<?php
/**
 * Bearer-token authentication for inter-site REST requests.
 *
 * @package Shiftora\Api\Auth
 */

declare(strict_types=1);

namespace Shiftora\Api\Auth;

use Shiftora\Connection\ConnectionManager;
use WP_REST_Request;

// Prevent direct file access.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Finds the connection for the X-Shiftora-Key-Id header (the SHA-256 of the token) or,
 * from a build that predates it, the X-Shiftora-Token header, and rejects revoked ones.
 */
final class TokenAuth {

	private ConnectionManager $connections;

	public function __construct( ConnectionManager $connections ) {
		$this->connections = $connections;
	}

	/** @return object|null The connection row, or null when unauthenticated. */
	public function authenticate( WP_REST_Request $request ): ?object {
		$key_id = (string) $request->get_header( 'X-Shiftora-Key-Id' );
		$token  = $request->get_header( 'X-Shiftora-Token' );

		if ( '' !== $key_id ) {
			// A hash is lower-case hex of fixed length; anything else cannot match a stored one.
			$connection = 1 === preg_match( '/\A[0-9a-f]{64}\z/', $key_id ) ? $this->connections->find_by_key_id( $key_id ) : null;
		} elseif ( ! empty( $token ) ) {
			$connection = $this->connections->find_by_token( $token );
		} else {
			return null;
		}

		if ( null === $connection ) {
			return null;
		}

		if ( 'revoked' === $connection->status ) {
			return null;
		}

		$this->connections->update_last_ping( (int) $connection->id );

		return $connection;
	}
}