<?php
/**
 * Fires on "Delete" from the WP admin plugin list (after deactivation). If the shop has a
 * registered RSA key, best-effort asks the backend to revoke that registration before
 * clearing local state, so a deleted shop does not leave an orphaned, still-active
 * credential behind. Then clears the local RSA key material and the webhook signing secret
 * so a later reinstall always starts a fresh pairing with the backend, rather than resuming
 * with stale credentials. Does not remove the merchant API key option. Deactivation alone
 * intentionally leaves this state untouched.
 *
 * WordPress executes this file standalone (never the plugin's main file), so this resolves
 * the backend URL itself (Simplyin_Env, bootstrap-free) and passes it to a revoke call that
 * reuses only the signing mechanism (Plugin_Rsa_Signer), not the runtime HTTP client — see
 * Plugin_Rsa_Registrar::revoke(). Any failure (unreachable backend, already revoked, signing
 * unavailable) is caught and logged: deleting the plugin must never hang or fail on this
 * network call.
 */

if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
	exit;
}

require_once __DIR__ . '/vendor/autoload.php';
require_once __DIR__ . '/Simplyin_Env.php';

use Simplyin\Simplyin_W_Plugin\Lib\Remote\Sin_Core_Api\Plugin_Rsa_Registrar;
use Simplyin\Simplyin_W_Plugin\Lib\Remote\Sin_Core_Api\Plugin_Rsa_Signer;

$simplyin_rsa_signer = new Plugin_Rsa_Signer();

if ( $simplyin_rsa_signer->is_registered() ) {
	try {
		( new Plugin_Rsa_Registrar( $simplyin_rsa_signer ) )->revoke( Simplyin_Env::resolve_backend_url() );
	} catch ( \Throwable $e ) {
		error_log( '[Simplyin] uninstall: RSA public key revoke failed — ' . $e->getMessage() );
	}
}

$simplyin_rsa_signer->clear();

delete_option( 'simplyin_plugin_payment_webhook_secret' );
