a group.
+	 *
+	 * @param array{id:string,label:string,query:array<mixed>} $group Group data.
+	 */
+	public function __construct( $group ) {
+		$group = wp_parse_args( $group, [
+			'id'    => '',
+			'label' => '',
+			'query' => [],
+		]);
+
+		$this->id    = $group['id'];
+		$this->label = $group['label'];
+		$this->query = new Query( $group['query'] );
+	}
+
+	/**
+	 * Check if this group has JS based rules.
+	 *
+	 * @return bool
+	 */
+	public function has_js_rules() {
+		return $this->query->has_js_rules();
+	}
+
+	/**
+	 * Check this groups rules.
+	 *
+	 * @return bool
+	 */
+	public function check_rules() {
+		return $this->query->check_rules();
+	}
+
+	/**
+	 * Check this groups rules.
+	 *
+	 * @return array<bool|null|array<bool|null>>
+	 */
+	public function get_checks() {
+		return $this->query->get_checks();
+	}
+
+	/**
+	 * Return the rule check as an array of information.
+	 *
+	 * Useful for debugging.
+	 *
+	 * @return array<mixed>
+	 */
+	public function get_check_info() {
+		return $this->query->get_check_info();
+	}
+}

+<?php
+/**
+ * Rule engine item model.
+ *
+ * @package ContentControl
+ * @subpackage Models
+ */
+
+namespace ContentControl\Models\RuleEngine;
+
+/**
+ * Handler for condition items.
+ *
+ * @package ContentControl
+ */
+abstract class Item {
+
+	/**
+	 * Item id.
+	 *
+	 * @var string
+	 */
+	public $id;
+
+	/**
+	 * Return the checks as an array of information.
+	 *
+	 * Useful for debugging.
+	 *
+	 * @return array<mixed>
+	 */
+	abstract public function get_check_info();
+}

+<?php
+/**
+ * Rule engine query model.
+ *
+ * @package ContentControl
+ * @subpackage Models
+ */
+
+namespace ContentControl\Models\RuleEngine;
+
+/**
+ * Handler for condition queries.
+ *
+ * @package ContentControl
+ */
+class Query {
+
+	/**
+	 * Query logical comparison operator.
+	 *
+	 * @var string `and` | `or`
+	 */
+	public $logical_operator;
+
+	/**
+	 * Query items.
+	 *
+	 * @var Item[]
+	 */
+	public $items;
+
+	/**
+	 * Build a query.
+	 *
+	 * @param array{logicalOperator:string,items:array<mixed>} $query Query data.
+	 */
+	public function __construct( $query ) {
+		$query = wp_parse_args( $query, [
+			'logicalOperator' => 'and',
+			'items'           => [],
+		]);
+
+		$this->logical_operator = $query['logicalOperator'];
+		$this->items            = [];
+
+		foreach ( $query['items'] as $item ) {
+			$is_group = ( isset( $item['type'] ) && 'group' === $item['type'] )
+				|| isset( $item['query'] );
+
+				$this->items[] = $is_group ? new Group( $item ) : new Rule( $item );
+		}
+	}
+
+	/**
+	 * Check if this query has any rules.
+	 *
+	 * @return bool
+	 */
+	public function has_rules() {
+		return ! empty( $this->items );
+	}
+
+	/**
+	 * Check if this query has JS based rules.
+	 *
+	 * @return bool
+	 */
+	public function has_js_rules() {
+		foreach ( $this->items as $item ) {
+			if ( $item instanceof Rule ) {
+				if ( $item->is_js_rule() ) {
+					return true;
+				}
+			} elseif ( $item instanceof Group ) {
+				if ( $item->has_js_rules() ) {
+					return true;
+				}
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Check rules in a recursive nested pattern.
+	 *
+	 * @return bool
+	 */
+	public function check_rules() {
+		$checks = [];
+
+		if ( empty( $this->items ) ) {
+			return true;
+		}
+
+		foreach ( $this->items as $item ) {
+			// Missing rules should result in restricted content.
+			$result = false;
+
+			if ( $item instanceof Rule ) {
+				$result = $item->check_rule();
+			} elseif ( $item instanceof Group ) {
+				$result = $item->check_rules();
+			}
+
+			$checks[] = $result;
+
+			// Bail as early as we can.
+			if (
+				// If we have a true result and are using `or`.
+				( true === $result && 'or' === $this->logical_operator ) ||
+				// If we have a false result and are using `and`.
+				( false === $result && 'and' === $this->logical_operator )
+			) {
+				break;
+			}
+		}
+
+		/*
+		 * This method ignores null values (JS conditions),
+		 * if changed, null needs to be accounted for.
+		 */
+		if ( 'or' === $this->logical_operator ) {
+			// If any values are true or null, return true.
+			return in_array( true, $checks, true );
+		} else {
+			// If any values are false, return false.
+			return ! in_array( false, $checks, true );
+		}
+	}
+
+	/**
+	 * Return the checks as an array.
+	 *
+	 * Useful for debugging or passing to JS.
+	 *
+	 * @return array<bool|null|array<bool|null>>
+	 */
+	public function get_checks() {
+		$checks = [];
+
+		foreach ( $this->items as $item ) {
+			if ( $item instanceof Rule ) {
+				$checks[] = $item->get_check();
+			} elseif ( $item instanceof Group ) {
+				$checks[] = $item->get_checks();
+			}
+		}
+
+		return $checks;
+	}
+
+	/**
+	 * Return the checks as an array of information.
+	 *
+	 * Useful for debugging.
+	 *
+	 * @return array<mixed>
+	 */
+	public function get_check_info() {
+		$checks = [];
+
+		foreach ( $this->items as $key => $item ) {
+			$checks[ $key ] = $item->get_check_info();
+		}
+
+		return $checks;
+	}
+}

+<?php
+/**
+ * Rule engine rule model.
+ *
+ * @package ContentControl
+ * @subpackage Models
+ */
+
+namespace ContentControl\Models\RuleEngine;
+
+use function ContentControl\plugin;
+use function ContentControl\Rules\current_rule;
+
+/**
+ * Handler for condition rules.
+ *
+ * @package ContentControl
+ */
+class Rule extends Item {
+
+	/**
+	 * Unique Hash ID.
+	 *
+	 * @var string
+	 */
+	public $id;
+
+	/**
+	 * Rule name.
+	 *
+	 * @var string
+	 */
+	public $name;
+
+	/**
+	 * Rule options.
+	 *
+	 * @var array<string,mixed>
+	 */
+	public $options;
+
+	/**
+	 * Rule not operand.
+	 *
+	 * @var boolean
+	 */
+	public $not_operand;
+
+	/**
+	 * Rule extras.
+	 *
+	 * Such as post type or taxnomy like meta.
+	 *
+	 * @var array<string,mixed>
+	 */
+	public $extras = [];
+
+	/**
+	 * Rule is frontend only.
+	 *
+	 * @var boolean
+	 */
+	public $frontend_only = false;
+
+	/**
+	 * Rule definition.
+	 *
+	 * @var array<string,mixed>|null
+	 */
+	public $definition;
+
+	/**
+	 * Rule is deprecated.
+	 *
+	 * @var boolean
+	 */
+	public $deprecated = false;
+
+	/**
+	 * Build a rule.
+	 *
+	 * @param array{id:string,name:string,notOperand:bool,options:array<string,mixed>,extras:array<string,mixed>} $rule Rule data.
+	 */
+	public function __construct( $rule ) {
+		$rule = wp_parse_args( $rule, [
+			'id'         => '',
+			'name'       => '',
+			'notOperand' => false,
+			'options'    => [],
+			'extras'     => [],
+		]);
+
+		if ( isset( $rule['deprecated'] ) ) {
+			$this->deprecated = $rule['deprecated'];
+		}
+
+		$name = $rule['name'];
+
+		$this->definition = plugin( 'rules' )->get_rule( $name );
+
+		if ( ! $this->definition ) {
+			/* translators: 1. Rule name. */
+			plugin( 'logging' )->log_unique( 'ERROR: ' . sprintf( __( 'Rule `%s` not found.', 'content-control' ), $name ) );
+		}
+
+		$extras = isset( $this->definition['extras'] ) ? $this->definition['extras'] : [];
+
+		$this->id            = $rule['id'];
+		$this->name          = $name;
+		$this->not_operand   = $rule['notOperand'];
+		$this->frontend_only = isset( $this->definition['frontend'] ) ? $this->definition['frontend'] : false;
+		$this->options       = $this->parse_options( $rule['options'] );
+		$this->extras        = array_merge( $extras, $rule['extras'] );
+	}
+
+	/**
+	 * Parse rule options based on rule definitions.
+	 *
+	 * @param array<string,mixed> $options Array of rule opions.
+	 * @return array<string,mixed>
+	 */
+	public function parse_options( $options = [] ) {
+		return $options;
+	}
+
+	/**
+	 * Check the results of this rule.
+	 *
+	 * @return bool
+	 */
+	public function check_rule() {
+		if ( $this->is_js_rule() ) {
+			return true;
+		}
+
+		$check = $this->run_check();
+
+		return $this->not_operand ? ! $check : $check;
+	}
+
+	/**
+	 * Check the results of this rule.
+	 *
+	 * @return bool True if rule passes, false if not.
+	 */
+	private function run_check() {
+		$callback = isset( $this->definition['callback'] ) ? $this->definition['callback'] : null;
+
+		if ( ! $callback ) {
+			/* translators: 1. Rule name. */
+			plugin( 'logging' )->log_unique( 'ERROR: ' . esc_html( sprintf( __( 'Rule `%s` has no callback.', 'content-control' ), $this->name ) ) );
+			return false;
+		}
+
+		if ( ! is_callable( $callback ) ) {
+			/* translators: 1. Rule name. 2. Callback name. */
+			plugin( 'logging' )->log_unique( 'ERROR: ' . esc_html( sprintf( __( 'Rule `%1$s` callback is not callable (%2$s).', 'content-control' ), $this->name, $callback ) ) );
+			return false;
+		}
+
+		// Set global current rule so it can be easily accessed.
+		current_rule( $this );
+
+		if ( $this->deprecated ) {
+			$settings = [
+				'target'   => $this->name,
+				'settings' => $this->options,
+			];
+
+			// Old rules had the settings passed as the first argument.
+			$check = call_user_func( $callback, $settings );
+		} else {
+			/**
+			 * All rule options can be accessed via the global.
+			 *
+			 * @see \ContentControl\Rules\current_rule()
+			 */
+			$check = call_user_func( $callback );
+		}
+
+		// Clear global current rule.
+		current_rule( null );
+
+		return $check;
+	}
+
+	/**
+	 * Check if this rule's callback is based in JS rather than PHP.
+	 *
+	 * @return bool
+	 */
+	public function is_js_rule() {
+		return $this->frontend_only;
+	}
+
+	/**
+	 * Return the rule check as boolean or null if the rule is JS based.
+	 *
+	 * @return bool|null
+	 */
+	public function get_check() {
+		if ( $this->is_js_rule() ) {
+			return null;
+		}
+
+		return $this->run_check();
+	}
+
+	/**
+	 * Return the rule check as an array of information.
+	 *
+	 * Useful for debugging.
+	 *
+	 * @return array<string,mixed>|null
+	 */
+	public function get_check_info() {
+		if ( $this->is_js_rule() ) {
+			return null;
+		}
+
+		return [
+			'result' => $this->run_check(),
+			'id'     => $this->id,
+			'rule'   => $this->name,
+			'not'    => $this->not_operand,
+			'args'   => $this->options,
+			'def'    => $this->definition,
+		];
+	}
+}

+<?php
+/**
+ * Rule engine set model.
+ *
+ * @package ContentControl
+ * @subpackage Models
+ */
+
+namespace ContentControl\Models\RuleEngine;
+
+/**
+ * Handler for condition sets.
+ *
+ * @package ContentControl
+ */
+class Set {
+
+	/**
+	 * Set id.
+	 *
+	 * @var string
+	 */
+	public $id;
+
+	/**
+	 * Set label.
+	 *
+	 * @var string
+	 */
+	public $label;
+
+	/**
+	 * Set query.
+	 *
+	 * @var Query
+	 */
+	public $query;
+
+	/**
+	 * Build a set.
+	 *
+	 * @param array{id:string,label:string,query:array<mixed>} $set Set data.
+	 */
+	public function __construct( $set ) {
+		$set = wp_parse_args( $set, [
+			'id'    => '',
+			'label' => '',
+			'query' => [],
+		]);
+
+		$this->id    = $set['id'];
+		$this->label = $set['label'];
+		$this->query = new Query( $set['query'] );
+	}
+
+	/**
+	 * Check if this set has JS based rules.
+	 *
+	 * @return bool
+	 */
+	public function has_js_rules() {
+		return $this->query->has_js_rules();
+	}
+
+	/**
+	 * Check this sets rules.
+	 *
+	 * @return bool
+	 */
+	public function check_rules() {
+		return $this->query->check_rules();
+	}
+
+	/**
+	 * Get the check array for further post processing.
+	 *
+	 * @return array<bool|null|array<bool|null>>
+	 */
+	public function get_checks() {
+		return $this->query->get_checks();
+	}
+
+	/**
+	 * Return the checks as an array of information.
+	 *
+	 * Useful for debugging.
+	 *
+	 * @return array<string,mixed>
+	 */
+	public function get_check_info() {
+		return $this->query->get_check_info();
+	}
+}

+<?php
+/**
+ * Includes the composer Autoloader used for packages and classes in the classes/ directory.
+ *
+ * @package ContentControl\Plugin
+ */
+
+namespace ContentControl\Plugin;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Autoloader class.
+ */
+class Autoloader {
+
+	/**
+	 * Static-only class.
+	 */
+	private function __construct() {
+	}
+
+	/**
+	 * Require the autoloader and return the result.
+	 *
+	 * If the autoloader is not present, let's log the failure and display a nice admin notice.
+	 *
+	 * @param string $name Plugin name for error messaging.
+	 * @param string $path Path to the plugin.
+	 *
+	 * @return boolean
+	 */
+	public static function init( $name = '', $path = '' ) {
+		$autoloader = $path . '/vendor/autoload.php';
+
+		if ( ! \is_readable( $autoloader ) ) {
+			self::missing_autoloader( $name );
+
+			return false;
+		}
+
+		require_once $autoloader;
+
+		return true;
+	}
+
+	/**
+	 * If the autoloader is missing, add an admin notice.
+	 *
+	 *  @param string $plugin_name Plugin name for error messaging.
+	 *
+	 * @return void
+	 */
+	protected static function missing_autoloader( $plugin_name = '' ) {
+		/* translators: 1. Plugin name */
+		$text = __( 'Your installation of %1$s is incomplete. If you installed %1$s from GitHub, please refer to this document to set up your development environment.', 'content-control' );
+
+		$message = sprintf( $text, $plugin_name );
+
+		if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+			// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
+			error_log(
+				esc_html( $message )
+			);
+		}
+
+		add_action(
+			'admin_notices',
+			function () use ( $message ) {
+				?>
+					<div class="notice notice-error">
+						<p><?php echo esc_html( $message ); ?></p>
+					</div>
+				<?php
+			}
+		);
+	}
+}

+<?php
+/**
+ * Plugin installer.
+ *
+ * @copyright (c) 2021, Code Atlantic LLC.
+ *
+ * @package ContentControl\Plugin
+ */
+
+namespace ContentControl\Plugin;
+
+use function ContentControl\plugin;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Class Install
+ *
+ * @since 1.0.0
+ */
+class Install {
+
+	/**
+	 * Activation wrapper.
+	 *
+	 * @param bool $network_wide Weather to activate network wide.
+	 *
+	 * @return void
+	 */
+	public static function activate_plugin( $network_wide ) {
+		self::do_multisite( $network_wide, [ __CLASS__, 'activate_site' ] );
+	}
+
+	/**
+	 * Deactivation wrapper.
+	 *
+	 * @param bool $network_wide Weather to deactivate network wide.
+	 *
+	 * @return void
+	 */
+	public static function deactivate_plugin( $network_wide ) {
+		self::do_multisite( $network_wide, [ __CLASS__, 'deactivate_site' ] );
+	}
+
+	/**
+	 * Uninstall the plugin.
+	 *
+	 * @return void
+	 */
+	public static function uninstall_plugin() {
+		self::do_multisite( true, [ __CLASS__, 'uninstall_site' ] );
+	}
+
+	/**
+	 * Handle single & multisite processes.
+	 *
+	 * @param bool                $network_wide Weather to do it network wide.
+	 * @param callable            $method Callable method for each site.
+	 * @param array<string,mixed> $args Array of extra args.
+	 *
+	 * @return void
+	 */
+	private static function do_multisite( $network_wide, $method, $args = [] ) {
+		global $wpdb;
+
+		if ( is_multisite() && $network_wide ) {
+			$activated = get_site_option( 'content_control_activated', [] );
+
+			/* phpcs:ignore WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.DirectDatabaseQuery.DirectQuery */
+			$blog_ids = $wpdb->get_col( "SELECT blog_id FROM {$wpdb->blogs}" );
+
+			// Try to reduce the chances of a timeout with a large number of sites.
+			if ( \count( $blog_ids ) > 2 ) {
+				ignore_user_abort( true );
+
+				if ( ! \ContentControl\is_func_disabled( 'set_time_limit' ) ) {
+					/* phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged */
+					@set_time_limit( 0 );
+				}
+			}
+
+			foreach ( $blog_ids as $blog_id ) {
+				switch_to_blog( $blog_id );
+				call_user_func_array( $method, [ $args ] );
+
+				$activated[] = $blog_id;
+
+				restore_current_blog();
+			}
+
+			update_site_option( 'content_control_activated', $activated );
+		} else {
+			call_user_func_array( $method, [ $args ] );
+		}
+	}
+
+	/**
+	 * Activate on single site.
+	 *
+	 * @return void
+	 */
+	public static function activate_site() {
+		// Add a temporary option that will fire a hookable action on next load.
+		\set_transient( '_content_control_installed', true, 3600 );
+
+		$version = plugin()->get( 'version' );
+
+		// Add version info.
+		\add_option( 'content_control_version', [
+			'version'         => $version,
+			'upgraded_from'   => null,
+			'initial_version' => $version,
+			'installed_on'    => gmdate( 'Y-m-d H:i:s' ),
+		] );
+
+		// Add data versions if missing.
+		\add_option( 'content_control_data_versioning', \ContentControl\current_data_versions() );
+	}
+
+	/**
+	 * Deactivate on single site.
+	 *
+	 * @return void
+	 */
+	public static function deactivate_site() {
+	}
+
+	/**
+	 * Uninstall single site.
+	 *
+	 * @return void
+	 */
+	public static function uninstall_site() {
+	}
+}

+<?php
+/**
+ * Logging class.
+ *
+ * @package ContentControl\Plugin
+ */
+
+namespace ContentControl\Plugin;
+
+/**
+ * Logging class.
+ */
+class Logging {
+
+	/**
+	 * Log file prefix.
+	 */
+	const LOG_FILE_PREFIX = 'content-control-';
+
+	/**
+	 * Whether the log file is writable.
+	 *
+	 * @var bool|null
+	 */
+	private $is_writable;
+
+	/**
+	 * Log file name.
+	 *
+	 * @var string
+	 */
+	private $filename = '';
+
+	/**
+	 * Log file path.
+	 *
+	 * @var string
+	 */
+	private $file = '';
+
+	/**
+	 * File system API.
+	 *
+	 * @var \WP_Filesystem_Base|null
+	 */
+	private $fs;
+
+	/**
+	 * Log file content.
+	 *
+	 * @var string|null
+	 */
+	private $content;
+
+	/**
+	 * Initialize logging.
+	 */
+	public function __construct() {
+		$this->init();
+
+		$this->register_hooks();
+	}
+
+	/**
+	 * Register hooks.
+	 *
+	 * @return void
+	 */
+	public function register_hooks() {
+		// On shutdown, save the log file.
+		add_action( 'shutdown', [ $this, 'save_logs' ] );
+	}
+
+	/**
+	 * Gets the Uploads directory
+	 *
+	 * @return bool|array{path: string, url: string, subdir: string, basedir: string, baseurl: string, error: string|false} An associated array with baseurl and basedir or false on failure
+	 */
+	public function get_upload_dir() {
+		// Used if you only need to fetch data, not create missing folders.
+		$wp_upload_dir = wp_get_upload_dir();
+
+		// phpcs:ignore Squiz.PHP.CommentedOutCode.Found
+		// $wp_upload_dir = wp_upload_dir(); // Disable this on IS_WPCOM if used.
+
+		if ( isset( $wp_upload_dir['error'] ) && false !== $wp_upload_dir['error'] ) {
+			return false;
+		} else {
+			return $wp_upload_dir;
+		}
+	}
+
+	/**
+	 * Gets the uploads directory URL
+	 *
+	 * @param string $path A path to append to end of upload directory URL.
+	 * @return bool|string The uploads directory URL or false on failure
+	 */
+	public function get_upload_dir_url( $path = '' ) {
+		$upload_dir = $this->get_upload_dir();
+		if ( false !== $upload_dir && isset( $upload_dir['baseurl'] ) ) {
+			$url = preg_replace( '/^https?:/', '', $upload_dir['baseurl'] );
+			if ( null === $url ) {
+				return false;
+			}
+			if ( ! empty( $path ) ) {
+				$url = trailingslashit( $url ) . $path;
+			}
+			return $url;
+		} else {
+			return false;
+		}
+	}
+
+	/**
+	 * Chek if logging is enabled.
+	 *
+	 * @return bool
+	 */
+	public function enabled() {
+		$disabled = defined( '\CONTENT_CONTROL_DISABLE_LOGGING' ) && true === \CONTENT_CONTROL_DISABLE_LOGGING;
+
+		return ! $disabled && $this->is_writable();
+	}
+
+	/**
+	 * Get working WP Filesystem instance
+	 *
+	 * @return \WP_Filesystem_Base|false
+	 */
+	public function fs() {
+		if ( isset( $this->fs ) ) {
+			return $this->fs;
+		}
+
+		global $wp_filesystem;
+
+		require_once ABSPATH . 'wp-admin/includes/file.php';
+
+		// If for some reason the include doesn't work as expected just return false.
+		if ( ! function_exists( 'WP_Filesystem' ) ) {
+			return false;
+		}
+
+		$writable = WP_Filesystem( false, '', true );
+
+		// We consider the directory as writable if it uses the direct transport,
+		// otherwise credentials would be needed.
+		$this->fs = ( $writable && 'direct' === $wp_filesystem->method ) ? $wp_filesystem : false;
+
+		return $this->fs;
+	}
+
+	/**
+	 * Check if the log file is writable.
+	 *
+	 * @return boolean
+	 */
+	public function is_writable() {
+		if ( isset( $this->is_writable ) ) {
+			return $this->is_writable;
+		}
+
+		$file_system = $this->fs();
+
+		if ( false === $file_system ) {
+			$this->is_writable = false;
+			return $this->is_writable;
+		}
+
+		$this->is_writable = 'direct' === $file_system->method;
+
+		$upload_dir = $this->get_upload_dir();
+
+		if ( ! $file_system->is_writable( $upload_dir['basedir'] ) ) {
+			$this->is_writable = false;
+		}
+
+		return $this->is_writable;
+	}
+
+	/**
+	 * Get things started
+	 *
+	 * @return void
+	 */
+	public function init() {
+		$upload_dir  = $this->get_upload_dir();
+		$file_system = $this->fs();
+
+		if ( false === $upload_dir || false === $file_system ) {
+			return;
+		}
+
+		$file_token = \get_option( 'content_control_debug_log_token' );
+		if ( false === $file_token ) {
+			$file_token = uniqid( (string) wp_rand(), true );
+			\update_option( 'content_control_debug_log_token', $file_token );
+		}
+
+		$this->filename = self::LOG_FILE_PREFIX . "debug-{$file_token}.log"; // ex. content-control-debug-5c2f6a9b9b5a3.log.
+		$this->file     = trailingslashit( $upload_dir['basedir'] ) . $this->filename;
+
+		if ( ! $file_system->exists( $this->file ) ) {
+			$this->setup_new_log();
+		} else {
+			$this->content = $this->get_file( $this->file );
+		}
+
+		// Truncate long log files.
+		if ( $file_system->exists( $this->file ) && $file_system->size( $this->file ) >= 1048576 ) {
+			$this->truncate_log();
+		}
+	}
+
+	/**
+	 * Get the log file path.
+	 *
+	 * @return string
+	 */
+	public function get_file_path() {
+		return $this->file;
+	}
+
+	/**
+	 * Retrieves the url to the file
+	 *
+	 * @return string|bool The url to the file or false on failure
+	 */
+	public function get_file_url() {
+		if ( ! $this->enabled() ) {
+			return false;
+		}
+
+		return $this->get_upload_dir_url( $this->filename );
+	}
+
+	/**
+	 * Retrieve the log data
+	 *
+	 * @return false|string
+	 */
+	public function get_log() {
+		return $this->get_log_content();
+	}
+
+	/**
+	 * Delete the log file and token.
+	 *
+	 * @return void
+	 */
+	public function delete_logs() {
+		$file_system = $this->fs();
+
+		if ( false === $file_system ) {
+			return;
+		}
+
+		$file_system->delete( $this->file );
+		\delete_option( 'content_control_debug_log_token' );
+	}
+
+	/**
+	 * Log message to file
+	 *
+	 * @param string $message The message to log.
+	 *
+	 * @return void
+	 */
+	public function log( $message = '' ) {
+		$this->write_to_log( wp_date( 'Y-n-d H:i:s' ) . ' - ' . $message );
+	}
+
+	/**
+	 * Log unique message to file.
+	 *
+	 * @param string $message The unique message to log.
+	 *
+	 * @return void
+	 */
+	public function log_unique( $message = '' ) {
+		$contents = $this->get_log_content();
+
+		if ( strpos( $contents, $message ) !== false ) {
+			return;
+		}
+
+		$this->log( $message );
+	}
+
+	/**
+	 * Get the log file contents.
+	 *
+	 * @return false|string
+	 */
+	public function get_log_content() {
+		if ( ! isset( $this->content ) ) {
+			$this->content = $this->get_file();
+		}
+
+		return $this->content;
+	}
+
+	/**
+	 * Set the log file contents in memory.
+	 *
+	 * @param mixed $content The content to set.
+	 * @param bool  $save    Whether to save the content to the file immediately.
+	 * @return void
+	 */
+	private function set_log_content( $content, $save = false ) {
+		$this->content = $content;
+
+		if ( $save ) {
+			$this->save_logs();
+		}
+	}
+
+	/**
+	 * Retrieve the contents of a file.
+	 *
+	 * @param string|boolean $file File to get contents of.
+	 *
+	 * @return false|string
+	 */
+	protected function get_file( $file = false ) {
+		$file = $file ? $file : $this->file;
+
+		$file_system = $this->fs();
+
+		if ( false === $file_system || ! $this->enabled() ) {
+			return '';
+		}
+
+		$content = '';
+
+		if ( $file_system->exists( $file ) ) {
+			$content = $file_system->get_contents( $file );
+		}
+
+		return $content;
+	}
+
+	/**
+	 * Write the log message
+	 *
+	 * @param string $message The message to write.
+	 *
+	 * @return void
+	 */
+	protected function write_to_log( $message = '' ) {
+		if ( ! $this->enabled() ) {
+			return;
+		}
+
+		$contents = $this->get_log_content();
+
+		// If it doesn't end with a new line, add one. \r\n length is 2.
+		if ( substr( $contents, -2 ) !== "\r\n" ) {
+			$contents .= "\r\n";
+		}
+
+		$this->set_log_content( $contents . $message );
+	}
+
+	/**
+	 * Save the current contents to file.
+	 *
+	 * @return void
+	 */
+	public function save_logs() {
+		$file_system = $this->fs();
+
+		if ( false === $file_system || ! $this->enabled() ) {
+			return;
+		}
+
+		$file_system->put_contents( $this->file, $this->content, FS_CHMOD_FILE );
+	}
+
+	/**
+	 * Get a line count.
+	 *
+	 * @return int
+	 */
+	public function count_lines() {
+		$file  = $this->get_log_content();
+		$lines = explode( "\r\n", $file );
+
+		return count( $lines );
+	}
+
+	/**
+	 * Truncates a log file to maximum of 250 lines.
+	 *
+	 * @return void
+	 */
+	public function truncate_log() {
+		$content           = $this->get_log_content();
+		$lines             = explode( "\r\n", $content );
+		$lines             = array_slice( $lines, 0, 250 ); // 50 is how many lines you want to keep
+		$truncated_content = implode( "\r\n", $lines );
+		$this->set_log_content( $truncated_content, true );
+	}
+
+	/**
+	 * Set up a new log file.
+	 *
+	 * @return void
+	 */
+	public function setup_new_log() {
+		$this->set_log_content( "Content Control Debug Logs:\r\n" . wp_date( 'Y-n-d H:i:s' ) . " - Log file initialized\r\n", true );
+	}
+
+	/**
+	 * Delete the log file.
+	 *
+	 * @return void
+	 */
+	public function clear_log() {
+		$file_system = $this->fs();
+
+		if ( false === $file_system ) {
+			return;
+		}
+
+		// Delete the file.
+		// phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+		@$file_system->delete( $this->file );
+
+		if ( $this->enabled() ) {
+			$this->setup_new_log();
+		}
+	}
+
+	/**
+	 * Log a deprecated notice.
+	 *
+	 * @param string $func_name Function name.
+	 * @param string $version Versoin deprecated.
+	 * @param string $replacement Replacement function (optional).
+	 *
+	 * @return void
+	 */
+	public function log_deprecated_notice( $func_name, $version, $replacement = null ) {
+		if ( ! is_null( $replacement ) ) {
+			$notice = sprintf( '%1$s is <strong>deprecated</strong> since version %2$s! Use %3$s instead.', $func_name, $version, $replacement );
+		} else {
+			$notice = sprintf( '%1$s is <strong>deprecated</strong> since version %2$s with no alternative available.', $func_name, $version );
+		}
+
+		$this->log_unique( $notice );
+	}
+}