<?php
declare(strict_types=1);
defined( 'ABSPATH' ) || exit;

require_once __DIR__.'/wordpress-context.php';
/** Unregistered internal admin service; no public AJAX hook or raw-identity capture.
 * Permission to add a local fence is not permission to erase or send anything. */
// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- OG_ prefix kept for 0.3.0 by owner decision; namespace move planned for 0.3.x
final class OG_Owned_Suppression_Controller {
    public static function request($nonce,array $hashes): array {
        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- request method is only compared with the fixed string 'POST'
        if(($_SERVER['REQUEST_METHOD']??'')!=='POST' || !is_user_logged_in() ||
            !current_user_can('manage_options') || !current_user_can('manage_woocommerce') ||
            !is_string($nonce) || !wp_verify_nonce($nonce,'orderguard_owned_suppression:'.get_current_blog_id())){
            return array('status'=>'forbidden');
        }
        global $wpdb;
        try{$context=(new OG_Owned_WordPress_Context($wpdb))->context();return $context['writer']->addSuppression($context,$hashes);}
        catch(Throwable $e){return array('status'=>'unavailable','reason'=>'suppression_storage_unavailable');}
    }
}