Profesja, która wymaga sterylności. Również technicznej.

// Cron 'pricing_excel_sync' uruchamiany co 5 minut przez wp_schedule_event
// Plik /srv/shared/cennik.xlsx parsowany, mapowany do CPT 'zabieg', upsert po SKU

add_action('pricing_excel_sync', 'lps_sync_pricing_from_excel');

function lps_sync_pricing_from_excel(): void {
    $file = '/srv/shared/cennik.xlsx';

    if (! file_exists($file)) {
        error_log('[lps] Excel file not found: ' . $file);
        return;
    }

    // mtime check - pomijamy jeśli plik się nie zmienił
    $last_sync = get_option('lps_pricing_last_sync', 0);
    if (filemtime($file) <= $last_sync) {
        return;
    }

    $spreadsheet = \PhpOffice\PhpSpreadsheet\IOFactory::load($file);
    $rows = $spreadsheet->getActiveSheet()->toArray();
    array_shift($rows);  // header

    foreach ($rows as $row) {
        [$sku, $name, $category, $price, $promo, $desc] = $row;
        if (!$sku) continue;

        // idempotentny upsert po SKU
        $existing = lps_find_zabieg_by_sku($sku);
        $data = [
            'post_title' => $name,
            'post_type'  => 'zabieg',
            'post_status'=> 'publish',
            'meta_input' => [
                'sku'         => $sku,
                'category'    => $category,
                'price'       => $price,
                'promo_price' => $promo ?: null,
                'description' => $desc,
            ],
        ];

        if ($existing) {
            $data['ID'] = $existing->ID;
            wp_update_post($data);
        } else {
            wp_insert_post($data);
        }
    }

    update_option('lps_pricing_last_sync', time());
    error_log('[lps] Cennik zsync, wierszy: ' . count($rows));
}

// Hook do submission Contact Form 7
add_action('wpcf7_before_send_mail', 'lps_send_to_clinic_system', 10, 3);

function lps_send_to_clinic_system($contact_form, &$abort, $submission): void {
    $data = $submission->get_posted_data();

    $payload = [
        'first_name' => sanitize_text_field($data['first-name'] ?? ''),
        'last_name'  => sanitize_text_field($data['last-name'] ?? ''),
        'email'      => sanitize_email($data['email'] ?? ''),
        'phone'      => sanitize_text_field($data['phone'] ?? ''),
        'message'    => sanitize_textarea_field($data['message'] ?? ''),
        'zabieg_id'  => intval($data['zabieg-id'] ?? 0),
        'source'     => 'website-form',
        'created_at' => current_time('mysql'),
    ];

    // loguj zgody RODO przed wysłaniem (patrz blok 3)
    lps_log_rodo_consents($data, $payload);

    $response = wp_remote_post(LPS_CLINIC_API_URL . '/patients/inquiry', [
        'headers' => [
            'Authorization' => 'Bearer ' . LPS_CLINIC_API_TOKEN,
            'Content-Type'  => 'application/json',
        ],
        'body'    => wp_json_encode($payload),
        'timeout' => 10,
    ]);

    if (is_wp_error($response) || wp_remote_retrieve_response_code($response) >= 400) {
        // fallback - mail do recepcji + alert do admina
        error_log('[lps] Clinic API failed, falling back to email');
        lps_fallback_email_to_reception($payload);
        // nie przerywamy submission - pacjentka dostaje thank-you
    } else {
        lps_log_successful_inquiry($payload, $response);
    }
}

// Tabela wp_lps_consent_log utworzona w migracji aktywacji motywu
// Zawiera: id, timestamp, ip_hash, consent_version, consents_json,
//          consent_texts (snapshot klauzul z dnia), form_payload_hash

function lps_log_rodo_consents(array $form_data, array $payload): void {
    global $wpdb;

    $consents = [
        'contact'   => !empty($form_data['consent-contact']),
        'marketing' => !empty($form_data['consent-marketing']),
        'profiling' => !empty($form_data['consent-profiling']),
    ];

    // aktualnie obowiązująca wersja klauzul
    $consent_version = get_option('lps_consent_version', '2026-01-01');
    $consent_texts   = get_option('lps_consent_texts_' . $consent_version);

    $wpdb->insert(
        $wpdb->prefix . 'lps_consent_log',
        [
            'timestamp'         => current_time('mysql'),
            'ip_hash'           => hash('sha256', $_SERVER['REMOTE_ADDR'] ?? 'unknown'),
            'consent_version'   => $consent_version,
            'consents_json'     => wp_json_encode($consents),
            'consent_texts'     => wp_json_encode($consent_texts),
            'form_payload_hash' => hash('sha256', wp_json_encode($payload)),
        ]
    );
}