<?php
declare(strict_types=1);
defined( 'ABSPATH' ) || exit;

require_once __DIR__.'/native-fence-service.php';

/** Request-aware boundary for the existing priority-9 eraser filter.
 * Unregistered: not a second callback(email,page), nor a completed takeover.
 * Until durable aliases/refs and remote receipts exist, it NEVER returns done.
 */
// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- OG_ prefix kept for 0.3.0 by owner decision; namespace move planned for 0.3.x
final class OG_Owned_Native_Coordinator {
    /** Explicit composition-root operation, never called by inclusion. Replaces
     * only this one legacy filter; not evidence that queued writers are drained.
     */
    public static function attach(): bool {
        $hook='wp_privacy_personal_data_erasure_page';$legacy='orderguard_filter_personal_data_erasure_page';
        $priority=has_filter($hook,$legacy);
        if($priority!==false && $priority!==9){return false;}
        if($priority===9){
            remove_filter($hook,$legacy,9);
            if(has_filter($hook,$legacy)!==false){add_filter($hook,$legacy,9,6);return false;}
        }
        add_filter($hook,array(self::class,'filter'),9,6);
        return true;
    }

    public static function filter($response,$eraserIndex,$email,$page,$requestId,$eraserKey) {
        if($eraserKey!=='orderguard'){return $response;}
        if(is_wp_error($response)){return $response;}
        // Core provides integers. Do not coerce a forged filter invocation.
        if(!is_int($page) || $page<1 || !is_int($eraserIndex) || $eraserIndex!==1 ||
            !is_int($requestId) || $requestId<1 || !is_string($email)){
            return self::error('owned_native_page_invalid');
        }
        // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- applies an existing WordPress or WooCommerce filter; not a new hook
        $erasers=apply_filters('wp_privacy_personal_data_erasers',array());
        if(!is_array($erasers) || array_key_first($erasers)!=='orderguard' ||
            ($erasers['orderguard']['callback']??null)!=='orderguard_personal_data_eraser_placeholder'){
            return self::error('owned_native_order_unsafe');
        }
        // A dispatcher must replace, not stack with, the legacy writer. Its
        // presence anywhere in this filter chain is a refusal, even later.
        if(has_filter('wp_privacy_personal_data_erasure_page','orderguard_filter_personal_data_erasure_page')!==false){
            return self::error('owned_native_legacy_active');
        }
        // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce is verified with wp_verify_nonce() in native-fence-service.php before any change
        $nonce=isset($_POST['security']) && is_string($_POST['security'])?wp_unslash($_POST['security']):'';
        $fence=OG_Owned_Native_Fence_Service::request($requestId,$email,$nonce);
        if(is_wp_error($fence)){return $fence;}
        if(($fence['status']??null)!=='native_email_fence_saved' || ($fence['coverage']??null)!=='request_email_only'){
            return self::error('owned_native_fence_unconfirmed');
        }
        // One local attempt per invocation; no network and no callback-page loop.
        // This is an unresolved obligation, not a database outage or an erasure.
        $saved=false;
        try {
            global $wpdb;
            $context=(new OG_Owned_WordPress_Context($wpdb,false))->attentionContext();
            $r=$context['writer']->recordNativeAttention($context,$requestId,'native_scope_incomplete');
            $saved=($r['status']??null)==='native_attention_recorded';
        }catch(Throwable $e){$saved=false;}
        return new WP_Error($saved?'owned_native_scope_pending':'owned_native_obligation_unsaved',
            __('OrderGuard has not completed erasure. Alias and order-reference coverage and server confirmation still require attention. Later erasers must not run yet.','orderguard'),
            array('attention_recorded'=>$saved,'automatic_retry'=>false,'erasure_complete'=>false,'coverage'=>'request_email_only'));
    }

    private static function error(string $code) {
        return new WP_Error($code,__('OrderGuard could not safely enter this erasure step. No completion is confirmed.','orderguard'),
            array('automatic_retry'=>false,'erasure_complete'=>false));
    }
}