<?php
/**
 * Token that marks a request as a Forensix scan request.
 *
 * @package ForensixDigital
 */

declare(strict_types=1);

namespace ForensixDigital\Services\Scan;

defined( 'ABSPATH' ) || exit;

/**
 * Scan requests send this token in a header. Only requests with a valid token get source markers
 * (D-21), so visitors never see them. The token lives a few hours and is renewed while scans run.
 */
final class ScanToken {

	public const OPTION = 'forensix_scan_token';
	public const HEADER = 'X-Forensix-Scan';

	private const LIFETIME = 6 * HOUR_IN_SECONDS;
	private const RENEW    = HOUR_IN_SECONDS;

	/**
	 * A valid token, created or renewed when it is missing or expires within the hour.
	 */
	public static function current(): string {
		$stored = get_option( self::OPTION );
		if ( is_array( $stored ) && isset( $stored['token'], $stored['expires'] ) && (int) $stored['expires'] - time() > self::RENEW ) {
			return (string) $stored['token'];
		}
		$token = wp_generate_password( 40, false );
		update_option(
			self::OPTION,
			array(
				'token'   => $token,
				'expires' => time() + self::LIFETIME,
			),
			false
		);
		return $token;
	}

	/**
	 * Whether a token is the current, unexpired one.
	 *
	 * @param string $given Token from a request.
	 */
	public static function verify( string $given ): bool {
		$stored = get_option( self::OPTION );
		if ( '' === $given || ! is_array( $stored ) || ! isset( $stored['token'], $stored['expires'] ) || (int) $stored['expires'] < time() ) {
			return false;
		}
		return hash_equals( (string) $stored['token'], $given );
	}

	/**
	 * Whether the current request carries a valid token.
	 */
	public static function is_scan_request(): bool {
		$header = 'HTTP_' . strtoupper( str_replace( '-', '_', self::HEADER ) );
		if ( ! isset( $_SERVER[ $header ] ) ) {
			return false;
		}
		return self::verify( sanitize_text_field( wp_unslash( (string) $_SERVER[ $header ] ) ) );
	}

	/**
	 * Removes the token, e.g. when the scan app is deactivated.
	 */
	public static function revoke(): void {
		delete_option( self::OPTION );
	}
}