<?php
/**
 * The chain's signing key.
 *
 * @package ActivityLog404
 */

namespace ActivityLog404\Chain;

defined( 'ABSPATH' ) || exit;

/**
 * Derived from the secrets in wp-config.php, never stored.
 *
 * The whole point of a keyed chain is that someone who can write to the
 * database but cannot read the site's files cannot make an edited log
 * verify. That holds only while the key is NOT in the database, so:
 *
 *  - an explicit `OPS404_ACTIVITY_LOG_CHAIN_KEY` constant in wp-config.php
 *    wins (for owners who want a key of their own, or one that survives a
 *    salt rotation);
 *  - otherwise the key is derived from the secure-auth key and salt;
 *  - and when WordPress has no such constants and generated its salts into
 *    the options table instead (wp_salt() does exactly that), the key
 *    exists but is readable with the same access that could edit the log.
 *    The chain still detects accidents and casual edits, and the tab says
 *    plainly that it does not protect against a database-only attacker on
 *    that site (config_backed()).
 *
 * The key is mixed with the site id on a network, so one site's rows cannot
 * be moved to another's table and still verify.
 */
final class Key {

	/** The optional wp-config.php constant. */
	public const CONSTANT = 'OPS404_ACTIVITY_LOG_CHAIN_KEY';

	/** @var array<int, string> Per-site key cache for the request. */
	private static array $cache = array();

	/** The signing key for the current site. */
	public static function get(): string {
		$site = function_exists( 'get_current_blog_id' ) ? (int) get_current_blog_id() : 1;

		if ( ! isset( self::$cache[ $site ] ) ) {
			$secret = self::explicit();
			if ( '' === $secret ) {
				$secret = wp_salt( 'secure_auth' );
			}

			self::$cache[ $site ] = hash_hmac( 'sha256', 'ops404-activity-log-chain-v1|' . $site, $secret );
		}

		return self::$cache[ $site ];
	}

	/**
	 * A short public identifier of the key, stored beside the state it signs
	 * so a changed key (rotated salts) is reported as that rather than as a
	 * wall of forged rows. It reveals nothing usable about the key.
	 *
	 * @param string $key Signing key.
	 */
	public static function fingerprint( string $key ): string {
		return substr( hash_hmac( 'sha256', 'fingerprint', $key ), 0, 16 );
	}

	/**
	 * Whether the key comes from wp-config.php rather than from the options
	 * table. See the class docblock for what that decides.
	 */
	public static function config_backed(): bool {
		if ( '' !== self::explicit() ) {
			return true;
		}

		foreach ( array( 'SECURE_AUTH_KEY', 'SECURE_AUTH_SALT' ) as $name ) {
			if ( ! defined( $name ) ) {
				return false;
			}

			$value = (string) constant( $name );
			if ( '' === $value || 'put your unique phrase here' === $value ) {
				return false;
			}
		}

		return true;
	}

	/** Forget the cached key (tests, and a restart after the constant changes). */
	public static function reset(): void {
		self::$cache = array();
	}

	private static function explicit(): string {
		if ( ! defined( self::CONSTANT ) ) {
			return '';
		}

		$value = constant( self::CONSTANT );
		return is_string( $value ) ? $value : '';
	}
}