<?php
namespace Advently\Security;

defined( 'ABSPATH' ) || exit;

/**
 * Cookie value "id.signature" that only this site can produce.
 *
 * The subscriber id alone would let anyone claim any subscriber; the HMAC ties
 * it to a site secret, so nothing has to be stored per device and the same
 * person can use several browsers.
 */
final class SignedId {

	/** @var string */
	private $key;

	public function __construct( string $key ) {
		$this->key = $key;
	}

	public function sign( int $id ): string {
		return $id . '.' . $this->mac( $id );
	}

	/**
	 * The id, or null when the value is malformed or was not signed with this key.
	 */
	public function verify( string $value ): ?int {
		if ( ! preg_match( '/^([1-9][0-9]{0,18})\.([0-9a-f]{64})$/', $value, $m ) ) {
			return null;
		}
		$id = (int) $m[1];
		return hash_equals( $this->mac( $id ), $m[2] ) ? $id : null;
	}

	private function mac( int $id ): string {
		return hash_hmac( 'sha256', 'advently-subscriber|' . $id, $this->key );
	}
}