<?php
/**
 * One atomic, per-blog, non-autoloaded encrypted state option.
 *
 * @package Waitlistize
 */

namespace Waitlistize\Auth;

use RuntimeException;

final class TokenStore {
	public const OPTION   = '_waitlistize_connection';
	public const DISABLED = '_waitlistize_disabled';

	private function key(): string {
		$secret = defined( 'WAITLISTIZE_TOKEN_KEY' ) ? WAITLISTIZE_TOKEN_KEY : wp_salt( 'auth' ) . wp_salt( 'secure_auth' );
		if ( ! is_string( $secret ) || strlen( $secret ) < 32 ) {
			throw new RuntimeException( 'A strong server-side encryption key is required.' );
		}
		return hash( 'sha256', (string) $secret . ':' . get_current_blog_id(), true );
	}

	/** Metadata binding detects migrations and distinguishable clones before HTTP. */
	public function fingerprint(): string {
		global $wpdb;
		$identity = array( get_option( 'home' ), get_option( 'siteurl' ), ABSPATH, $wpdb->prefix, wp_get_environment_type(), defined( 'WAITLISTIZE_INSTANCE_KEY' ) ? WAITLISTIZE_INSTANCE_KEY : '', wp_salt( 'auth' ), defined( 'WAITLISTIZE_API_BASE_URL' ) ? WAITLISTIZE_API_BASE_URL : 'https://waitlistize.com' );
		return hash( 'sha256', wp_json_encode( $identity ) );
	}

	/** Bypass request-local object/notoptions caches across concurrent workers. */
	private function raw( string $name ): ?string {
		global $wpdb;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Lifecycle synchronization requires a fresh database read.
		return $wpdb->get_var( $wpdb->prepare( "SELECT option_value FROM $wpdb->options WHERE option_name = %s", $name ) );
	}

	public function read(): array {
		$encoded = $this->raw( self::OPTION );
		if ( null === $encoded ) {
			return array( 'status' => 'disconnected' );
		}
		try {
			// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Binary ciphertext envelope, never executable code.
			$raw = base64_decode( (string) $encoded, true );
			if ( ! is_string( $raw ) || strlen( $raw ) <= SODIUM_CRYPTO_SECRETBOX_NONCEBYTES ) {
				throw new RuntimeException( 'Invalid storage envelope.' );
			}
			$plain = sodium_crypto_secretbox_open( substr( $raw, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES ), substr( $raw, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES ), $this->key() );
			$state = false === $plain ? null : json_decode( $plain, true );
			if ( ! is_array( $state ) || ! hash_equals( $state['fingerprint'] ?? '', $this->fingerprint() ) ) {
				throw new RuntimeException( 'Installation changed.' );
			}
			return $state;
		} catch ( \Throwable $exception ) {
			// Do not revoke credentials copied from another installation.
			$this->clear();
			$state = array( 'status' => 'installation_changed' );
			if ( function_exists( 'sodium_crypto_secretbox' ) ) {
				$this->write( $state );
			}
			return $state;
		}
	}

	public function write( array $state ): void {
		if ( ! function_exists( 'sodium_crypto_secretbox' ) ) {
			throw new RuntimeException( 'Authenticated encryption is unavailable.' );
		}
		$state['fingerprint'] = $this->fingerprint();
		$nonce                = random_bytes( SODIUM_CRYPTO_SECRETBOX_NONCEBYTES );
		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Encode authenticated ciphertext for a WordPress option.
		$encoded = base64_encode( $nonce . sodium_crypto_secretbox( wp_json_encode( $state ), $nonce, $this->key() ) );
		wp_cache_delete( self::OPTION, 'options' );
		update_option( self::OPTION, $encoded, false );
		wp_cache_delete( self::OPTION, 'options' );
		if ( $this->raw( self::OPTION ) !== $encoded ) {
			throw new RuntimeException( 'Connection storage failed.' );
		}
	}

	public function clear(): void {
		delete_option( self::OPTION );
		wp_cache_delete( self::OPTION, 'options' );
	}

	public function disable(): void {
		wp_cache_delete( self::DISABLED, 'options' );
		wp_cache_delete( 'notoptions', 'options' );
		update_option( self::DISABLED, true, false );
	}

	public function enable(): void {
		delete_option( self::DISABLED );
	}

	public function disabled(): bool {
		return null !== $this->raw( self::DISABLED );
	}
}