<?php

declare(strict_types=1);

namespace FreshetBackup\Dropbox;

// phpcs:disable WordPress.Security.EscapeOutput.ExceptionNotEscaped -- exception messages are escaped where they are printed (Admin).

use FreshetBackup\DestinationError;
use FreshetBackup\Http\Transport;

/**
 * Connecting a site to Dropbox from the screen: OAuth's code flow with PKCE,
 * so no app secret ships in the plugin.
 *
 * Dropbox only redirects back to a URL registered on the app beforehand, by
 * exact match, which no plugin installed on any number of sites can know. So
 * the authorize URL carries no redirect_uri: Dropbox shows the code on its own
 * page, the administrator pastes it into the screen, and the site exchanges it
 * together with the code_verifier it kept. A code is worthless without that
 * verifier, and the verifier never leaves the site.
 */
final class Authorization
{
    /**
     * The key of the Freshet Backup app on Dropbox: public by design — a PKCE
     * app has no secret. FRESHET_BACKUP_DROPBOX_APP_KEY on its own (without a
     * secret) connects through an app of your own instead.
     */
    public const FRESHET_APP_KEY = 's8d181jx3sgjeo8';

    public const AUTHORIZE = 'https://www.dropbox.com/oauth2/authorize';
    private const TOKEN = 'https://api.dropboxapi.com/oauth2/token';

    /** 64 characters from the unreserved set, as RFC 7636 asks (43-128). */
    public static function verifier(): string
    {
        return self::base64url(random_bytes(48));
    }

    public static function challenge(string $verifier): string
    {
        return self::base64url(hash('sha256', $verifier, true));
    }

    public static function url(string $appKey, string $verifier): string
    {
        return self::AUTHORIZE . '?' . http_build_query([
            'client_id'             => $appKey,
            'response_type'         => 'code',
            'token_access_type'     => 'offline',
            'code_challenge'        => self::challenge($verifier),
            'code_challenge_method' => 'S256',
        ], '', '&', PHP_QUERY_RFC3986);
    }

    /** Trade the pasted code for a refresh token, which does not expire. */
    public static function exchange(Transport $http, string $appKey, string $code, string $verifier): string
    {
        $response = $http->send('POST', self::TOKEN, [
            'Content-Type' => 'application/x-www-form-urlencoded',
        ], http_build_query([
            'grant_type'    => 'authorization_code',
            'code'          => $code,
            'client_id'     => $appKey,
            'code_verifier' => $verifier,
        ]), 30);

        $data = $response['status'] === 200 ? json_decode($response['body'], true) : null;
        $token = is_array($data) ? (string) ($data['refresh_token'] ?? '') : '';
        if ($token !== '' && preg_match('/^[A-Za-z0-9._~-]+$/', $token)) {
            return $token;
        }

        $error = json_decode($response['body'], true);
        $reason = is_array($error) ? (string) ($error['error'] ?? '') : '';
        if ($reason === 'invalid_grant') {
            throw new DestinationError(__('Dropbox did not accept that code. Codes work once, for a few minutes, and only with the Connect Dropbox link on this screen. Press Connect Dropbox again and paste the new code.', 'freshet-backup'));
        }

        throw new DestinationError(sprintf(
            /* translators: %s: Dropbox's error code, or the connection error */
            __('Dropbox did not complete the connection (%s), so nothing was changed. Press Connect Dropbox again. If it keeps failing, the readme explains how to connect with your own Dropbox app.', 'freshet-backup'),
            $reason !== '' ? $reason : ($response['error'] ?? 'HTTP ' . $response['status'])
        ));
    }

    private static function base64url(string $bytes): string
    {
        return rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
    }
}