<?php
/** Encrypted, user/purpose-bound short-lived previews; no staged upload or DB write. */
namespace Abientot\Import;
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}
final class Token {
	private static function key(): string {
		return hash( 'sha256', wp_salt( 'auth' ) . '|abientot-import-v1|' . (string) get_option( 'abientot_import_preview_epoch', '' ), true );
	}
	public static function seal( string $purpose, array $payload, int $user, ?int $now = null ): string {
		if ( $user < 1 || ! in_array( $purpose, array( 'upload', 'preview', 'rollback', 'privacy_retention' ), true ) || ! function_exists( 'openssl_encrypt' ) ) {
			throw new \RuntimeException( 'import_token' );
		}
		$now  = $now ?? time();
		$data = wp_json_encode(
			array(
				'version' => 1,
				'purpose' => $purpose,
				'user'    => $user,
				'expires' => $now + 1200,
				'payload' => $payload
			)
		);
		if ( ! is_string( $data ) || strlen( $data ) > 1048576 ) {
			throw new \DomainException( 'import_token' );
		}
		$iv        = random_bytes( 12 );
		$tag       = '';
		$encrypted = openssl_encrypt( $data, 'aes-256-gcm', self::key(), OPENSSL_RAW_DATA, $iv, $tag, 'abientot-import-v1', 16 );
		if ( $encrypted === false ) {
			throw new \RuntimeException( 'import_token' );
		}
		return rtrim( strtr( base64_encode( $iv . $tag . $encrypted ), '+/', '-_' ), '=' );
	}
	public static function open( string $token, string $purpose, int $user, ?int $now = null ): array {
		if ( strlen( $token ) > 1500000 || ! preg_match( '/^[a-zA-Z0-9_-]+$/D', $token ) ) {
			throw new \DomainException( 'import_token' );
		}
		$raw = base64_decode( strtr( $token, '-_', '+/' ), true );
		if ( $raw === false || strlen( $raw ) < 29 ) {
			throw new \DomainException( 'import_token' );
		}
		$data = openssl_decrypt( substr( $raw, 28 ), 'aes-256-gcm', self::key(), OPENSSL_RAW_DATA, substr( $raw, 0, 12 ), substr( $raw, 12, 16 ), 'abientot-import-v1' );
		if ( $data === false ) {
			throw new \DomainException( 'import_token' );
		}
		$payload = json_decode( $data, true, 32, JSON_THROW_ON_ERROR );
		$now     = $now ?? time();
		if ( ! is_array( $payload ) || ( $payload['version'] ?? null ) !== 1 || ( $payload['purpose'] ?? '' ) !== $purpose || ( $payload['user'] ?? null ) !== $user || ( $payload['expires'] ?? 0 ) < $now || ! is_array( $payload['payload'] ?? null ) ) {
			throw new \DomainException( 'import_token' );
		}
		return $payload['payload'];
	}
	public static function digest( $payload ): string {
		return hash_hmac( 'sha256', wp_json_encode( $payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES ), hash( 'sha256', wp_salt( 'auth' ) . '|abientot-import-ledger-v1', true ) );
	}
}