<?php
namespace Relay\Security;

use Relay\Support\RelayError;

/**
 * Encrypts stored secrets (key secrets, saved connection secrets) with sodium secretbox. The key comes from
 * the same sources wp_salt('auth') uses — AUTH_KEY/AUTH_SALT from wp-config, else WordPress' stored salts —
 * read directly, so Relay's mu-plugin can verify requests before pluggable functions load. Changing the
 * site's auth salts makes stored secrets unreadable (keys must then be recreated).
 */
final class Crypto
{
    public static function encrypt(string $plain): string
    {
        $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
        return base64_encode($nonce . sodium_crypto_secretbox($plain, $nonce, self::key()));
    }

    public static function decrypt(string $stored): string
    {
        $raw = base64_decode($stored, true);
        if ($raw === false || strlen($raw) <= SODIUM_CRYPTO_SECRETBOX_NONCEBYTES) {
            throw self::unreadable();
        }
        $plain = sodium_crypto_secretbox_open(substr($raw, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES), substr($raw, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES), self::key());
        if ($plain === false) {
            throw self::unreadable();
        }
        return $plain;
    }

    private static function key(): string
    {
        $parts = [];
        foreach (['AUTH_KEY' => 'auth_key', 'AUTH_SALT' => 'auth_salt'] as $constant => $option) {
            $value = defined($constant) ? (string) constant($constant) : '';
            if ($value === '' || stripos($value, 'put your unique phrase') !== false) {
                $value = (string) get_site_option($option, '');
                if ($value === '' && function_exists('wp_salt')) {
                    wp_salt('auth'); // makes WordPress generate and store its salts
                    $value = (string) get_site_option($option, '');
                }
            }
            $parts[] = $value;
        }
        if ($parts[0] === '' && $parts[1] === '') {
            throw new RelayError('keys.no_salt', esc_html__('This site has no authentication salts, so SiteRelay cannot store secrets safely.', 'siterelay'), esc_html__('Add AUTH_KEY and AUTH_SALT to wp-config.php.', 'siterelay'));
        }
        return hash('sha256', implode('|', $parts) . '|relay-keys', true);
    }

    private static function unreadable(): RelayError
    {
        return new RelayError('keys.unreadable', esc_html__('A stored SiteRelay secret can no longer be read (the site\'s security salts changed).', 'siterelay'), esc_html__('Create a new access key or connection.', 'siterelay'));
    }
}