<?php

/**
 * Copyright 2024-2025 Simply.IN Sp. z o.o.
 *
 * NOTICE OF LICENSE
 *
 * Licensed under the EUPL-1.2 or later.
 * You may not use this work except in compliance with the Licence.
 *
 * Copy of the Licence is available at:
 * https://joinup.ec.europa.eu/software/page/eupl
 * It is bundled with this package in the file LICENSE.txt
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the Licence is distributed on an as is basis,
 * without warranties or conditions of any kind, either express or implied.
 * Check the Licence for the specific language governing permissions
 * and limitations under the License.
 *
 * @author   Simply.IN Sp. z o.o.
 * @copyright 2024-2025 Simply.IN Sp. z o.o.
 * @license   https://joinup.ec.europa.eu/software/page/eupl
 */

declare(strict_types=1);

namespace SimplyIn\Payment;

if (!defined('_PS_VERSION_')) {
    exit;
}

/**
 * Makes a stored attempt's payment type safe to place inside a log line.
 *
 * The type reaches storage from the shopper's own request and is only length-capped on the way in
 * - not fit to print as-is: a control character in it (a newline, in particular) would let a
 * forged entry be planted inside the one log line meant to explain what happened. Keep the
 * printable ASCII range and drop the rest; this is a diagnostic aid, not a contract, so lossy
 * sanitisation is the right trade here. Shared by every call site that logs a payment type
 * ({@see PaymentCreationService::createPayment()}, {@see PaymentReconciliationSweep}) so the rule
 * lives in one place rather than being re-derived per caller.
 */
final class LogSafePaymentType
{
    public static function sanitize(string $paymentType): string
    {
        return (string) preg_replace('/[^\x20-\x7e]/', '', $paymentType);
    }
}
