class Spree::PriceHistory < Spree.base_class
  belongs_to :price, class_name: 'Spree::Price'
  belongs_to :variant, class_name: 'Spree::Variant'

  validates :amount, presence: true
  validates :currency, presence: true
  validates :recorded_at, presence: true

  scope :for_variant, ->(variant_id) { where(variant_id: variant_id) }
  scope :for_currency, ->(currency) { where(currency: currency) }
  scope :in_period, ->(from, to = Time.current) { where(recorded_at: from..to) }
  scope :recent, ->(days = 30) { in_period(days.days.ago) }
end

# In Spree::Price
class Spree::Price < Spree.base_class
  after_save :record_price_history, if: :should_record_price_history?

  private

  def should_record_price_history?
    price_list_id.nil? &&
      amount.present? &&
      saved_change_to_amount? &&
      Spree::Config[:track_price_history]
  end

  def record_price_history
    Spree::PriceHistory.create!(
      price: self,
      variant_id: variant_id,
      amount: amount,
      compare_at_amount: compare_at_amount,
      currency: currency,
      recorded_at: Time.current
    )
  end
end

# In Spree::Price
class Spree::Price < Spree.base_class
  has_many :price_histories, class_name: 'Spree::PriceHistory'

  def prior_price
    price_histories.where(recorded_at: 30.days.ago..).minimum(:amount)
  end
end

# lib/tasks/price_history.rake
namespace :spree do
  desc 'Seed price history from existing prices (run once after migration)'
  task seed_price_history: :environment do
    Spree::Price.where(deleted_at: nil, price_list_id: nil).find_each do |price|
      next if price.amount.nil?
      next if Spree::PriceHistory.exists?(price_id: price.id)

      Spree::PriceHistory.create!(
        price: price,
        variant_id: price.variant_id,
        amount: price.amount,
        compare_at_amount: price.compare_at_amount,
        currency: price.currency,
        recorded_at: price.updated_at || Time.current
      )
    end
  end
end

# lib/tasks/price_history.rake
namespace :spree do
  desc 'Prune price history older than retention period (per-store)'
  task prune_price_history: :environment do
    Spree::Store.find_each do |store|
      retention_days = store.preferences[:price_history_retention_days] || 30
      variant_ids = Spree::Product.joins(:stores).where(spree_stores: { id: store.id }).
        joins(:variants).pluck('spree_variants.id')

      next if variant_ids.empty?

      deleted = Spree::PriceHistory
        .where(variant_id: variant_ids)
        .where('recorded_at < ?', retention_days.days.ago)
        .delete_all

      puts "Store #{store.name}: pruned #{deleted} price history records older than #{retention_days} days"
    end
  end
end

# In Spree::Api::V3::ProductSerializer
typelize prior_price: 'number | null'

attribute :prior_price,
          if: proc { params[:expand]&.include?('prior_price') } do |product, params|
  currency = params[:currency] || Spree::Current.currency
  product.default_variant.price_in(currency)&.prior_price
end

# In Spree::Api::V3::VariantSerializer
typelize prior_price: 'number | null'

attribute :prior_price,
          if: proc { params[:expand]&.include?('prior_price') } do |variant, params|
  currency = params[:currency] || Spree::Current.currency
  variant.price_in(currency)&.prior_price
end

add_column :spree_users, :email_marketing_consent_updated_at, :datetime

# In Spree::UserMethods
before_save :track_marketing_consent_change, if: -> { will_save_change_to_attribute?('accepts_email_marketing') }

private

def track_marketing_consent_change
  self.email_marketing_consent_updated_at = Time.current
end

# In Spree::Api::V3::CustomerSerializer
attributes :accepts_email_marketing, :email_marketing_consent_updated_at

# GET /api/v3/store/customer/data_export
module Spree::Api::V3::Store
  class CustomerDataExportsController < BaseController
    before_action :require_authentication

    def show
      exporter = Spree::Customers::DataExporter.new(current_customer)
      render json: exporter.call
    end
  end
end

# core/app/services/spree/customers/data_exporter.rb
module Spree
  module Customers
    class DataExporter
      attr_reader :customer

      def initialize(customer)
        @customer = customer
      end

      def call
        {
          account: account_data,
          addresses: addresses_data,
          orders: orders_data,
          payment_sources: payment_sources_data,
          wishlists: wishlists_data,
          store_credits: store_credits_data,
          metafields: metafields_data,
          marketing_consent: marketing_consent_data,
          exported_at: Time.current.iso8601
        }
      end

      private

      def account_data
        {
          email: customer.email,
          first_name: customer.first_name,
          last_name: customer.last_name,
          phone: customer.try(:phone),
          created_at: customer.created_at&.iso8601,
          selected_locale: customer.try(:selected_locale)
        }
      end

      def addresses_data
        customer.addresses.not_deleted.map do |addr|
          {
            label: addr.label,
            first_name: addr.firstname,
            last_name: addr.lastname,
            address1: addr.address1,
            address2: addr.address2,
            city: addr.city,
            state: addr.state_text,
            postal_code: addr.zipcode,
            country: addr.country&.name,
            phone: addr.phone,
            company: addr.company
          }
        end
      end

      def orders_data
        customer.orders.complete.map do |order|
          {
            number: order.number,
            email: order.email,
            total: order.total&.to_s,
            currency: order.currency,
            completed_at: order.completed_at&.iso8601,
            special_instructions: order.special_instructions,
            billing_address: address_hash(order.bill_address),
            shipping_address: address_hash(order.ship_address),
            line_items: order.line_items.map { |li|
              { name: li.name, quantity: li.quantity, price: li.price&.to_s, currency: li.currency }
            }
          }
        end
      end

      def payment_sources_data
        customer.credit_cards.not_removed.map do |card|
          {
            type: card.cc_type,
            last_digits: card.last_digits,
            name: card.name,
            expiry_month: card.month,
            expiry_year: card.year
          }
        end
      end

      def wishlists_data
        return [] unless customer.respond_to?(:wishlists)

        customer.wishlists.map do |wishlist|
          {
            name: wishlist.name,
            items: wishlist.wished_items.map { |wi| { variant_id: wi.variant&.prefixed_id } }
          }
        end
      end

      def store_credits_data
        return [] unless customer.respond_to?(:store_credits)

        customer.store_credits.map do |credit|
          {
            amount: credit.amount&.to_s,
            currency: credit.currency,
            created_at: credit.created_at&.iso8601
          }
        end
      end

      def metafields_data
        return [] unless customer.respond_to?(:metafields)

        customer.metafields.where(visibility: 'public').map do |mf|
          { key: mf.key, value: mf.value, kind: mf.kind }
        end
      end

      def marketing_consent_data
        {
          accepts_email_marketing: customer.accepts_email_marketing,
          consent_updated_at: customer.try(:email_marketing_consent_updated_at)&.iso8601
        }
      end

      def address_hash(addr)
        return nil unless addr

        {
          first_name: addr.firstname,
          last_name: addr.lastname,
          address1: addr.address1,
          address2: addr.address2,
          city: addr.city,
          state: addr.state_text,
          postal_code: addr.zipcode,
          country: addr.country&.name,
          phone: addr.phone
        }
      end
    end
  end
end

# core/app/services/spree/customers/data_anonymizer.rb
module Spree
  module Customers
    class DataAnonymizer
      attr_reader :customer

      def initialize(customer)
        @customer = customer
      end

      # Returns true if anonymization was performed, false if blocked
      def call
        ActiveRecord::Base.transaction do
          anonymize_account
          anonymize_addresses
          anonymize_order_addresses
          anonymize_payment_sources
          anonymize_identities
          clear_metadata
          record_anonymization

          customer.publish_event('customer.anonymized')
        end

        true
      end

      private

      def anonymize_account
        anonymous_email = "anonymized+#{SecureRandom.uuid}@removed.invalid"
        customer.update!(
          email: anonymous_email,
          first_name: 'Anonymized',
          last_name: 'Customer',
          phone: nil,
          login: anonymous_email,
          accepts_email_marketing: false,
          email_marketing_consent_updated_at: Time.current,
          public_metadata: {},
          private_metadata: {}
        )
      end

      def anonymize_addresses
        customer.addresses.find_each do |addr|
          addr.update_columns(
            firstname: 'Anonymized',
            lastname: 'Customer',
            address1: 'Removed',
            address2: nil,
            city: 'Removed',
            phone: nil,
            company: nil,
            alternative_phone: nil,
            zipcode: addr.zipcode&.first(2)&.ljust(5, '*'), # Keep partial for tax jurisdiction
            deleted_at: Time.current
          )
        end
      end

      def anonymize_order_addresses
        # Anonymize billing/shipping addresses on completed orders
        # Preserve: country, state (needed for tax records), partial zip
        order_address_ids = customer.orders
          .pluck(:bill_address_id, :ship_address_id)
          .flatten.compact.uniq

        Spree::Address.where(id: order_address_ids).find_each do |addr|
          addr.update_columns(
            firstname: 'Anonymized',
            lastname: 'Customer',
            address1: 'Removed',
            address2: nil,
            phone: nil,
            company: nil,
            alternative_phone: nil,
            zipcode: addr.zipcode&.first(2)&.ljust(5, '*'),
            # Keep: city, state, country — needed for tax records
          )
        end
      end

      def anonymize_payment_sources
        customer.credit_cards.find_each do |card|
          card.update_columns(
            name: 'Anonymized',
            deleted_at: Time.current
          )
        end

        if customer.respond_to?(:gateway_customers)
          customer.gateway_customers.delete_all
        end
      end

      def anonymize_identities
        if customer.respond_to?(:user_identities)
          customer.user_identities.delete_all
        end
      end

      def clear_metadata
        # Clear order-level PII that isn't financial
        customer.orders.find_each do |order|
          order.update_columns(
            email: customer.email, # Already anonymized
            special_instructions: nil,
            last_ip_address: nil
          )
        end
      end

      def record_anonymization
        # Store anonymization record for compliance audit
        # Uses private_metadata on the user since they're already anonymized
        metadata = (customer.private_metadata || {}).merge(
          anonymized_at: Time.current.iso8601,
          anonymization_version: '1.0'
        )
        customer.update_column(:private_metadata, metadata)
      end
    end
  end
end

# DELETE /api/v3/store/customer
# Requires authentication + password confirmation
module Spree::Api::V3::Store
  class CustomersController < ResourceController
    # ... existing actions ...

    def destroy
      unless current_customer.valid_password?(params[:current_password])
        render json: { error: 'Invalid password' }, status: :unauthorized
        return
      end

      anonymizer = Spree::Customers::DataAnonymizer.new(current_customer)
      anonymizer.call

      head :no_content
    end
  end
end

class Spree::Market < Spree.base_class
  # Legal settings
  attribute :withdrawal_period_days, :integer, default: 14
  attribute :price_history_display_days, :integer, default: 30
  attribute :data_retention_days, :integer  # nil = indefinite
  attribute :legal_entity_name, :string
  attribute :legal_entity_address, :text
end

# In Spree::Store preferences
preference :withdrawal_period_days, :integer, default: 14

class Spree::Order < Spree.base_class
  # Set on completion based on market/store config
  attribute :withdrawal_eligible_until, :datetime

  after_transition to: :complete, do: :set_withdrawal_deadline

  private

  def set_withdrawal_deadline
    days = store.preferred_withdrawal_period_days || 14
    update_column(:withdrawal_eligible_until, completed_at + days.days)
  end
end

# In Spree::Api::V3::OrderSerializer
typelize withdrawal_eligible_until: 'string | null'
attribute :withdrawal_eligible_until do |order|
  order.withdrawal_eligible_until&.iso8601
end

class AddEuLegalComplianceFields < ActiveRecord::Migration[7.2]
  def change
    # Price history
    create_table :spree_price_histories do |t|
      t.references :price, null: false
      t.references :variant, null: false
      t.decimal :amount, precision: 10, scale: 2, null: false
      t.decimal :compare_at_amount, precision: 10, scale: 2
      t.string :currency, null: false
      t.datetime :recorded_at, null: false
      t.datetime :created_at, null: false
    end

    add_index :spree_price_histories, [:variant_id, :currency, :recorded_at],
              name: 'idx_price_histories_variant_currency_recorded'
    add_index :spree_price_histories, [:price_id, :recorded_at],
              name: 'idx_price_histories_price_recorded'
    add_index :spree_price_histories, :recorded_at,
              name: 'idx_price_histories_recorded_at'

    # Marketing consent timestamp
    add_column :spree_users, :email_marketing_consent_updated_at, :datetime

    # Withdrawal period
    add_column :spree_orders, :withdrawal_eligible_until, :datetime
  end
end

bundle exec rake spree:price_history:seed   # Snapshot existing prices