<?php
/**
 * Keeps third-party credentials encrypted at rest.
 *
 * @package ForensixDigital
 */

declare(strict_types=1);

namespace ForensixDigital\Services\Security;

defined( 'ABSPATH' ) || exit;

/**
 * Libsodium secretbox with a key derived from FORENSIX_ENCRYPTION_KEY (if defined in wp-config.php)
 * or the WordPress salts (section 8.3). Changing the salts makes stored secrets unreadable;
 * the user then enters them again.
 */
final class Vault {

	/**
	 * Encryption key, 32 bytes.
	 *
	 * @var string
	 */
	private string $key;

	/**
	 * Creates a vault.
	 *
	 * @param string $secret Secret material to derive the key from.
	 */
	public function __construct( string $secret ) {
		$this->key = sodium_crypto_generichash( 'fxd-credentials|' . $secret, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES );
	}

	/**
	 * The vault for this site.
	 */
	public static function default(): self {
		$secret = \ForensixDigital\Core\PrefixMigration::config( 'ENCRYPTION_KEY' ) ?? wp_salt( 'auth' ) . wp_salt( 'secure_auth' );
		return new self( $secret );
	}

	/**
	 * Encrypts text.
	 *
	 * @param string $plain Plain text.
	 */
	public function lock( string $plain ): string {
		$nonce = random_bytes( SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
		return base64_encode( $nonce . sodium_crypto_secretbox( $plain, $nonce, $this->key ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Storage encoding of ciphertext.
	}

	/**
	 * Decrypts text, or returns "" when it cannot be read.
	 *
	 * @param string $locked Encrypted text.
	 */
	public function unlock( string $locked ): string {
		$raw = base64_decode( $locked, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Storage encoding of ciphertext.
		if ( ! is_string( $raw ) || strlen( $raw ) <= SODIUM_CRYPTO_SECRETBOX_NONCEBYTES ) {
			return '';
		}
		$plain = sodium_crypto_secretbox_open( substr( $raw, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES ), substr( $raw, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES ), $this->key );
		return is_string( $plain ) ? $plain : '';
	}
}