<?php
/**
 * Keeps a job's archive password out of job state: encrypted with a key derived from the auth salt and held in a
 * one-day transient named after the job. The password never reaches state.json or job.log.
 *
 * @package Mench_Migrate
 */

defined( 'ABSPATH' ) || exit;

final class Mench_Migrate_Secrets {

	public const TRANSIENT = 'mench_migrate_pw_';

	public static function stash( string $job_id, string $password ): void {
		$nonce = random_bytes( SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
		$box   = sodium_crypto_secretbox( $password, $nonce, self::key() );
		set_transient( self::TRANSIENT . $job_id, [ 'nonce' => base64_encode( $nonce ), 'box' => base64_encode( $box ) ], DAY_IN_SECONDS );
	}

	/** The stashed password, or null when it expired, was forgotten or the salt changed. */
	public static function read( string $job_id ): ?string {
		$t     = get_transient( self::TRANSIENT . $job_id );
		$nonce = is_array( $t ) ? base64_decode( (string) ( $t['nonce'] ?? '' ), true ) : false;
		$box   = is_array( $t ) ? base64_decode( (string) ( $t['box'] ?? '' ), true ) : false;
		if ( ! is_string( $nonce ) || ! is_string( $box ) || SODIUM_CRYPTO_SECRETBOX_NONCEBYTES !== strlen( $nonce ) ) {
			return null;
		}
		$plain = sodium_crypto_secretbox_open( $box, $nonce, self::key() );
		return is_string( $plain ) && '' !== $plain ? $plain : null;
	}

	public static function forget( string $job_id ): void {
		delete_transient( self::TRANSIENT . $job_id );
	}

	private static function key(): string {
		return sodium_crypto_generichash( wp_salt( 'auth' ), '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES );
	}
}