<?php
/**
 * OAuth refresh-token credentials.
 *
 * @package TurtleReport
 */

namespace TurtleReport\Auth;

defined( 'ABSPATH' ) || exit;

/**
 * Credentials from a Google sign-in, using the stored refresh token.
 */
final class OAuthCredentials extends AbstractCredentials {

	/**
	 * Connection ID.
	 *
	 * @var string
	 */
	private $connection_id;

	/**
	 * OAuth client ID.
	 *
	 * @var string
	 */
	private $client_id;

	/**
	 * OAuth client secret.
	 *
	 * @var string
	 */
	private $client_secret;

	/**
	 * Refresh token.
	 *
	 * @var string
	 */
	private $refresh_token;

	/**
	 * Scopes Google granted.
	 *
	 * @var string[]
	 */
	private $scopes;

	/**
	 * Constructor.
	 *
	 * @param string   $connection_id Connection ID.
	 * @param string   $client_id     Client ID.
	 * @param string   $client_secret Client secret.
	 * @param string   $refresh_token Refresh token.
	 * @param string[] $scopes        Granted scopes.
	 */
	public function __construct( $connection_id, $client_id, $client_secret, $refresh_token, array $scopes ) {
		$this->connection_id = $connection_id;
		$this->client_id     = $client_id;
		$this->client_secret = $client_secret;
		$this->refresh_token = $refresh_token;
		$this->scopes        = $scopes;
	}

	/**
	 * {@inheritDoc}
	 *
	 * @return string
	 */
	public function id() {
		return 'oauth:' . $this->connection_id . ':' . substr( hash( 'sha256', $this->refresh_token ), 0, 12 );
	}

	/**
	 * {@inheritDoc}
	 *
	 * @param string $scope Scope URL.
	 * @return bool
	 */
	public function supports( $scope ) {
		return in_array( $scope, $this->scopes, true );
	}

	/**
	 * {@inheritDoc}
	 *
	 * @return void
	 */
	public function revoke() {
		OAuthClient::revoke( $this->refresh_token );
		$this->forget_token();
	}

	/**
	 * {@inheritDoc}
	 *
	 * @return array
	 */
	protected function request_token() {
		return OAuthClient::refresh( $this->client_id, $this->client_secret, $this->refresh_token );
	}
}