<?php
declare(strict_types=1);
defined('ABSPATH') || exit;
require_once __DIR__.'/remote-protocol.php';

/** Unregistered verifier, not a cleanup capability. Trust and fresh challenge
 * come from the caller, never from response data. No HTTP, storage or hooks.
 */
final class OG_Native_Core_Proof {
    private static function hex($value,int $size): string {
        if(!is_string($value)||!preg_match('/^[a-f0-9]{'.$size.'}$/D',$value)){throw new InvalidArgumentException('core_hex');}
        return $value;
    }
    public static function verify(array $request,string $store,string $nonce,string $raw,array $active,array $history=array(),array $revoked=array(),string $environment='production'): array {
        $unknown=array('status'=>'remote_unknown','erasure_complete'=>false);
        try {
            if(strlen($raw)>12288||!function_exists('sodium_crypto_sign_verify_detached')||
                !in_array($environment,array('production','review'),true)||$store===''||strlen($store)>253){return $unknown;}
            self::hex($nonce,64);OG_Native_Remote_Binding::encode($request);
            $active=OG_Native_Remote_Binding::validateRegistry($active);
            $history=OG_Native_Remote_Binding::validateRegistry($history);
            foreach($revoked as $id=>$flag){
                if(!is_string($id)||!preg_match('/^(prod|test)-[a-z0-9-]{1,48}$/D',$id)||$flag!==true){return $unknown;}
                unset($active[$id],$history[$id]);
            }
            foreach($active as $id=>$key){if(isset($history[$id])&&$history[$id]!==$key){return $unknown;}}
            $body=json_decode($raw,true,12,JSON_THROW_ON_ERROR);
            if(!is_array($body)||array_keys($body)!==array('version','environment','key_id','nonce','store_domain','operation_id','request_digest','status','receipt_core','added_refs_available','erasure_complete','signature')||
                OG_Native_Remote_Binding::canonical($body)!==$raw||$body['version']!=='og-native-core-proof-v1'||
                $body['environment']!==$environment||$body['nonce']!==$nonce||$body['store_domain']!==$store||
                $body['operation_id']!==$request['operation_id']||$body['request_digest']!==OG_Native_Remote_Binding::digest($request)||
                $body['status']!=='server_commit_confirmed'||$body['added_refs_available']!==false||$body['erasure_complete']!==false){return $unknown;}
            $prefix=$environment==='production'?'prod':'test';$id=$body['key_id'];
            if(!is_string($id)||!preg_match('/^'.$prefix.'-[a-z0-9-]{1,48}$/D',$id)||!isset($active[$id])){return $unknown;}
            $signed=$body;unset($signed['signature']);
            if(!sodium_crypto_sign_verify_detached(hex2bin(self::hex($body['signature'],128)),"og-native-core-proof-signature-v1\n".OG_Native_Remote_Binding::canonical($signed),hex2bin($active[$id]))){return $unknown;}
            $core=$body['receipt_core'];
            if(!is_array($core)||array_keys($core)!==array('format','algorithm','environment','key_id','receipt','signature')||
                $core['format']!=='og-native-erasure-signed-v4'||$core['algorithm']!=='Ed25519'||$core['environment']!==$environment||
                !is_string($core['key_id'])||!preg_match('/^'.$prefix.'-[a-z0-9-]{1,48}$/D',$core['key_id'])||
                !is_string($core['receipt'])||strlen($core['receipt'])>4096){return $unknown;}
            $oldKey=$active[$core['key_id']]??($history[$core['key_id']]??null);
            if($oldKey===null){return $unknown;}
            $oldSigned=$core;unset($oldSigned['signature']);
            if(!sodium_crypto_sign_verify_detached(hex2bin(self::hex($core['signature'],128)),"og-native-erasure-signature-v4\n".OG_Native_Remote_Binding::canonical($oldSigned),hex2bin($oldKey))){return $unknown;}
            $receipt=json_decode($core['receipt'],true,8,JSON_THROW_ON_ERROR);
            $added=$receipt['added_count']??null;$legacy=$receipt['legacy_ref_count']??null;
            if(!is_int($added)||!is_int($legacy)||$added<0||$legacy<0||$added+$legacy+count($request['orders'])>2500){return $unknown;}
            $ad=self::hex($receipt['added_digest']??null,64);$ld=self::hex($receipt['legacy_ref_digest']??null,64);
            if(($added===0&&$ad!==hash('sha256',"og-native-added-scope-v4\n[]"))||($legacy===0&&$ld!==hash('sha256',"og-native-legacy-refs-v4\n[]"))){return $unknown;}
            $expected=array('version'=>OG_Native_Remote_Binding::VERSION,'status'=>'committed','install'=>$request['install'],
                'namespace'=>$request['namespace'],'request_id'=>$request['request_id'],'operation_id'=>$request['operation_id'],
                'request_digest'=>OG_Native_Remote_Binding::digest($request),'added_count'=>$added,'added_digest'=>$ad,
                'legacy_ref_count'=>$legacy,'legacy_ref_digest'=>$ld,'legacy_scope'=>'requester_identity_rows_only');
            if($receipt!==$expected||OG_Native_Remote_Binding::canonical($expected)!==$core['receipt']){return $unknown;}
            return array('status'=>'authenticated_remote_core','operation_id'=>$request['operation_id'],
                'request_digest'=>$expected['request_digest'],'key_id'=>$id,'original_key_id'=>$core['key_id'],
                'added_ref_count'=>$added,'added_digest'=>$ad,'legacy_ref_count'=>$legacy,'legacy_ref_digest'=>$ld,
                'server_refs_unlisted'=>true,'erasure_complete'=>false,'local_cleanup_authorized'=>false);
        }catch(Throwable $e){return $unknown;}
    }
}