<?php

if (!defined('ABSPATH')) {
    exit;
}

/**
 * Authenticated encryption for credentials stored in the database.
 *
 * Uses libsodium when available (PHP 7.2+ ships it on most hosts), otherwise
 * OpenSSL AES-256-GCM. The key is derived from the site's auth salts, so a salt
 * change makes stored credentials unreadable; callers treat an empty result as
 * "not connected" and ask the user to reconnect.
 */
final class SWPB_Crypto
{
    private const PREFIX_SODIUM = 's1:';
    private const PREFIX_GCM = 'g1:';

    private function key(): string
    {
        $material = (string)wp_salt('auth') . '|' . (string)wp_salt('secure_auth') . '|seljebackup';
        return hash('sha256', $material, true);
    }

    public static function is_available(): bool
    {
        return function_exists('sodium_crypto_secretbox')
            || (function_exists('openssl_encrypt') && in_array('aes-256-gcm', openssl_get_cipher_methods(), true));
    }

    public function encrypt(string $plaintext): string
    {
        if (function_exists('sodium_crypto_secretbox')) {
            $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
            return self::PREFIX_SODIUM . base64_encode($nonce . sodium_crypto_secretbox($plaintext, $nonce, $this->key()));
        }

        if (function_exists('openssl_encrypt')) {
            $iv = random_bytes(12);
            $tag = '';
            $ciphertext = openssl_encrypt($plaintext, 'aes-256-gcm', $this->key(), OPENSSL_RAW_DATA, $iv, $tag);
            if ($ciphertext === false) {
                return '';
            }
            return self::PREFIX_GCM . base64_encode($iv . $tag . $ciphertext);
        }

        return '';
    }

    public function decrypt(string $payload): string
    {
        $prefix = substr($payload, 0, 3);
        $raw = base64_decode(substr($payload, 3), true);
        if ($raw === false) {
            return '';
        }

        if ($prefix === self::PREFIX_SODIUM && function_exists('sodium_crypto_secretbox_open')) {
            if (strlen($raw) <= SODIUM_CRYPTO_SECRETBOX_NONCEBYTES) {
                return '';
            }
            $nonce = substr($raw, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
            $plaintext = sodium_crypto_secretbox_open(substr($raw, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES), $nonce, $this->key());
            return $plaintext === false ? '' : $plaintext;
        }

        if ($prefix === self::PREFIX_GCM && function_exists('openssl_decrypt')) {
            if (strlen($raw) <= 28) {
                return '';
            }
            $plaintext = openssl_decrypt(substr($raw, 28), 'aes-256-gcm', $this->key(), OPENSSL_RAW_DATA, substr($raw, 0, 12), substr($raw, 12, 16));
            return $plaintext === false ? '' : $plaintext;
        }

        return '';
    }

    public function encrypt_array(array $data): string
    {
        $json = wp_json_encode($data);
        return is_string($json) ? $this->encrypt($json) : '';
    }

    public function decrypt_array(string $payload): array
    {
        if ($payload === '') {
            return [];
        }
        $data = json_decode($this->decrypt($payload), true);
        return is_array($data) ? $data : [];
    }
}