<?php
/**
 * PKCE (RFC 7636) helper for the AdPriva OAuth connect flow.
 *
 * @package AdPriva
 */

declare( strict_types=1 );

defined( 'ABSPATH' ) || exit;

/**
 * Pure PKCE + authorize-URL helpers (no WordPress dependency, so they are unit-testable).
 */
class Adpriva_PKCE {

	/**
	 * Generate a high-entropy PKCE code verifier (RFC 7636 section 4.1).
	 *
	 * 32 random bytes encode to a 43-character URL-safe string, within the
	 * 43-128 character range the spec allows.
	 *
	 * @return string The code verifier.
	 */
	public static function generate_verifier() {
		return self::base64url( random_bytes( 32 ) );
	}

	/**
	 * Derive the S256 code challenge from a verifier (RFC 7636 section 4.2).
	 *
	 * @param string $verifier The code verifier.
	 * @return string The base64url-encoded SHA-256 challenge.
	 */
	public static function challenge( $verifier ) {
		return self::base64url( hash( 'sha256', (string) $verifier, true ) );
	}

	/**
	 * Build an OAuth authorize URL from a base endpoint and query parameters.
	 *
	 * @param string                $base_url The authorize endpoint.
	 * @param array<string, string> $params   Query parameters.
	 * @return string The assembled URL.
	 */
	public static function build_authorize_url( $base_url, array $params ) {
		return $base_url . '?' . http_build_query( $params, '', '&', PHP_QUERY_RFC3986 );
	}

	/**
	 * URL-safe base64 encoding without padding.
	 *
	 * @param string $bytes Raw bytes.
	 * @return string
	 */
	private static function base64url( $bytes ) {
		return rtrim( strtr( base64_encode( $bytes ), '+/', '-_' ), '=' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Encoding raw bytes for a URL-safe string, not obfuscating code.
	}
}