fix(instanda): content-based dedupe, resubmit guards, PII retention

- F-01: derive the dedupe key from submission content (form id + mapped values)
  instead of a per-request token, so identical re-POSTs / retry-after-error
  collapse to the existing quote. Keeps the per-request lock; adds a content lock
  race guard and a 30-min recent_delivered_by_dedupe short-circuit.
- F-12: refuse resubmit of an already-delivered transaction (AJAX + worker).
- F-18: scope the resubmit self-recovery guard to the content dedupe key so a
  customer's different event is no longer skipped.
- F-05: anonymize PII on stale failed/pending rows via the cron; add delete_by_email
  and wire WP's Erase Personal Data eraser.
- F-13: exempt stranded delivered rows (no entry_id) from the retention purge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
2026-07-02 16:06:13 -06:00
co-authored by Claude Fable 5
parent 4d7abdbb3b
commit 2b1c226d46
5 changed files with 127 additions and 19 deletions
@@ -136,15 +136,21 @@ final class Resubmit_Handler {
if ($tx === null) {
return;
}
if ($tx->status === Tx_Status::Delivered->value) {
$store->append_event($tx_id, 'Resubmit blocked - already delivered (would duplicate the quote).', 'error');
return;
}
if ($tx->environment !== Config::environment()->value) {
$store->append_event($tx_id, 'Resubmit blocked - cross-environment.', 'error');
return;
}
// Self-recovery guard: skip if the customer already has a recent successful quote.
$recent = $store->recent_success_for_email($tx->customer_email, DAY_IN_SECONDS);
// Self-recovery guard: skip only when an IDENTICAL submission already delivered
// recently. Scoped to the content dedupe key so a customer's different event
// (different key) is never blocked.
$recent = $store->recent_delivered_by_dedupe($tx->dedupe_key, Submission::DEDUPE_WINDOW);
if ($recent !== null && $recent->id !== $tx->id) {
$store->append_event($tx_id, 'Resubmit skipped - customer already has a recent successful quote.');
$store->append_event($tx_id, 'Resubmit skipped - an identical submission already has a recent quote.');
return;
}