<?php
/**
 * Remove what this plugin put in the database.
 *
 * Run by WordPress when the plugin is deleted, not when it is deactivated.
 *
 * Everything here is this site's own bookkeeping: the connection, the webhook
 * secret, the form mappings and the WooCommerce trigger, the per-document
 * status rows and the maps from a document back to its order or entry, and
 * the short-lived tokens and caches. None of it is evidence — the
 * documents, their certificates and their audit trails are at SignSealer and
 * are untouched by deleting this plugin, which is the point of never having
 * kept them here.
 *
 * The connection is forgotten but not revoked. Revoking is the business's to
 * do from its own account under Developers → Connected apps; a plugin being
 * deleted is not proof that the person deleting it speaks for the business.
 *
 * @package SignSealer
 */

defined( 'WP_UNINSTALL_PLUGIN' ) || exit;

/**
 * Everything the plugin stored on the current site.
 *
 * Run once per site on a network (see the bottom of this file), and once on
 * a single site.
 */
function signsealer_uninstall_site() {
	global $wpdb;

	/*
		Transients by name first. On a site with a persistent object cache
		(Redis, Memcached) a transient lives only in the cache, never in the
		options table, and the cache cannot list keys by prefix: what is not
		named here is not found below. The replay guard's markers, one per
		delivery, are named by the index the webhook keeps of them (Codex, on
		#372). The message kept across a redirect (1.5.0) is per
		administrator and lives a minute: the one deleting is named here,
		anybody else's is gone before it could matter.
	*/
	foreach ( array( 'signsealer_access_token', 'signsealer_pkce_verifier', 'signsealer_pending_client', 'signsealer_site_token', 'signsealer_lists', 'signsealer_texting', 'signsealer_setup_tried', 'signsealer_questions', 'signsealer_notice_' . get_current_user_id() ) as $transient ) {
		delete_transient( $transient );
	}
	$seen = get_option( 'signsealer_seen_index', array() );
	if ( is_array( $seen ) ) {
		foreach ( array_keys( $seen ) as $transient ) {
			delete_transient( (string) $transient );
		}
	}
	/*
		What each visitor's address has started this hour (1.14.4), kept in
		256 buckets named by two hex digits so that this can name every one
		(`SignSealer_Throttle`).
	*/
	for ( $signsealer_bucket = 0; $signsealer_bucket < 256; $signsealer_bucket++ ) {
		delete_transient( 'signsealer_rate_' . sprintf( '%02x', $signsealer_bucket ) );
	}

	/*
		Then every row in the options table with the plugin's name on it: the
		connection, the webhook secret, the form mappings, the WooCommerce
		trigger, the replay index, and the rows that have no fixed names --
		one status row, and one map back to its order or entry, per document
		(`signsealer_status_`, `signsealer_wc_doc_`, `signsealer_form_doc_`)
		-- and, on a site without an object cache, the transients' own rows.

		Found with one query and deleted one by one through WordPress, not
		with a `DELETE ... LIKE`. The per-document rows are stored with
		autoload off, so a persistent object cache holds each under its own
		key, and a direct delete would leave those copies for a reinstall to
		read (Codex, on #372). `delete_option` and `delete_transient` take the
		cached copy with the row.

		The one prefix covers the next option somebody adds, so an uninstall
		that forgets one is not possible to write (1.4.1 did: the form
		mappings, the trigger and both maps stayed behind).
		`wordpress/tests/uninstall.php` checks that nothing named for the
		plugin survives, in the table or through the options API, on every
		site of a network.

		What stays is what belongs to the shop, not to the plugin: the note
		and the document id on each WooCommerce order and form entry are that
		order's own history, and the documents, their certificates and their
		audit trails are at SignSealer.
	*/

	/*
		A direct query, and the two things a reviewer should want said about
		one.

		**Why not an API.** There is no API that lists options by prefix. The
		rows have no fixed names -- one per document id -- so the only way to
		find them is a pattern, and the only thing that takes a pattern is
		SQL. The name fragments are run through `esc_like` and the whole
		thing through `prepare`, so the pattern is data rather than syntax.
		It only reads: every deletion goes through the options API.

		**Why no cache.** This runs once, when the plugin is being deleted,
		on a request nobody is waiting for, and its answer is used at once.
	*/
	// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- See above: no API lists options by prefix, and this is the deletion path.
	$rows = $wpdb->get_col(
		$wpdb->prepare(
			"SELECT option_name FROM {$wpdb->options} WHERE option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s",
			$wpdb->esc_like( 'signsealer_' ) . '%',
			$wpdb->esc_like( '_transient_signsealer_' ) . '%',
			$wpdb->esc_like( '_transient_timeout_signsealer_' ) . '%'
		)
	);
	// phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	foreach ( $rows as $row ) {
		if ( 0 === strpos( $row, '_transient_timeout_' ) ) {
			/* Either half of a transient is enough to name it; deleting it takes both. */
			delete_transient( substr( $row, strlen( '_transient_timeout_' ) ) );
		} elseif ( 0 === strpos( $row, '_transient_' ) ) {
			delete_transient( substr( $row, strlen( '_transient_' ) ) );
		} else {
			delete_option( $row );
		}
	}
}

/*
	On a network, every site's. WordPress runs this file once, on the site
	the network admin deleted the plugin from, and each site keeps its own
	options table and its own corner of the object cache: a sweep of that
	site alone would leave every other site's connection, webhook secret and
	mappings behind (Codex, on #372). That holds whether the plugin was
	network-activated or switched on site by site, so every site is swept,
	including ones that never used it -- on those the sweep finds nothing.
	`switch_to_blog` moves both `$wpdb->options` and the object cache to the
	site being swept. The plugin keeps nothing network-wide (no site
	options), so there is nothing to sweep above the sites.
*/
if ( is_multisite() ) {
	foreach ( get_sites(
		array(
			'fields' => 'ids',
			'number' => 0,
		)
	) as $signsealer_site ) {
		switch_to_blog( (int) $signsealer_site );
		signsealer_uninstall_site();
		restore_current_blog();
	}
} else {
	signsealer_uninstall_site();
}