<?php
/**
 * Canonical JSON and HMAC signing for API requests and webhooks, matching Python's
 * json.dumps(data, separators=(",", ":"), sort_keys=True) and
 * HMAC-SHA256(key, timestamp + json_string).
 *
 * @package CryptowayButton
 */

namespace CryptowayButton;

defined( 'ABSPATH' ) || exit;

final class Signature {

    /** Skew tolerance for incoming webhooks, in seconds (outgoing requests must be within ±15 s). */
    public const WEBHOOK_TOLERANCE = 300;

    private function __construct() {}

    /**
     * Canonical JSON: object keys sorted recursively, list order kept, non-ASCII escaped,
     * slashes not. Objects must be stdClass so that {} and [] stay distinct.
     */
    public static function canonical( mixed $data ): string {
        // Floats must print the shortest round-trip form ("30.26"), as Python does.
        // Some php.ini files set serialize_precision to 17, which breaks every signature
        // over a fractional amount, so it is pinned around this call only.
        $previous = ini_get( 'serialize_precision' );

        if ( '-1' !== $previous ) {
            // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- serialize_precision is pinned for the signature and restored below.
            @ini_set( 'serialize_precision', '-1' );
        }

        try {
            return json_encode(
                self::sort_recursive( $data ),
                JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR
            );
        } finally {
            if ( '-1' !== $previous && false !== $previous ) {
                // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- restores the value pinned above.
                @ini_set( 'serialize_precision', $previous );
            }
        }
    }

    /** HMAC-SHA256 of the timestamp followed by the canonical JSON of $data. */
    public static function sign( int $timestamp, mixed $data, string $secret ): string {
        return hash_hmac( 'sha256', (string) $timestamp . self::canonical( $data ), $secret );
    }

    /** Whether $candidate is the signature of $data at $timestamp. */
    public static function verify( string $candidate, int $timestamp, mixed $data, string $secret ): bool {
        if ( '' === $candidate || '' === $secret ) {
            return false;
        }

        // A body that cannot be canonicalised (json_decode turns 1e999 into INF) cannot
        // match. This runs before authentication, so it must not throw a 500.
        try {
            $expected = self::sign( $timestamp, $data, $secret );
        } catch ( \JsonException $e ) {
            return false;
        }

        return hash_equals( $expected, $candidate );
    }

    /**
     * Envelope for outgoing API requests: params + body + path.
     *
     * @param array|\stdClass $body Request body; for GET pass new stdClass().
     */
    public static function api_envelope( string $path, string $params, array|\stdClass $body ): \stdClass {
        $envelope         = new \stdClass();
        $envelope->params = $params;
        $envelope->body   = is_array( $body ) && [] === $body ? new \stdClass() : self::to_object( $body );
        $envelope->path   = $path;
        return $envelope;
    }

    /** Associative array -> stdClass (lists stay arrays). */
    public static function to_object( mixed $value ): mixed {
        if ( $value instanceof \stdClass ) {
            foreach ( $value as $k => $v ) {
                $value->{$k} = self::to_object( $v );
            }
            return $value;
        }

        if ( ! is_array( $value ) ) {
            return $value;
        }

        if ( self::is_list( $value ) ) {
            return array_map( [ self::class, 'to_object' ], $value );
        }

        $object = new \stdClass();
        foreach ( $value as $k => $v ) {
            $object->{(string) $k} = self::to_object( $v );
        }
        return $object;
    }

    private static function sort_recursive( mixed $value ): mixed {
        if ( $value instanceof \stdClass ) {
            $pairs = (array) $value;
            ksort( $pairs, SORT_STRING );
            $sorted = new \stdClass();
            foreach ( $pairs as $k => $v ) {
                $sorted->{(string) $k} = self::sort_recursive( $v );
            }
            return $sorted;
        }

        if ( ! is_array( $value ) ) {
            return $value;
        }

        // A list: order matters, keys are not sorted.
        if ( self::is_list( $value ) ) {
            return array_map( [ self::class, 'sort_recursive' ], $value );
        }

        // An associative array is a JSON object.
        ksort( $value, SORT_STRING );
        $sorted = new \stdClass();
        foreach ( $value as $k => $v ) {
            $sorted->{(string) $k} = self::sort_recursive( $v );
        }
        return $sorted;
    }

    private static function is_list( array $array ): bool {
        if ( [] === $array ) {
            return true;
        }
        return array_keys( $array ) === range( 0, count( $array ) - 1 );
    }
}