<?php
/**
 * Persists the single Mobile_App_Config plus its long-lived signing
 * secrets (the PKCS#12 keystore blob and its password), the latter
 * encrypted at rest via Secret_Box.
 *
 * One app per site for now — the option holds a single record, not a
 * keyed list like Project_Store.
 *
 * @package Esipher
 */

namespace Esipher;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Simple load/save over three options.
 */
class Mobile_App_Store {

	const OPTION_CONFIG         = 'esipher_mobile_app';
	const OPTION_KEYSTORE_P12   = 'esipher_mobile_app_keystore';
	const OPTION_KEYSTORE_PASS  = 'esipher_mobile_app_keystore_pass';
	const OPTION_ASC_KEY_P8     = 'esipher_mobile_app_asc_key';
	const OPTION_IOS_P12        = 'esipher_mobile_app_ios_p12';
	const OPTION_IOS_P12_PASS   = 'esipher_mobile_app_ios_p12_pass';
	const OPTION_IOS_PROFILE    = 'esipher_mobile_app_ios_profile';

	/**
	 * @return Mobile_App_Config|null Null until the app is first configured.
	 */
	public function get() {
		$raw = get_option( self::OPTION_CONFIG, null );

		if ( ! is_array( $raw ) ) {
			return null;
		}

		return Mobile_App_Config::from_array( $raw );
	}

	/**
	 * @param Mobile_App_Config $config
	 */
	public function save( Mobile_App_Config $config ) {
		update_option( self::OPTION_CONFIG, $config->to_array(), false );
	}

	/**
	 * @return bool Whether a signing keystore has been generated and stored.
	 */
	public function has_keystore() {
		return '' !== (string) get_option( self::OPTION_KEYSTORE_P12, '' );
	}

	/**
	 * @param string $p12_base64 Base64 of the raw .p12 bytes.
	 * @param string $password   The keystore password.
	 */
	public function save_keystore( $p12_base64, $password ) {
		update_option( self::OPTION_KEYSTORE_P12, Secret_Box::encrypt( $p12_base64 ), false );
		update_option( self::OPTION_KEYSTORE_PASS, Secret_Box::encrypt( $password ), false );
	}

	/**
	 * @return string Base64 of the .p12 bytes, or '' if none stored.
	 */
	public function keystore_base64() {
		return Secret_Box::decrypt( (string) get_option( self::OPTION_KEYSTORE_P12, '' ) );
	}

	/**
	 * @return string The keystore password, or '' if none stored.
	 */
	public function keystore_password() {
		return Secret_Box::decrypt( (string) get_option( self::OPTION_KEYSTORE_PASS, '' ) );
	}

	/**
	 * @return bool Whether an App Store Connect .p8 key is stored.
	 */
	public function has_asc_key() {
		return '' !== (string) get_option( self::OPTION_ASC_KEY_P8, '' );
	}

	/**
	 * @param string $p8 The full ".p8" file contents (PEM).
	 */
	public function save_asc_key( $p8 ) {
		update_option( self::OPTION_ASC_KEY_P8, Secret_Box::encrypt( $p8 ), false );
	}

	/**
	 * @return string The ".p8" contents, or '' if none stored.
	 */
	public function asc_key() {
		return Secret_Box::decrypt( (string) get_option( self::OPTION_ASC_KEY_P8, '' ) );
	}

	/**
	 * @return bool Whether an iOS distribution certificate + profile have
	 *              been provisioned and stored.
	 */
	public function has_ios_signing() {
		return '' !== (string) get_option( self::OPTION_IOS_P12, '' )
			&& '' !== (string) get_option( self::OPTION_IOS_PROFILE, '' );
	}

	/**
	 * @param string $p12_base64             Base64 of the .p12 bytes.
	 * @param string $p12_password           The .p12 password.
	 * @param string $mobileprovision_base64 Base64 of the .mobileprovision.
	 */
	public function save_ios_signing( $p12_base64, $p12_password, $mobileprovision_base64 ) {
		update_option( self::OPTION_IOS_P12, Secret_Box::encrypt( $p12_base64 ), false );
		update_option( self::OPTION_IOS_P12_PASS, Secret_Box::encrypt( $p12_password ), false );
		update_option( self::OPTION_IOS_PROFILE, Secret_Box::encrypt( $mobileprovision_base64 ), false );
	}

	/**
	 * @return string Base64 of the .p12 bytes, or ''.
	 */
	public function ios_p12_base64() {
		return Secret_Box::decrypt( (string) get_option( self::OPTION_IOS_P12, '' ) );
	}

	/**
	 * @return string The .p12 password, or ''.
	 */
	public function ios_p12_password() {
		return Secret_Box::decrypt( (string) get_option( self::OPTION_IOS_P12_PASS, '' ) );
	}

	/**
	 * @return string Base64 of the .mobileprovision, or ''.
	 */
	public function ios_mobileprovision_base64() {
		return Secret_Box::decrypt( (string) get_option( self::OPTION_IOS_PROFILE, '' ) );
	}

	/**
	 * Discard the stored iOS signing so the next build re-provisions
	 * (used when the App Store Connect key changes, or on demand).
	 */
	public function clear_ios_signing() {
		delete_option( self::OPTION_IOS_P12 );
		delete_option( self::OPTION_IOS_P12_PASS );
		delete_option( self::OPTION_IOS_PROFILE );
	}

	/**
	 * Forget the app config. Deliberately KEEPS the Android keystore and
	 * the App Store Connect key: re-adding an app for the same store
	 * listing must reuse the identical signing key, and the .p8 can only
	 * be downloaded from Apple once. A user who truly wants a clean
	 * break can clear those options from the database themselves.
	 */
	public function delete_config() {
		delete_option( self::OPTION_CONFIG );
	}
}