From 535dbda6b48171f8115b455e54790de94d97d42a Mon Sep 17 00:00:00 2001
From: Murilo Ijanc <murilo@ijanc.org>
Date: Sun, 26 Jul 2026 16:41:48 -0300
Subject: Initial import

---
 includes/class-cepis-woo-settings.php | 135 ++++++++++++++++++++++++++++++++++
 1 file changed, 135 insertions(+)
 create mode 100644 includes/class-cepis-woo-settings.php

(limited to 'includes/class-cepis-woo-settings.php')

diff --git a/includes/class-cepis-woo-settings.php b/includes/class-cepis-woo-settings.php
new file mode 100644
index 0000000..3fa73a1
--- /dev/null
+++ b/includes/class-cepis-woo-settings.php
@@ -0,0 +1,135 @@
+<?php
+/**
+ * The settings tab under WooCommerce.
+ *
+ * @package CepisWooCommerce
+ */
+
+declare(strict_types=1);
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * WooCommerce → Settings → CEP autofill.
+ *
+ * Extending `WC_Settings_Page` rather than rolling an options screen means the
+ * capability check, the `woocommerce-settings` nonce and the per-type
+ * sanitisation of every field come from WooCommerce, which is the code most
+ * likely to stay correct as WordPress changes. What is added on top is a
+ * second, explicit check on save and a stricter sanitiser for the one free-text
+ * field.
+ */
+final class Cepis_Woo_Settings extends WC_Settings_Page {
+
+	/**
+	 * Identify the tab.
+	 */
+	public function __construct() {
+		$this->id    = 'cepis';
+		$this->label = __( 'CEP autofill', 'cepis-woocommerce' );
+
+		parent::__construct();
+
+		add_filter( 'woocommerce_admin_settings_sanitize_option_cepis_woo_base_url', array( $this, 'sanitize_base_url' ) );
+	}
+
+	/**
+	 * The fields on the tab.
+	 *
+	 * @return array<int, array<string, mixed>>
+	 */
+	public function get_settings_for_default_section(): array {
+		return array(
+			array(
+				'title' => __( 'CEP autofill', 'cepis-woocommerce' ),
+				'type'  => 'title',
+				'desc'  => __( 'Fills the checkout address from the CEP the shopper types, using official Correios data (DNE) from cep.is.', 'cepis-woocommerce' ),
+				'id'    => 'cepis_woo_section',
+			),
+			array(
+				'title'   => __( 'Autofill', 'cepis-woocommerce' ),
+				'desc'    => __( 'Look the address up while the shopper types the CEP', 'cepis-woocommerce' ),
+				'id'      => 'cepis_woo_enabled',
+				'type'    => 'checkbox',
+				'default' => 'yes',
+			),
+			array(
+				'title'    => __( 'Lookups go through', 'cepis-woocommerce' ),
+				'id'       => 'cepis_woo_mode',
+				'type'     => 'radio',
+				'default'  => 'direct',
+				'options'  => array(
+					'direct' => __( 'The shopper’s browser, straight to cep.is (recommended)', 'cepis-woocommerce' ),
+					'proxy'  => __( 'This site, through the WordPress REST API', 'cepis-woocommerce' ),
+				),
+				'desc_tip' => __( 'A direct lookup hits an edge cache and costs this store nothing. Route it through the site when a Content-Security-Policy forbids external requests from the page, or to cache answers server-side.', 'cepis-woocommerce' ),
+			),
+			array(
+				'title'    => __( 'Fields already filled in', 'cepis-woocommerce' ),
+				'id'       => 'cepis_woo_overwrite',
+				'type'     => 'select',
+				'class'    => 'wc-enhanced-select',
+				'default'  => 'auto',
+				'options'  => array(
+					'auto'   => __( 'Keep what the shopper typed, replace what this plugin wrote', 'cepis-woocommerce' ),
+					'never'  => __( 'Only ever fill empty fields', 'cepis-woocommerce' ),
+					'always' => __( 'Always overwrite', 'cepis-woocommerce' ),
+				),
+				'desc_tip' => __( 'A shopper who corrects the street by hand should not see the correction undone by the next lookup.', 'cepis-woocommerce' ),
+			),
+			array(
+				'title'    => __( 'House number', 'cepis-woocommerce' ),
+				'desc'     => __( 'Move the cursor to the house-number field after a successful lookup', 'cepis-woocommerce' ),
+				'id'       => 'cepis_woo_focus_number',
+				'type'     => 'checkbox',
+				'default'  => 'yes',
+				'desc_tip' => __( 'Classic checkout only, and only when the store has a house-number field.', 'cepis-woocommerce' ),
+			),
+			array(
+				'title'    => __( 'API address', 'cepis-woocommerce' ),
+				'id'       => 'cepis_woo_base_url',
+				'type'     => 'url',
+				'default'  => Cepis_Woo_Options::DEFAULT_BASE_URL,
+				'desc_tip' => __( 'Leave as it is unless you run your own instance of the API.', 'cepis-woocommerce' ),
+			),
+			array(
+				'type' => 'sectionend',
+				'id'   => 'cepis_woo_section',
+			),
+		);
+	}
+
+	/**
+	 * Save the tab.
+	 *
+	 * WooCommerce already gates this screen, but the check is repeated here so
+	 * that the guarantee does not depend on a menu registration somewhere else
+	 * staying correct.
+	 */
+	public function save(): void {
+		if ( ! current_user_can( 'manage_woocommerce' ) ) {
+			wp_die( esc_html__( 'You are not allowed to change these settings.', 'cepis-woocommerce' ), 403 );
+		}
+
+		check_admin_referer( 'woocommerce-settings' );
+
+		$previous = Cepis_Woo_Options::base_url();
+
+		parent::save();
+
+		if ( Cepis_Woo_Options::base_url() !== $previous ) {
+			Cepis_Woo_Lookup::flush();
+		}
+	}
+
+	/**
+	 * Keep the API address to an absolute http(s) URL.
+	 *
+	 * @param mixed $value Whatever the form posted.
+	 */
+	public function sanitize_base_url( mixed $value ): string {
+		$url = esc_url_raw( trim( (string) $value ), array( 'http', 'https' ) );
+
+		return '' === $url ? Cepis_Woo_Options::DEFAULT_BASE_URL : untrailingslashit( $url );
+	}
+}
-- 
cgit v1.3