unsupervised-scheduler/src/Payment/StudioSettings.php

<?php
declare(strict_types=1);

namespace Unsupervised\Schedular\Payment;

use Unsupervised\Schedular\Auth\RoleManager;
use Unsupervised\Schedular\Val;

class StudioSettings {

	public const OPT_PUBLISHABLE     = 'us_stripe_publishable_key';
	public const OPT_SECRET          = 'us_stripe_secret_key';
	public const OPT_WEBHOOK_SECRET  = 'us_stripe_webhook_secret';
	public const OPT_MODE            = 'us_stripe_mode';
	public const OPT_CURRENCY        = 'us_currency';
	public const OPT_ETRANSFER_EMAIL = 'us_etransfer_email';
	public const OPT_HST_RATE        = 'us_hst_rate';

	/**
	 * Studio-default cancellation cutoff, stored in hours. A student may not
	 * cancel a lesson once it starts within this many hours. Displayed to the
	 * admin in days; an offering may override it with its own hour value.
	 */
	public const OPT_CANCELLATION_CUTOFF_HOURS     = 'us_cancellation_cutoff_hours';
	public const DEFAULT_CANCELLATION_CUTOFF_HOURS = 24;

	public const OPT_REGISTRATION_MODE = 'us_registration_mode';
	public const MODE_INVITE           = 'invite';
	public const MODE_SELF_APPROVAL    = 'self_approval';

	/**
	 * Snapshots of the two core WordPress options this feature takes over while
	 * open registration is enabled, so disabling restores them exactly rather
	 * than clobbering a site that set them for its own reasons.
	 */
	public const OPT_PREV_USERS_CAN_REGISTER = 'us_registration_prev_can_register';
	public const OPT_PREV_DEFAULT_ROLE       = 'us_registration_prev_default_role';

	public function publishableKey(): string {
		return Val::string( get_option( self::OPT_PUBLISHABLE, '' ) );
	}

	public function secretKey(): string {
		return Val::string( get_option( self::OPT_SECRET, '' ) );
	}

	/**
	 * The Stripe webhook signing secret (`whsec_…`) used to verify that incoming
	 * webhook requests genuinely came from Stripe. Empty until configured.
	 */
	public function webhookSecret(): string {
		return Val::string( get_option( self::OPT_WEBHOOK_SECRET, '' ) );
	}

	public function mode(): string {
		return 'live' === get_option( self::OPT_MODE, 'test' ) ? 'live' : 'test';
	}

	public function currency(): string {
		$currency = Val::string( get_option( self::OPT_CURRENCY, 'CAD' ) );

		return '' !== $currency ? strtoupper( $currency ) : 'CAD';
	}

	/**
	 * The studio-default e-transfer destination email (used when an offering has
	 * no override).
	 */
	public function etransferEmail(): string {
		return Val::string( get_option( self::OPT_ETRANSFER_EMAIL, '' ) );
	}

	/**
	 * Default HST/tax rate as a percentage (e.g. 13.0). 0 means no tax.
	 */
	public function hstRate(): float {
		return max( 0.0, Val::float( get_option( self::OPT_HST_RATE, 0 ) ) );
	}

	/**
	 * The studio-default cancellation cutoff in hours: a student cannot cancel a
	 * lesson once it starts within this window. 0 means students may cancel any
	 * time. Offerings without their own override inherit this value.
	 */
	public function cancellationCutoffHours(): int {
		return max( 0, Val::int( get_option( self::OPT_CANCELLATION_CUTOFF_HOURS, self::DEFAULT_CANCELLATION_CUTOFF_HOURS ) ) );
	}

	/**
	 * Whether Stripe is configured. When false the platform falls back to
	 * e-transfer billing and card processing is unavailable.
	 */
	public function isStripeConfigured(): bool {
		return '' !== $this->publishableKey() && '' !== $this->secretKey();
	}

	/**
	 * Which student registration mode is active: `invite` (default) — only a
	 * valid invite token grants the registration form — or `self_approval` —
	 * anyone may sign up, confirm their email, and await studio approval.
	 */
	public function registrationMode(): string {
		return self::MODE_SELF_APPROVAL === get_option( self::OPT_REGISTRATION_MODE, self::MODE_INVITE )
			? self::MODE_SELF_APPROVAL
			: self::MODE_INVITE;
	}

	/**
	 * Whether anyone may self-register (the `self_approval` mode).
	 */
	public function openRegistrationEnabled(): bool {
		return self::MODE_SELF_APPROVAL === $this->registrationMode();
	}

	public function renderPage(): void {
		if ( ! current_user_can( RoleManager::CAP_MANAGE_BILLING ) ) {
			wp_die( esc_html__( 'You do not have permission to manage billing settings.', 'unsupervised-schedular' ) );
		}

		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_settings_action' ) ) {
			$this->save();
		}

		$publishableKey = $this->publishableKey();
		// Secrets are write-only in the UI: never echo a stored secret back into the
		// page. We only surface whether one is set so the field can be left blank to
		// keep the existing value.
		$secretKeySet     = '' !== $this->secretKey();
		$webhookSecretSet = '' !== $this->webhookSecret();
		$webhookUrl       = rest_url( 'us-scheduler/v1/payments/webhook' );
		$mode             = $this->mode();
		$currency         = $this->currency();
		$etransferEmail   = $this->etransferEmail();
		$hstRate          = $this->hstRate();
		$stripeConfigured = $this->isStripeConfigured();
		$openRegistration = $this->openRegistrationEnabled();
		// Stored in hours, surfaced to the admin in whole days.
		$cancellationCutoffDays = (int) round( $this->cancellationCutoffHours() / 24 );

		include USC_PLUGIN_DIR . 'templates/admin/settings.php';
	}

	private function save(): void {
		// Nonce is verified by the caller (renderPage) before this method runs.
		// phpcs:disable WordPress.Security.NonceVerification.Missing
		$mode = sanitize_key( Val::string( wp_unslash( $_POST['mode'] ?? 'test' ) ) );
		update_option( self::OPT_PUBLISHABLE, sanitize_text_field( Val::string( wp_unslash( $_POST['publishable_key'] ?? '' ) ) ) );
		// Secret fields are write-only: a blank submission keeps the stored secret,
		// so an admin saving other settings never wipes the keys.
		$secretKey = sanitize_text_field( Val::string( wp_unslash( $_POST['secret_key'] ?? '' ) ) );
		if ( '' !== $secretKey ) {
			update_option( self::OPT_SECRET, $secretKey );
		}
		$webhookSecret = sanitize_text_field( Val::string( wp_unslash( $_POST['webhook_secret'] ?? '' ) ) );
		if ( '' !== $webhookSecret ) {
			update_option( self::OPT_WEBHOOK_SECRET, $webhookSecret );
		}
		update_option( self::OPT_MODE, 'live' === $mode ? 'live' : 'test' );
		update_option( self::OPT_CURRENCY, strtoupper( sanitize_text_field( Val::string( wp_unslash( $_POST['currency'] ?? 'CAD' ) ) ) ) );
		update_option( self::OPT_ETRANSFER_EMAIL, sanitize_email( Val::string( wp_unslash( $_POST['etransfer_email'] ?? '' ) ) ) );
		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Val::float() coerces to float; slashes cannot survive numeric coercion.
		$hstRate = isset( $_POST['hst_rate'] ) ? Val::float( $_POST['hst_rate'] ) : 0.0;
		update_option( self::OPT_HST_RATE, max( 0.0, $hstRate ) );

		// The cutoff is entered in whole days but stored in hours.
		// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Val::int() coerces to int; slashes cannot survive numeric coercion.
		$cutoffDays = isset( $_POST['cancellation_cutoff_days'] ) ? max( 0, Val::int( $_POST['cancellation_cutoff_days'] ) ) : 0;
		update_option( self::OPT_CANCELLATION_CUTOFF_HOURS, $cutoffDays * 24 );

		$this->applyRegistrationMode( isset( $_POST['open_registration'] ) );
		// phpcs:enable WordPress.Security.NonceVerification.Missing
	}

	/**
	 * Enable or disable open (self-approval) registration, mirroring the change
	 * into the two core WordPress options it depends on.
	 *
	 * Enabling snapshots the current `users_can_register` and `default_role`,
	 * then turns registration on and makes Student the default new-user role.
	 * Disabling restores that snapshot, so this toggle never permanently
	 * overwrites a site's own membership settings. Only transitions act, so
	 * saving unrelated settings leaves the core options untouched.
	 */
	private function applyRegistrationMode( bool $enable ): void {
		$currentlyOpen = $this->openRegistrationEnabled();

		if ( $enable && ! $currentlyOpen ) {
			update_option( self::OPT_PREV_USERS_CAN_REGISTER, get_option( 'users_can_register' ) ? '1' : '0' );
			update_option( self::OPT_PREV_DEFAULT_ROLE, Val::string( get_option( 'default_role', 'subscriber' ) ) );

			update_option( 'users_can_register', '1' );
			update_option( 'default_role', RoleManager::STUDENT );
			update_option( self::OPT_REGISTRATION_MODE, self::MODE_SELF_APPROVAL );
			return;
		}

		if ( ! $enable && $currentlyOpen ) {
			$prevCanRegister = '1' === Val::string( get_option( self::OPT_PREV_USERS_CAN_REGISTER, '0' ) );
			$prevRole        = Val::string( get_option( self::OPT_PREV_DEFAULT_ROLE, 'subscriber' ) );

			update_option( 'users_can_register', $prevCanRegister ? '1' : '0' );
			update_option( 'default_role', '' !== $prevRole ? $prevRole : 'subscriber' );
			delete_option( self::OPT_PREV_USERS_CAN_REGISTER );
			delete_option( self::OPT_PREV_DEFAULT_ROLE );
			update_option( self::OPT_REGISTRATION_MODE, self::MODE_INVITE );
		}
	}
}