<?php
/**
 * Password-based archive encryption: Argon2id key derivation plus libsodium secretstream (XChaCha20-Poly1305).
 * Stream state is a binary string, passed by reference and updated per chunk, so a resumable job can persist it.
 *
 * @package Mench_Migrate
 */

defined( 'ABSPATH' ) || exit;

class Mench_Migrate_Crypto {

	/** True when this PHP can encrypt and decrypt archives. */
	public static function available(): bool {
		return function_exists( 'sodium_crypto_pwhash' )
			&& function_exists( 'sodium_crypto_secretstream_xchacha20poly1305_init_push' )
			&& defined( 'SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13' );
	}

	public static function new_salt(): string {
		return random_bytes( SODIUM_CRYPTO_PWHASH_SALTBYTES );
	}

	/** 32-byte key from a password and a 16-byte salt. */
	public static function derive_key( string $password, string $salt ): string {
		return sodium_crypto_pwhash(
			SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_KEYBYTES,
			$password,
			$salt,
			SODIUM_CRYPTO_PWHASH_OPSLIMIT_MODERATE,
			SODIUM_CRYPTO_PWHASH_MEMLIMIT_MODERATE,
			SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13
		);
	}

	/** @return array{state:string, header:string} */
	public static function encrypt_stream_init( string $key ): array {
		[ $state, $header ] = sodium_crypto_secretstream_xchacha20poly1305_init_push( $key );
		return [
			'state'  => $state,
			'header' => $header,
		];
	}

	/** $ad is authenticated but not encrypted; the archive passes the entry path so blocks cannot be moved between entries. */
	public static function encrypt_chunk( string &$state, string $plain, bool $final, string $ad = '' ): string {
		return sodium_crypto_secretstream_xchacha20poly1305_push(
			$state,
			$plain,
			$ad,
			$final ? SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_FINAL : SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_MESSAGE
		);
	}

	public static function decrypt_stream_init( string $key, string $header ): string {
		if ( SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_HEADERBYTES !== strlen( $header ) ) {
			throw new Mench_Migrate_Archive_Exception( 'bad_password_or_tampered', 'decrypt' );
		}
		return sodium_crypto_secretstream_xchacha20poly1305_init_pull( $header, $key );
	}

	/**
	 * @return array{plain:string, final:bool}
	 * @throws Mench_Migrate_Archive_Exception On authentication failure (wrong password or altered data).
	 */
	public static function decrypt_chunk( string &$state, string $cipher, string $ad = '' ): array {
		$res = sodium_crypto_secretstream_xchacha20poly1305_pull( $state, $cipher, $ad );
		if ( false === $res ) {
			throw new Mench_Migrate_Archive_Exception( 'bad_password_or_tampered', 'decrypt' );
		}
		return [
			'plain' => $res[0],
			'final' => SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_TAG_FINAL === $res[1],
		];
	}

	/** 32-byte MAC of an archive index under a subkey of the archive key (context "MMIGidx1", id 1). */
	public static function index_mac( string $key, string $index_json ): string {
		$subkey = sodium_crypto_kdf_derive_from_key( 32, 1, 'MMIGidx1', $key );
		return sodium_crypto_generichash( $index_json, $subkey, 32 );
	}

	/**
	 * The same MAC computed in pieces, for an index too large to hold in memory: feed it with
	 * sodium_crypto_generichash_update() and end with sodium_crypto_generichash_final( $state, 32 ).
	 */
	public static function index_mac_init( string $key ): string {
		return sodium_crypto_generichash_init( sodium_crypto_kdf_derive_from_key( 32, 1, 'MMIGidx1', $key ), 32 );
	}
}