<?php
/**
 * Symmetric encryption for secrets stored in the database.
 *
 * @package TurtleReport
 */

namespace TurtleReport\Support;

defined( 'ABSPATH' ) || exit;

/**
 * Encrypts client secrets, refresh tokens and service-account keys at rest.
 *
 * Uses libsodium's secretbox. WordPress bundles sodium_compat, so this works
 * even where the PHP extension is missing. The key comes from the site's
 * AUTH salts, or from TURTLEREPORT_ENCRYPTION_KEY if it is defined in
 * wp-config.php. Changing either makes stored secrets unreadable, and the
 * connections must then be re-added. Encrypted values use the "trp1:" format.
 */
final class Crypto {

	const PREFIX = 'trp1:';

	/**
	 * Encrypts a plain-text value.
	 *
	 * @param string $plain Value to encrypt.
	 * @return string Encrypted, hex-encoded value.
	 */
	public function encrypt( $plain ) {
		$nonce = random_bytes( SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
		return self::PREFIX . bin2hex( $nonce . sodium_crypto_secretbox( (string) $plain, $nonce, $this->key() ) );
	}

	/**
	 * Decrypts a value produced by encrypt().
	 *
	 * @param mixed $payload Encrypted value; invalid types are rejected.
	 * @return string Plain text, or an empty string when the value can't be decrypted.
	 */
	public function decrypt( $payload ) {
		if ( ! is_string( $payload ) || 0 !== strpos( $payload, self::PREFIX ) ) {
			return '';
		}
		$hex = substr( $payload, strlen( self::PREFIX ) );
		if ( strlen( $hex ) < 2 * ( SODIUM_CRYPTO_SECRETBOX_NONCEBYTES + SODIUM_CRYPTO_SECRETBOX_MACBYTES ) || 0 !== strlen( $hex ) % 2 || ! preg_match( '/\A[0-9a-fA-F]+\z/', $hex ) ) {
			return '';
		}
		$raw = hex2bin( $hex );
		if ( false === $raw ) {
			return '';
		}
		$nonce = substr( $raw, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
		$box   = substr( $raw, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
		try {
			$plain = sodium_crypto_secretbox_open( $box, $nonce, $this->key() );
		} catch ( \Throwable $e ) {
			return '';
		}
		return false === $plain ? '' : $plain;
	}

	/**
	 * Derives the 32-byte encryption key.
	 *
	 * @return string
	 */
	private function key() {
		if ( defined( 'TURTLEREPORT_ENCRYPTION_KEY' ) && TURTLEREPORT_ENCRYPTION_KEY ) {
			$material = (string) TURTLEREPORT_ENCRYPTION_KEY;
		} else {
			$material = wp_salt( 'auth' );
		}
		return sodium_crypto_generichash( 'turtlereport|' . $material, '', SODIUM_CRYPTO_SECRETBOX_KEYBYTES );
	}
}