<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* SessionClearanceManager class file.

[2] Fix | Delete

*/

[3] Fix | Delete

[4] Fix | Delete

declare( strict_types=1 );

[5] Fix | Delete

[6] Fix | Delete

namespace Automattic\WooCommerce\Internal\FraudProtection;

[7] Fix | Delete

[8] Fix | Delete

defined( 'ABSPATH' ) || exit;

[9] Fix | Delete

[10] Fix | Delete

/**

[11] Fix | Delete

* Manages session clearance state for fraud protection.

[12] Fix | Delete

*

[13] Fix | Delete

* This class handles the session status tracking for fraud protection decisions,

[14] Fix | Delete

* managing three possible states: pending, allowed, and blocked. It integrates

[15] Fix | Delete

* with WooCommerce sessions and uses the FraudProtectionController logging helper

[16] Fix | Delete

* to maintain consistent audit logs.

[17] Fix | Delete

*

[18] Fix | Delete

* @since 10.5.0

[19] Fix | Delete

* @internal This class is part of the internal API and is subject to change without notice.

[20] Fix | Delete

*/

[21] Fix | Delete

class SessionClearanceManager {

[22] Fix | Delete

[23] Fix | Delete

/**

[24] Fix | Delete

* Session key for storing clearance status.

[25] Fix | Delete

*/

[26] Fix | Delete

private const SESSION_KEY = '_fraud_protection_clearance_status';

[27] Fix | Delete

[28] Fix | Delete

/**

[29] Fix | Delete

* Session status: pending clearance.

[30] Fix | Delete

*/

[31] Fix | Delete

public const STATUS_PENDING = 'pending';

[32] Fix | Delete

[33] Fix | Delete

/**

[34] Fix | Delete

* Session status: allowed.

[35] Fix | Delete

*/

[36] Fix | Delete

public const STATUS_ALLOWED = 'allowed';

[37] Fix | Delete

[38] Fix | Delete

/**

[39] Fix | Delete

* Session status: blocked.

[40] Fix | Delete

*/

[41] Fix | Delete

public const STATUS_BLOCKED = 'blocked';

[42] Fix | Delete

[43] Fix | Delete

/**

[44] Fix | Delete

* Default session status.

[45] Fix | Delete

*/

[46] Fix | Delete

public const DEFAULT_STATUS = self::STATUS_ALLOWED;

[47] Fix | Delete

[48] Fix | Delete

/**

[49] Fix | Delete

* Check if the current session is allowed.

[50] Fix | Delete

*

[51] Fix | Delete

* @return bool True if session is allowed, false otherwise.

[52] Fix | Delete

*/

[53] Fix | Delete

public function is_session_allowed(): bool {

[54] Fix | Delete

$status = $this->get_session_status();

[55] Fix | Delete

return self::STATUS_ALLOWED === $status;

[56] Fix | Delete

}

[57] Fix | Delete

[58] Fix | Delete

/**

[59] Fix | Delete

* Check if the current session is blocked.

[60] Fix | Delete

*

[61] Fix | Delete

* @return bool True if session is blocked, false otherwise.

[62] Fix | Delete

*/

[63] Fix | Delete

public function is_session_blocked(): bool {

[64] Fix | Delete

$status = $this->get_session_status();

[65] Fix | Delete

return self::STATUS_BLOCKED === $status;

[66] Fix | Delete

}

[67] Fix | Delete

[68] Fix | Delete

/**

[69] Fix | Delete

* Mark the current session as allowed.

[70] Fix | Delete

*

[71] Fix | Delete

* @return void

[72] Fix | Delete

*/

[73] Fix | Delete

public function allow_session(): void {

[74] Fix | Delete

$this->set_session_status( self::STATUS_ALLOWED );

[75] Fix | Delete

$this->log_session_update_event( 'allowed' );

[76] Fix | Delete

}

[77] Fix | Delete

[78] Fix | Delete

/**

[79] Fix | Delete

* Mark the current session as pending (challenge required).

[80] Fix | Delete

*

[81] Fix | Delete

* @return void

[82] Fix | Delete

*/

[83] Fix | Delete

public function challenge_session(): void {

[84] Fix | Delete

$this->set_session_status( self::STATUS_PENDING );

[85] Fix | Delete

$this->log_session_update_event( 'challenged' );

[86] Fix | Delete

}

[87] Fix | Delete

[88] Fix | Delete

/**

[89] Fix | Delete

* Mark the current session as blocked and empty the cart.

[90] Fix | Delete

*

[91] Fix | Delete

* Emptying the cart prevents express payment methods (e.g., PayPal) from

[92] Fix | Delete

* rendering on cart pages, as they are loaded via third-party SDKs that

[93] Fix | Delete

* don't respect WooCommerce's payment method filtering.

[94] Fix | Delete

*

[95] Fix | Delete

* @return void

[96] Fix | Delete

*/

[97] Fix | Delete

public function block_session(): void {

[98] Fix | Delete

$this->set_session_status( self::STATUS_BLOCKED );

[99] Fix | Delete

$this->log_session_update_event( 'blocked' );

[100] Fix | Delete

$this->empty_cart();

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete

/**

[104] Fix | Delete

* Get the current session clearance status.

[105] Fix | Delete

*

[106] Fix | Delete

* @return string One of: pending, allowed, blocked.

[107] Fix | Delete

*/

[108] Fix | Delete

public function get_session_status(): string {

[109] Fix | Delete

if ( ! $this->is_session_available() ) {

[110] Fix | Delete

return self::DEFAULT_STATUS;

[111] Fix | Delete

}

[112] Fix | Delete

[113] Fix | Delete

$status = WC()->session->get( self::SESSION_KEY, self::DEFAULT_STATUS );

[114] Fix | Delete

[115] Fix | Delete

// Validate status value - return default for invalid values.

[116] Fix | Delete

if ( ! in_array( $status, array( self::STATUS_PENDING, self::STATUS_ALLOWED, self::STATUS_BLOCKED ), true ) ) {

[117] Fix | Delete

return self::DEFAULT_STATUS;

[118] Fix | Delete

}

[119] Fix | Delete

[120] Fix | Delete

return $status;

[121] Fix | Delete

}

[122] Fix | Delete

[123] Fix | Delete

/**

[124] Fix | Delete

* Set the session clearance status.

[125] Fix | Delete

*

[126] Fix | Delete

* @param string $status One of: pending, allowed, blocked.

[127] Fix | Delete

* @return void

[128] Fix | Delete

*/

[129] Fix | Delete

private function set_session_status( string $status ): void {

[130] Fix | Delete

if ( ! $this->is_session_available() ) {

[131] Fix | Delete

return;

[132] Fix | Delete

}

[133] Fix | Delete

[134] Fix | Delete

WC()->session->set( self::SESSION_KEY, $status );

[135] Fix | Delete

[136] Fix | Delete

// Ensure session cookie is set so the session persists across page loads.

[137] Fix | Delete

// This is important because fraud protection may set session status before

[138] Fix | Delete

// any cart action triggers the cookie to be set.

[139] Fix | Delete

// Skip cookie setting if headers have already been sent (e.g., in test environment).

[140] Fix | Delete

if ( WC()->session instanceof \WC_Session_Handler ) {

[141] Fix | Delete

WC()->session->set_customer_session_cookie( true );

[142] Fix | Delete

}

[143] Fix | Delete

}

[144] Fix | Delete

[145] Fix | Delete

/**

[146] Fix | Delete

* Reset the session clearance status to default (allowed).

[147] Fix | Delete

*

[148] Fix | Delete

* @return void

[149] Fix | Delete

*/

[150] Fix | Delete

public function reset_session(): void {

[151] Fix | Delete

$this->set_session_status( self::DEFAULT_STATUS );

[152] Fix | Delete

}

[153] Fix | Delete

[154] Fix | Delete

/**

[155] Fix | Delete

* Ensure cart and session are available.

[156] Fix | Delete

*

[157] Fix | Delete

* Loads cart if not already loaded, which initializes session for both

[158] Fix | Delete

* traditional (cookie) and Store API (token) flows.

[159] Fix | Delete

*

[160] Fix | Delete

* @return void

[161] Fix | Delete

*/

[162] Fix | Delete

public function ensure_cart_loaded(): void {

[163] Fix | Delete

if ( ! did_action( 'woocommerce_load_cart_from_session' ) && function_exists( 'wc_load_cart' ) ) {

[164] Fix | Delete

WC()->call_function( 'wc_load_cart' );

[165] Fix | Delete

}

[166] Fix | Delete

}

[167] Fix | Delete

[168] Fix | Delete

/**

[169] Fix | Delete

* Check if WooCommerce session is available.

[170] Fix | Delete

*

[171] Fix | Delete

* @return bool True if session is available.

[172] Fix | Delete

*/

[173] Fix | Delete

private function is_session_available(): bool {

[174] Fix | Delete

$this->ensure_cart_loaded();

[175] Fix | Delete

return WC()->session instanceof \WC_Session;

[176] Fix | Delete

}

[177] Fix | Delete

[178] Fix | Delete

/**

[179] Fix | Delete

* Get a unique identifier for the current session.

[180] Fix | Delete

*

[181] Fix | Delete

* @return string Session identifier.

[182] Fix | Delete

*/

[183] Fix | Delete

public function get_session_id(): string {

[184] Fix | Delete

if ( ! $this->is_session_available() ) {

[185] Fix | Delete

return 'no-session';

[186] Fix | Delete

}

[187] Fix | Delete

[188] Fix | Delete

// Use or generate a stable session ID for tracking consistency.

[189] Fix | Delete

$fraud_customer_session_id = WC()->session->get( '_fraud_protection_customer_session_id' );

[190] Fix | Delete

if ( ! $fraud_customer_session_id ) {

[191] Fix | Delete

$fraud_customer_session_id = WC()->call_function( 'wc_rand_hash', 'customer_', 30 );

[192] Fix | Delete

WC()->session->set( '_fraud_protection_customer_session_id', $fraud_customer_session_id );

[193] Fix | Delete

}

[194] Fix | Delete

return $fraud_customer_session_id;

[195] Fix | Delete

}

[196] Fix | Delete

[197] Fix | Delete

/**

[198] Fix | Delete

* Empty the cart.

[199] Fix | Delete

*

[200] Fix | Delete

* @return void

[201] Fix | Delete

*/

[202] Fix | Delete

private function empty_cart(): void {

[203] Fix | Delete

if ( function_exists( 'WC' ) && WC()->cart ) {

[204] Fix | Delete

WC()->cart->empty_cart();

[205] Fix | Delete

}

[206] Fix | Delete

}

[207] Fix | Delete

[208] Fix | Delete

/**

[209] Fix | Delete

* Log a session update event using FraudProtectionController's logging helper.

[210] Fix | Delete

*

[211] Fix | Delete

* @param string $action The action taken (allowed, challenged, or blocked).

[212] Fix | Delete

* @return void

[213] Fix | Delete

*/

[214] Fix | Delete

private function log_session_update_event( string $action ): void {

[215] Fix | Delete

$session_id = $this->get_session_id();

[216] Fix | Delete

$user_id = get_current_user_id();

[217] Fix | Delete

$user_info = $user_id ? "User: {$user_id}" : 'User: guest';

[218] Fix | Delete

$timestamp = current_time( 'mysql' );

[219] Fix | Delete

[220] Fix | Delete

$message = sprintf(

[221] Fix | Delete

'Session updated: %s | %s | Action: %s | Timestamp: %s',

[222] Fix | Delete

$session_id,

[223] Fix | Delete

$user_info,

[224] Fix | Delete

$action,

[225] Fix | Delete

$timestamp

[226] Fix | Delete

);

[227] Fix | Delete

[228] Fix | Delete

FraudProtectionController::log( 'info', $message );

[229] Fix | Delete

}

[230] Fix | Delete

}

[231] Fix | Delete

[232] Fix | Delete