<?php

/**
 * Copyright 2024-2025 Simply.IN Sp. z o.o.
 *
 * NOTICE OF LICENSE
 *
 * Licensed under the EUPL-1.2 or later.
 * You may not use this work except in compliance with the Licence.
 *
 * Copy of the Licence is available at:
 * https://joinup.ec.europa.eu/software/page/eupl
 * It is bundled with this package in the file LICENSE.txt
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the Licence is distributed on an as is basis,
 * without warranties or conditions of any kind, either express or implied.
 * Check the Licence for the specific language governing permissions
 * and limitations under the License.
 *
 * @author   Simply.IN Sp. z o.o.
 * @copyright 2024-2025 Simply.IN Sp. z o.o.
 * @license   https://joinup.ec.europa.eu/software/page/eupl
 */

declare(strict_types=1);

namespace SimplyIn\Payment;

use Order;
use Simplyin;
use Validate;

if (!defined('_PS_VERSION_')) {
    exit;
}

/**
 * The order named by an order id and a payment-retry token, or null when the pair proves nothing.
 *
 * Shared by every endpoint that has to prove "this caller may act on this specific order" from an
 * order id and a token alone, with no session to fall back on - the payment-retry submission and
 * the order-confirmation poll's decision recheck both resolve through here rather than each
 * carrying its own copy of the same checks.
 */
final class RetryOrderResolver
{
    public static function resolve(Simplyin $module, int $idOrder, string $token): ?Order
    {
        // POST only. The token authorises the caller and does not expire, so accepting it from a
        // query string would make whatever this resolves to reachable by following a link -
        // true of a payment resubmission and just as true of reading this order's retry state.
        if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
            return null;
        }

        if (!$idOrder || $token === '') {
            return null;
        }

        $order = new Order($idOrder);
        if (!Validate::isLoadedObject($order)) {
            return null;
        }

        $expected = (string) $module->getPaymentRetryToken((int) $order->id, (string) $order->secure_key);

        return hash_equals($expected, $token) ? $order : null;
    }
}
