<?php
namespace Relay\Security;

use Relay\Database\Db;
use Relay\Install\Schema;

/** Remembers request nonces for 15 minutes, so a captured request can't be sent again (spec §2.4). */
final class ReplayGuard
{
    public const TTL = 900;

    private Db $db;
    private string $table;

    public function __construct(Db $db)
    {
        $this->db = $db;
        $this->table = Schema::tables()['nonces'];
    }

    /** False when this nonce was already used. */
    public function remember(string $nonce, string $key_id): bool
    {
        if (random_int(1, 50) === 1) {
            $this->prune();
        }
        $wpdb = $this->db->wpdb();
        return $this->db->query($wpdb->prepare('INSERT IGNORE INTO ' . Db::ident($this->table) . ' (nonce, key_id, expires_at) VALUES (%s, %s, %s)', $nonce, $key_id, gmdate('Y-m-d H:i:s', time() + self::TTL))) === 1; // phpcs:ignore WordPress.DB.PreparedSQL -- table names quoted by Db::ident(), values prepared
    }

    public function prune(): void
    {
        $this->db->query($this->db->wpdb()->prepare('DELETE FROM ' . Db::ident($this->table) . ' WHERE expires_at < %s', gmdate('Y-m-d H:i:s')));
    }
}