__( 'You have unsaved changes.', 'refmora' ),
'saving' => __( 'Saving your changes...', 'refmora' ),
'clearing_trash' => __( 'Clearing Trash...', 'refmora' ),
'clear_trash_done' => __( 'Trash cleared.', 'refmora' ),
'clear_trash_partial' => __( 'Some items could not be deleted.', 'refmora' ),
'clear_trash_error' => __( 'Clearing could not finish. Some items may have been deleted. Refresh Trash before trying again.', 'refmora' ),
/* translators: %d: number of records permanently deleted so far. */
'trash_removed' => __( 'Deleted: %d', 'refmora' ),
) );
}
} );
add_action( 'admin_post_refm_payout', array( __CLASS__, 'payout_action' ) );
add_action( 'admin_post_refm_commission', array( __CLASS__, 'commission_action' ) );
add_action( 'admin_post_refm_record', array( __CLASS__, 'record_action' ) );
add_action( 'admin_post_refm_clear_trash', array( __CLASS__, 'clear_trash_action' ) );
add_action( 'wp_ajax_refm_clear_trash', array( __CLASS__, 'clear_trash_ajax' ) );
add_action( 'admin_post_refm_affiliate', array( __CLASS__, 'affiliate_action' ) );
add_filter( 'plugin_action_links_' . plugin_basename( REFM_FILE ), function ( $links ) {
array_unshift( $links, '' . esc_html__( 'Settings', 'refmora' ) . '' );
return $links;
} );
}
public static function pending_affiliates_count() {
$query = new WP_User_Query( array(
'fields' => 'ID', 'number' => 1, 'count_total' => true, 'cache_results' => true,
// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Required enrollment/pending predicates; WordPress caches IDs and totals and invalidates them when user metadata changes.
'meta_query' => array(
'relation' => 'AND',
array( 'key' => '_refm_enrolled', 'value' => 'yes' ),
array( 'key' => '_refm_approval', 'value' => 'pending' ),
),
) );
return absint( $query->get_total() );
}
public static function pending_counts() {
global $wpdb;
$commissions = REFM_Store::table( 'commissions' );
$payouts = REFM_Store::table( 'payouts' );
// phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Custom affiliate tables have no WordPress CRUD API; read current totals, history and privacy records without stale cross-request caches.
$counts = $wpdb->get_row( $wpdb->prepare( 'SELECT (SELECT COUNT(*) FROM %i WHERE status=%s) AS commissions, (SELECT COUNT(*) FROM %i WHERE status=%s) AS payouts', $commissions, 'pending', $payouts, 'pending' ), ARRAY_A );
return array( 'affiliates' => self::pending_affiliates_count(), 'commissions' => absint( $counts['commissions'] ?? 0 ), 'payouts' => absint( $counts['payouts'] ?? 0 ) );
}
public static function pending_badge( $count ) {
$count = absint( $count ); if ( ! $count ) { return ''; }
/* translators: %s: formatted count of pending items. */
$label = sprintf( _n( '%s pending item', '%s pending items', $count, 'refmora' ), number_format_i18n( $count ) );
return '' . esc_html( number_format_i18n( $count ) ) . '' . esc_html( $label ) . '';
}
public static function menu() {
$title = 'Refmora Affiliate';
$count = current_user_can( 'manage_woocommerce' ) ? self::pending_affiliates_count() : 0;
if ( $count ) {
/* translators: %s: formatted count of pending affiliate applications. */
$description = sprintf( _n( '%s pending affiliate application', '%s pending affiliate applications', $count, 'refmora' ), number_format_i18n( $count ) );
$title .= ' ' . esc_html( number_format_i18n( $count ) ) . '' . esc_html( $description ) . '';
}
add_submenu_page( 'woocommerce', 'Refmora Affiliate', $title, 'manage_woocommerce', 'refmora', array( __CLASS__, 'render' ) );
}
public static function payout_action() {
if ( ! current_user_can( 'manage_woocommerce' ) ) { wp_die( esc_html__( 'Access denied.', 'refmora' ), 403 ); }
if ( 'POST' !== ( isset( $_SERVER['REQUEST_METHOD'] ) && is_string( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '' ) ) { wp_die( esc_html__( 'Use the settings form to make changes.', 'refmora' ), '', array( 'response' => 405 ) ); }
$id = absint( isset( $_POST['payout_id'] ) && is_scalar( $_POST['payout_id'] ) ? wp_unslash( $_POST['payout_id'] ) : 0 );
if ( ! isset( $_POST['_wpnonce'] ) || ! is_string( $_POST['_wpnonce'] ) ) { wp_die( esc_html__( 'Your session expired. Refresh and try again.', 'refmora' ), '', array( 'response' => 403 ) ); }
check_admin_referer( 'refm_payout_' . $id );
$status = sanitize_key( ( isset( $_POST[ 'status' ] ) && is_scalar( $_POST[ 'status' ] ) ? wp_unslash( $_POST[ 'status' ] ) : '' ) );
$note = sanitize_textarea_field( ( isset( $_POST[ 'note' ] ) && is_scalar( $_POST[ 'note' ] ) ? wp_unslash( $_POST[ 'note' ] ) : '' ) );
$result = REFM_Payouts::transition( $id, $status, $note );
$url = add_query_arg( array( 'page' => 'refmora', 'tab' => 'payouts', 'refm_message' => is_wp_error( $result ) ? $result->get_error_message() : __( 'Withdrawal updated.', 'refmora' ), 'refm_error' => is_wp_error( $result ) ? 1 : 0 ), admin_url( 'admin.php' ) );
wp_safe_redirect( $url ); exit;
}
/** Process a nonce-protected manager decision, never a GET request. */
public static function commission_action() {
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read the scalar ID solely to select its nonce; admin_request() verifies capability, POST and that nonce before any mutation.
$id = absint( REFM_Security::value( $_POST, 'commission_id' ) );
REFM_Security::admin_request( 'refm_commission_' . $id );
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- admin_request() above verified POST, manage_woocommerce and this commission's nonce.
$decision = sanitize_key( wp_unslash( REFM_Security::value( $_POST, 'decision' ) ) );
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- admin_request() above verified POST, manage_woocommerce and this commission's nonce.
$version = sanitize_text_field( wp_unslash( REFM_Security::value( $_POST, 'review_version' ) ) );
$result = REFM_Commissions::review( $id, $decision, $version );
$message = is_wp_error( $result ) ? $result->get_error_message() : ( 'confirmed' === $decision ? __( 'Commission confirmed. Earnings are now available for withdrawal.', 'refmora' ) : __( 'Commission rejected.', 'refmora' ) );
$url = add_query_arg(
array(
'page' => 'refmora',
'tab' => 'commissions',
'refm_error' => is_wp_error( $result ) ? 1 : 0,
'refm_message' => $message,
),
admin_url( 'admin.php' )
);
wp_safe_redirect( $url );
exit;
}
/** Handle administrator record removal with a type-, ID- and operation-specific nonce. */
public static function record_action() {
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read only scalar routing values to choose the nonce checked immediately below, before any mutation.
$type = sanitize_key( REFM_Security::value( $_POST, 'record_type' ) );
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read only the scalar record ID for nonce selection.
$id = absint( REFM_Security::value( $_POST, 'record_id' ) );
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read only the scalar operation for nonce selection.
$operation = sanitize_key( REFM_Security::value( $_POST, 'operation' ) );
REFM_Security::admin_request( 'refm_record_' . $type . '_' . $id . '_' . $operation );
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- admin_request() verified POST, manage_woocommerce and the record-specific nonce above.
$version = sanitize_text_field( wp_unslash( REFM_Security::value( $_POST, 'record_version' ) ) );
if ( 'affiliates' === $type && 'delete' === $operation ) {
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- The record-specific nonce and POST capability guard have already passed.
$confirmation = sanitize_text_field( wp_unslash( REFM_Security::value( $_POST, 'confirmation' ) ) );
$result = REFM_Records::delete_affiliate( $id, $confirmation, $version );
} else {
$result = REFM_Records::change( $type, $id, $operation, $version );
}
$url = add_query_arg(
array(
'page' => 'refmora',
'tab' => in_array( $type, array( 'affiliates', 'commissions', 'payouts' ), true ) ? $type : 'affiliates',
'view' => 'affiliates' !== $type && in_array( $operation, array( 'restore', 'delete' ), true ) ? 'trash' : '',
'refm_error' => is_wp_error( $result ) ? 1 : 0,
'refm_message' => is_wp_error( $result ) ? $result->get_error_message() : $result,
),
admin_url( 'admin.php' )
);
wp_safe_redirect( $url );
exit;
}
/** @return string Nonce-verified record type for a Clear All Trash request. */
private static function clear_trash_request() {
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- This scalar chooses the type-specific nonce verified immediately below, before clearing any record.
$type = sanitize_key( REFM_Security::value( $_POST, 'record_type' ) );
REFM_Security::admin_request( 'refm_clear_trash_' . $type );
return $type;
}
/** Process one bounded batch so a large Trash does not require one long request. */
public static function clear_trash_ajax() {
$type = self::clear_trash_request();
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- clear_trash_request() verified POST, capability and the type-specific nonce above.
$cursor = absint( REFM_Security::value( $_POST, 'cursor', '0' ) );
// phpcs:ignore WordPress.Security.NonceVerification.Missing -- clear_trash_request() verified POST, capability and the type-specific nonce above.
$ceiling = REFM_Security::value( $_POST, 'ceiling' );
$result = REFM_Records::clear_trash( $type, $cursor, '' === $ceiling ? null : absint( $ceiling ) );
if ( is_wp_error( $result ) ) {
wp_send_json_error( array( 'message' => $result->get_error_message() ), 'access' === $result->get_error_code() ? 403 : 400 );
}
wp_send_json_success( $result );
}
/** Clear ordinary-sized Trash without JavaScript, reporting any partial result. */
public static function clear_trash_action() {
$type = self::clear_trash_request();
$cursor = 0;
$ceiling = null;
$deleted = 0;
$skipped = 0;
$done = false;
$error = '';
$started = microtime( true );
do {
$result = REFM_Records::clear_trash( $type, $cursor, $ceiling );
if ( is_wp_error( $result ) ) {
$error = $result->get_error_message();
break;
}
$deleted += $result['deleted'];
$skipped += $result['skipped'];
$cursor = $result['cursor'];
$ceiling = $result['ceiling'];
$done = $result['done'];
if ( '' === $error && '' !== $result['first_error'] ) {
$error = $result['first_error'];
}
} while ( ! $done && microtime( true ) - $started < 10 );
/* translators: %d: number of permanently deleted records. */
$message = sprintf( _n( '%d item permanently deleted.', '%d items permanently deleted.', $deleted, 'refmora' ), $deleted );
if ( $skipped || ! $done || $error ) {
$message .= ' ' . ( $error ?: __( 'Some items were not deleted. Resolve any related withdrawals and run Clear All Trash again.', 'refmora' ) );
}
$url = add_query_arg(
array(
'page' => 'refmora',
'tab' => in_array( $type, array( 'commissions', 'payouts' ), true ) ? $type : 'commissions',
'view' => 'trash',
'refm_error' => $skipped || ! $done || $error ? 1 : 0,
'refm_message' => $message,
),
admin_url( 'admin.php' )
);
wp_safe_redirect( $url );
exit;
}
/** @return bool Whether an administrator requested the reversible Trash view. */
public static function trash_view() {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only list routing; deletion and restoration require separate POST actions and nonces.
return REFM_Records::allowed() && 'trash' === REFM_Security::value( $_GET, 'view' );
}
/**
* Render deletion or restoration for the exact record displayed.
*
* @param string $type Record type.
* @param object|int $row Financial row or affiliate user ID.
*/
public static function record_actions( $type, $row ) {
if ( ! REFM_Records::allowed() ) {
return;
}
$affiliate = 'affiliates' === $type;
if ( ! $affiliate && ( 'processing' === $row->status || ( 'commissions' === $type && $row->payout_id ) ) ) {
echo '' . esc_html__( 'Resolve withdrawal first', 'refmora' ) . '';
return;
}
$id = $affiliate ? absint( $row ) : absint( $row->id );
$operations = $affiliate ? array( 'delete' ) : ( empty( $row->trashed_at ) ? array( 'trash' ) : array( 'restore', 'delete' ) );
$version = $affiliate ? REFM_Records::affiliate_version( $id ) : REFM_Records::version( $row );
if ( $affiliate ) {
echo '' . esc_html__( 'Delete', 'refmora' ) . '
' . esc_html__( 'Permanently delete this affiliate profile, commissions, withdrawals, referred-customer associations and click history. Their WordPress account and WooCommerce orders remain. This cannot be undone.', 'refmora' ) . '
' . esc_html__( 'Commission summaries use creation dates and current balances, including refund adjustments. Awaiting payouts uses request dates. Latest lists below show the newest records overall.', 'refmora' ) . '
';
/** Separate add-ons can render an overview report using the same validated date range. */
do_action( 'refm_admin_overview_chart', $range, $currency );
echo '
';
}
/** Render accessible status choices using the same allowlist as settings validation. */
public static function commission_statuses_field() {
$selected = REFM_Settings::clean_commission_statuses( REFM_Settings::get( 'commission_statuses' ) );
echo '';
}
private static function overview_lists() {
global $wpdb;
$table = REFM_Store::table( 'payouts' );
// phpcs:ignore WordPress.DB.DirectDatabaseQuery -- Custom affiliate tables have no WordPress CRUD API; read current totals, history and privacy records without stale cross-request caches.
$rows = $wpdb->get_results( $wpdb->prepare( 'SELECT * FROM %i WHERE trashed_at IS NULL ORDER BY id DESC LIMIT 5', $table ) );
echo '
';
if ( $record_actions ) {
self::record_views( $type, $trash );
if ( $trash ) {
echo '
' . esc_html__( 'Restore returns history to Records using the current rules. Delete permanently removes the record and cannot be undone. Cancelled withdrawals stay cancelled when restored.', 'refmora' ) . '
';
}
}
if ( 'payouts' === $type ) { echo '
' . esc_html__( 'Approve each request first. For manual methods, send money outside the plugin and choose Mark paid. For PayPal or Stripe, choose Send payment; completion requires provider confirmation. Sandbox/Test does not settle real earnings. Notes are visible to the affiliate.', 'refmora' ) . '
 . '){kind=icon}