<?php
/**
 * File Path: includes/export/class-mbs-settings-io-keys.php
 *
 * Settings IO — Shared Exclusion Keys
 *
 * Single authoritative source for the EXCLUDED_KEYS list consumed by both
 * MBS_Settings_Exporter and MBS_Tab_Child_Settings_Import.
 *
 * This file exists to avoid duplicating the exclusion list across the two
 * classes. Any Sprint 13+ additions to the list (e.g. new encrypted
 * credentials, new internal-only option keys) go here and only here.
 *
 * Rules for this list (SECURITY.md Rule 1 / Rule 2):
 *   · All encrypted credential keys must be present.
 *   · All license-state keys must be present — they are site-specific
 *     and must never travel with a settings export.
 *   · Payment processor secrets must be present (S-03).
 *   · Internal cache and manifest keys must be present.
 *
 * @package    My_Book_Showroom
 * @since      1.0.0
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class MBS_Settings_IO_Keys { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- mbs_/MBS_ prefix is correct; scanner not configured with plugin prefix

	/** wp_options keys that are NEVER included in exports or applied on import. */
	const EXCLUDED_KEYS = array(
		'mbs_license_key_encrypted',
		'mbs_api_secret_encrypted',
		'mbs_license_tier',
		'mbs_license_tier_hmac', // SEC-1: HMAC binding — site-specific; must never travel in exports.
		'mbs_license_registered',
		'mbs_license_last_ping',
		'mbs_license_activated_at',   // SEC-022: site-specific activation timestamp -- must never travel in exports.
		'mbs_license_sites_used',     // SEC-022: site-specific usage count -- must never travel in exports.
		'mbs_license_sites_allowed',  // SEC-022: site-specific seat limit -- must never travel in exports.
		'mbs_api_nonce',    // SEC-04: importing another site's nonce breaks all HMAC-signed requests on the receiving site
		'mbs_tamper_flag',  // SEC-04: importing another site's tamper state resets legitimate tamper detection
		'mbs_setting_import_amazon_api_key_encrypted',
		'mbs_setting_import_amazon_api_secret_encrypted',
		'mbs_db_version',
		'mbs_install_timestamp',  // V3-E-018: site-specific install date -- must never travel in exports.
		'mbs_dummy_book_installed',
		// Internal cache and manifest keys
		'mbs_license_request_log',
		'mbs_file_hashes_cache',
		'mbs_manifest_cache',
		'mbs_manifest_version',
		'mbs_wizard_completed',
		// S-03: Payment processor secrets must never appear in exports.
		'mbs_setting_payment_stripe_webhook_secret_encrypted',
		'mbs_setting_payment_paypal_webhook_secret_encrypted',
		// F-006: Telemetry privacy keys are site-specific and must never travel in exports.
		'mbs_telemetry_consent',         // User privacy preference -- site-specific.
		'mbs_telemetry_deferred',        // User privacy preference -- site-specific.
		'mbs_telemetry_failure_counts',  // Site-specific diagnostic data.
		// F-026: ESP API keys and account URLs -- encrypted; must never appear in exports.
		'mbs_setting_email_mailchimp_api_key',
		'mbs_setting_email_mailerlite_api_key',
		'mbs_setting_email_convertkit_api_key',
		'mbs_setting_email_brevo_api_key',
		'mbs_setting_email_sendy_api_key',
		'mbs_setting_email_sendy_url',
		'mbs_setting_email_activecampaign_api_key',
		'mbs_setting_email_activecampaign_url',
		'mbs_setting_email_getresponse_api_key',
		'mbs_setting_email_campaignmonitor_api_key',
		'mbs_setting_email_moosend_api_key',
		'mbs_setting_email_flodesk_api_key',
		'mbs_setting_email_authoremail_api_key',
		// F-027: CAPTCHA provider key pairs -- encrypted; must never appear in exports.
		'mbs_setting_email_captcha_recaptcha_v3_site_key',
		'mbs_setting_email_captcha_recaptcha_v3_secret_key',
		'mbs_setting_email_captcha_hcaptcha_site_key',
		'mbs_setting_email_captcha_hcaptcha_secret_key',
		'mbs_setting_email_captcha_turnstile_site_key',
		'mbs_setting_email_captcha_turnstile_secret_key',
		// Spec 2 (Cookie Analytics): tracking ID encrypted; must never appear in exports.
		'mbs_setting_analytics_id',
	);

	/**
	 * Return the exclusion key list.
	 *
	 * Thin accessor so callers (MBS_Tab_Child_Settings_Import) do not
	 * need to reference the class constant directly.
	 *
	 * @return string[]
	 */
	public static function get_excluded_keys(): array {
		return self::EXCLUDED_KEYS;
	}
}
