<?php
namespace StoreSuit;
defined( 'ABSPATH' ) || exit;
// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Messages are returned as JSON by Admin::ajax() and shown with textContent; HTML output escapes them where printed.

/** A narrow contact correction, independent of the locked money and fulfilment editor. */
final class OrderContact {
    public static function save_email( int $id, array $data ): array {
        Store::require_cap( 'storesuit_orders' );
        if ( empty( $data['confirmed'] ) ) { throw new \InvalidArgumentException( I18n::t( 'Confirm the order email address before saving.' ) ); }
        $request = Store::text( $data, 'request_key' );
        if ( ! preg_match( '/^[a-zA-Z0-9_-]{16,80}$/', $request ) ) { throw new \InvalidArgumentException( I18n::t( 'The action key is missing. Refresh the page.' ) ); }
        $email = Store::text( $data, 'email' );
        if ( strlen( $email ) > 254 || ! is_email( $email ) ) { throw new \InvalidArgumentException( I18n::t( 'Enter a valid order email address.' ) ); }
        $expected = Store::text( $data, 'expected_email' );
        // The new address is part of the request: correcting a typo is a new request, not a repeat of the first one.
        Store::once( 'order-email:' . $id . ':' . $request . ':' . substr( hash( 'sha256', strtolower( $email ) ), 0, 16 ), static function () use ( $id, $expected, $email ) {
            return Store::lock( 'order-' . $id, static function () use ( $id, $expected, $email ) {
                $order = Orders::get( $id );
                $previous = (string) $order->get_billing_email();
                if ( ! hash_equals( $previous, $expected ) ) { throw new \RuntimeException( I18n::t( 'The order email changed elsewhere. Refresh the order and check it again.' ) ); }
                if ( $previous === $email ) { return array( 'changed'=>false ); }
                $order->set_billing_email( $email );
                $order->save();
                clean_post_cache( $id );
                Store::audit( 'order', $id, 'order_email_updated' );
                return array( 'changed'=>true );
            } );
        } );
        return Orders::summary( Orders::get( $id ) );
    }
}