<?php
/**
 * Approved-product sync: is this answer really CortexCommerce's, for this store and this product, right now?
 *
 * @package CortexCommerce
 */

namespace CortexCommerce\Sync;

use CortexCommerce\Settings\Options;
use CortexCommerce\Support\Log;
use CortexCommerce\Support\SignedClient;
use CortexCommerce\Support\SignedResponse;

defined( 'ABSPATH' ) || exit;

/**
 * Contract §5d, version 2. A "get product X" answer is signed by the backend with this store's secret over the exact
 * bytes received (X-Cortex-Response-Signature), and names this store (tenant_id), the product asked for, the approval
 * (writeback_id), when it was issued (ts) and the nonce the plugin sent with the request. The signature is checked
 * before the body is read; then each of the others.
 *
 * Freshness comes from the nonce: it is new on every request, so an answer that echoes it was made for this request
 * and cannot be replayed. ts is only compared with the store's clock to log a drift, never to refuse: a store whose
 * clock is off would otherwise refuse every answer without anyone being told.
 *
 * Until the backend signs its answers, an unsigned answer is read as before (version 1). The first answer that verifies
 * switches the store to signed answers only, for as long as it stays connected: from then on an unsigned answer, like
 * any answer that fails a check, writes nothing.
 */
final class SyncAnswer {

	public const VERSION = 2;

	/**
	 * Seconds between an answer's ts and the store's clock beyond which the drift is logged (never refused).
	 */
	public const MAX_SKEW = 300;

	public const OK       = 'ok';
	public const LEGACY   = 'legacy';
	public const REFUSED  = 'refused';
	public const MISMATCH = 'mismatch';

	/**
	 * Why a signed answer cannot be trusted at all, as it reads in the log after "the (signed) answer for product N".
	 */
	private const REFUSALS = array(
		'signature' => 'has a signature that does not verify',
		'version'   => 'is not contract version ' . self::VERSION,
		'nonce'     => 'does not answer this request (nonce)',
	);

	/**
	 * A fresh, unguessable nonce for one request.
	 */
	public static function nonce(): string {
		return bin2hex( random_bytes( 16 ) );
	}

	/**
	 * Whether this store takes signed answers only.
	 *
	 * @phpstan-impure
	 */
	public static function signed_only(): bool {
		return '1' === get_option( Options::SYNC_SIGNED, '' );
	}

	/**
	 * OK (signed and every check passed), LEGACY (unsigned, and this store does not yet require signed answers),
	 * REFUSED (nothing in it can be trusted: no write and no report) or MISMATCH (signed by CortexCommerce, but for
	 * another store or product: no write, and the failure is reported). Every outcome but OK and LEGACY is logged.
	 */
	public static function check( SignedResponse $response, string $product_id, string $nonce ): string {
		if ( '' === $response->signature ) {
			return self::unsigned( $product_id );
		}
		$json    = is_array( $response->json ) ? $response->json : array();
		$refusal = self::refusal( $response, $json, $nonce );
		if ( '' !== $refusal ) {
			Log::error( sprintf( 'Approved-product sync: the %s for product %s %s; nothing written.', 'signature' === $refusal ? 'answer' : 'signed answer', $product_id, self::REFUSALS[ $refusal ] ) );
			return self::REFUSED;
		}
		self::log_clock_drift( $json );
		// Verified: from now on this store takes signed answers only.
		if ( ! self::signed_only() ) {
			update_option( Options::SYNC_SIGNED, '1', false );
		}
		$mismatch = self::mismatch( $json, $product_id );
		if ( '' !== $mismatch ) {
			Log::error( sprintf( 'Approved-product sync: the answer for product %s is for another %s; nothing written.', $product_id, $mismatch ) );
			return self::MISMATCH;
		}
		return self::OK;
	}

	private static function unsigned( string $product_id ): string {
		if ( ! self::signed_only() ) {
			return self::LEGACY;
		}
		Log::error( sprintf( 'Approved-product sync: the answer for product %s is not signed, and this store only takes signed answers; nothing written.', $product_id ) );
		return self::REFUSED;
	}

	/**
	 * The first REFUSALS key that applies, or '' when the signature, version and nonce all hold. The signature is
	 * checked first, on the raw bytes, before anything decoded from them is looked at.
	 *
	 * @param array<string, mixed> $json The decoded answer.
	 */
	private static function refusal( SignedResponse $response, array $json, string $nonce ): string {
		if ( ! SignedClient::verify_answer( $response->body, $response->signature ) ) {
			return 'signature';
		}
		if ( ! isset( $json['v'] ) || self::VERSION !== $json['v'] ) {
			return 'version';
		}
		if ( ! isset( $json['nonce'] ) || ! is_string( $json['nonce'] ) || ! hash_equals( $nonce, $json['nonce'] ) ) {
			return 'nonce';
		}
		return '';
	}

	/**
	 * A warning when the verified answer's ts and the store's clock differ by more than MAX_SKEW: the answer is still
	 * written (the nonce proved it fresh), and whoever reads the log learns the store's clock is off.
	 *
	 * @param array<string, mixed> $json The decoded, verified answer.
	 */
	private static function log_clock_drift( array $json ): void {
		if ( ! isset( $json['ts'] ) || ! is_int( $json['ts'] ) ) {
			return;
		}
		$drift = time() - $json['ts'];
		if ( abs( $drift ) > self::MAX_SKEW ) {
			Log::warning( sprintf( 'Approved-product sync: this store\'s clock differs from CortexCommerce\'s by %d seconds; answers are still checked by their nonce, but the server clock should be corrected.', $drift ) );
		}
	}

	/**
	 * 'store' or 'product' when the answer is for another one, '' when it names this store and this product.
	 *
	 * @param array<string, mixed> $json The decoded answer.
	 */
	private static function mismatch( array $json, string $product_id ): string {
		$tenant = isset( $json['tenant_id'] ) && is_string( $json['tenant_id'] ) ? $json['tenant_id'] : '';
		if ( '' === $tenant || ! hash_equals( Options::tenant_id(), $tenant ) ) {
			return 'store';
		}
		$answered = isset( $json['product_id'] ) && is_scalar( $json['product_id'] ) ? (string) $json['product_id'] : '';
		return $answered === $product_id ? '' : 'product';
	}
}