<?php
/**
 * Signed, expiring answer-summary token. It carries only the entry id and expiry, never answers.
 *
 * @package ReactWoo\Atomic
 */

namespace ReactWoo\Atomic\Forms;

defined( 'ABSPATH' ) || exit;

final class Summary_Token {

	const TTL = 1800; // Default: 30 minutes (Atomic -> Settings -> Forms can change it).

	/**
	 * Link lifetime in seconds from the Forms settings (5 min - 24 h, default 30 min).
	 *
	 * @return int
	 */
	public static function ttl() {
		$ttl = class_exists( __NAMESPACE__ . '\\Forms_Settings' ) ? Forms_Settings::summary_link_minutes() * 60 : self::TTL;
		return (int) apply_filters( 'reactwoo/atomic/forms/summary_link_ttl', $ttl );
	}

	/**
	 * @param int $entry_id Entry post id.
	 * @param int $now      Optional time (tests).
	 * @param int $ttl      Optional lifetime in seconds (default ttl()).
	 * @return string base64url(entry_id.exp).hmac
	 */
	public static function sign( $entry_id, $now = 0, $ttl = 0 ) {
		$exp     = ( $now ? (int) $now : time() ) + max( 60, $ttl ? (int) $ttl : self::ttl() );
		$payload = (int) $entry_id . '.' . $exp;
		return self::b64( $payload ) . '.' . self::mac( $payload );
	}

	/**
	 * @param string $token Token.
	 * @param int    $now   Optional time (tests).
	 * @return int Entry id, or 0 when invalid / expired / tampered.
	 */
	public static function verify( $token, $now = 0 ) {
		$token = is_string( $token ) ? $token : '';
		$parts = explode( '.', $token );
		if ( 2 !== count( $parts ) ) {
			return 0;
		}
		$payload = self::unb64( $parts[0] );
		if ( ! is_string( $payload ) || ! preg_match( '/^(\d+)\.(\d+)$/', $payload, $m ) ) {
			return 0;
		}
		if ( ! hash_equals( self::mac( $payload ), $parts[1] ) ) {
			return 0;
		}
		if ( (int) $m[2] < ( $now ? (int) $now : time() ) ) {
			return 0;
		}
		return (int) $m[1];
	}

	/**
	 * Expiry of a well-formed, correctly signed token (0 otherwise). Used for single-use markers.
	 *
	 * @param string $token Token.
	 * @return int
	 */
	public static function expiry( $token ) {
		$parts   = explode( '.', is_string( $token ) ? $token : '' );
		$payload = 2 === count( $parts ) ? self::unb64( $parts[0] ) : false;
		if ( ! is_string( $payload ) || ! preg_match( '/^(\d+)\.(\d+)$/', $payload, $m ) || ! hash_equals( self::mac( $payload ), $parts[1] ) ) {
			return 0;
		}
		return (int) $m[2];
	}

	private static function mac( $payload ) {
		return rtrim( strtr( base64_encode( hash_hmac( 'sha256', $payload, wp_salt( 'auth' ), true ) ), '+/', '-_' ), '=' );
	}

	private static function b64( $s ) {
		return rtrim( strtr( base64_encode( $s ), '+/', '-_' ), '=' );
	}

	private static function unb64( $s ) {
		return base64_decode( strtr( $s, '-_', '+/' ), true );
	}
}