core/src/Order/Privacy/OrderDataProvider.php

<?php

namespace Modules\Core\Order\Privacy;

use Lunar\Models\Order;
use Lunar\Models\OrderAddress;
use Modules\Core\Privacy\Contracts\PersonalDataProvider;
use Modules\Core\Privacy\DTOs\CustomerSubject;
use Modules\Core\Privacy\Enums\ErasureOutcome;
use Modules\Core\Privacy\DTOs\ProviderErasureResult;
use Modules\Core\Privacy\DTOs\ProviderExportResult;
use Modules\Core\Privacy\DTOs\UserSubject;

/**
 * Orders and order addresses (lunar_orders, lunar_order_addresses) belong to the
 * Customer (business account) via customer_id, not to an individual User, so this
 * is Customer-scope only. They're also subject to legal retention (tax/accounting
 * law generally requires invoices be kept for several years — GDPR Art. 17(3)(b)
 * explicitly allows this to override an erasure request). eraseForCustomer()
 * therefore pseudonymizes the PII-bearing free-text fields in place rather than
 * deleting the order: totals, line items, tax data, and the order itself all
 * remain intact and auditable.
 */
class OrderDataProvider implements PersonalDataProvider
{
    public function name(): string
    {
        return 'orders';
    }

    public function exportForCustomer(CustomerSubject $subject): ProviderExportResult
    {
        $orders = Order::where('customer_id', $subject->customerId)->with('addresses')->get();

        return new ProviderExportResult('orders', $orders->map(fn (Order $order) => [
            'id' => $order->id,
            'reference' => $order->reference,
            'status' => $order->status,
            'total' => $order->total?->decimal(),
            'placed_at' => $order->placed_at?->toIso8601String(),
            'addresses' => $order->addresses->map(fn (OrderAddress $address) => [
                'type' => $address->type,
                'first_name' => $address->first_name,
                'last_name' => $address->last_name,
                'line_one' => $address->line_one,
                'city' => $address->city,
                'postcode' => $address->postcode,
                'contact_email' => $address->contact_email,
                'contact_phone' => $address->contact_phone,
            ])->all(),
        ])->all());
    }

    public function exportForUser(UserSubject $subject): ProviderExportResult
    {
        return new ProviderExportResult('orders', []);
    }

    public function eraseForCustomer(CustomerSubject $subject): ProviderErasureResult
    {
        $orderIds = Order::where('customer_id', $subject->customerId)->pluck('id');

        if ($orderIds->isEmpty()) {
            return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'No orders for this customer.');
        }

        Order::whereIn('id', $orderIds)->update([
            'customer_reference' => null,
            'notes' => null,
        ]);

        OrderAddress::whereIn('order_id', $orderIds)->update([
            'title' => null,
            'first_name' => 'Erased',
            'last_name' => 'Customer',
            'company_name' => null,
            'tax_identifier' => null,
            'line_one' => null,
            'line_two' => null,
            'line_three' => null,
            'delivery_instructions' => null,
            'contact_email' => null,
            'contact_phone' => null,
        ]);

        return new ProviderErasureResult(
            'orders',
            ErasureOutcome::Pseudonymized,
            'Order and address free-text fields cleared; order records, totals, and line items retained for legal/tax record-keeping.'
        );
    }

    public function eraseForUser(UserSubject $subject): ProviderErasureResult
    {
        return new ProviderErasureResult('orders', ErasureOutcome::Skipped, 'Orders belong to Customer accounts, not individual users.');
    }
}