<?php
defined( 'ABSPATH' ) || exit;
/** Bounded immutable case linkage. Hashes remain personal data. */
final class OG_Privacy_Case_Integrity {
    public static function canonical(array $links): string {
        if (count($links)<1 || count($links)>8) { throw new InvalidArgumentException('case_scope_bounds'); }
        $encoded=array();
        foreach ($links as $link) {
            if (!is_array($link) || array_keys($link)!==array('namespace','hash') ||
                !is_string($link['namespace']) || !preg_match('/\A[a-f0-9]{32}\z/D',$link['namespace']) ||
                !is_string($link['hash']) || !preg_match('/\A[a-f0-9]{64}\z/D',$link['hash'])) {
                throw new InvalidArgumentException('case_link_invalid');
            }
            $encoded[]=$link['namespace'].':'.$link['hash'];
        }
        sort($encoded,SORT_STRING);
        if (count(array_unique($encoded))!==count($encoded)) { throw new InvalidArgumentException('case_link_duplicate'); }
        return implode("\n",$encoded);
    }

    public static function commitment(string $key,string $case,string $generation,string $operation,array $links): string {
        if (!preg_match('/\A[a-f0-9]{64}\z/D',$key)) { throw new InvalidArgumentException('case_key_unavailable'); }
        foreach (array($case,$generation,$operation) as $id) {
            if (!preg_match('/\A[a-f0-9]{32}\z/D',$id)) { throw new InvalidArgumentException('case_identity_invalid'); }
        }
        return hash_hmac('sha256',"og-case-links-v1\n".$case."\n".$generation."\n".$operation."\n".self::canonical($links),hex2bin($key));
    }
}