<?php
/**
 * Plugin Name: FEA Security — disabled legacy accounts
 * Description: Blocks authentication and password resets for accounts disabled during incident #183.
 * Version: 1.0.0
 */

declare(strict_types=1);

const FEA_SECURITY_DISABLED_USER_IDS = [1047, 1049, 1087];

function fea_security_is_disabled_user(int $user_id): bool
{
    return in_array($user_id, FEA_SECURITY_DISABLED_USER_IDS, true);
}

add_filter('wp_authenticate_user', static function (WP_User $user): WP_User|WP_Error {
    if (fea_security_is_disabled_user((int) $user->ID)) {
        return new WP_Error('fea_account_disabled', __('This account is disabled.'));
    }

    return $user;
}, 99);

add_filter('allow_password_reset', static function (bool $allow, int $user_id): bool {
    return fea_security_is_disabled_user($user_id) ? false : $allow;
}, 99, 2);