<?php
/**
 * One-time-use identifiers (`jti`) for assertions, browser assertions and DPoP
 * proofs. Spec 4.2 / 4.3 / 5: a copied JWT must not work twice.
 *
 * Shared across every PHP worker because it is a database row, and atomic
 * because the claim is a single INSERT IGNORE against a primary key: of two
 * workers racing with the same jti, exactly one sees a row inserted (Guides:
 * "Keep one replay cache shared by every server"). Rows only need to outlive
 * the JWT they protect; AgentAdapt_Maintenance purges expired ones.
 *
 * MySQL semantics are load-bearing here. SQLite (wp-now) silently no-ops
 * `INSERT IGNORE` (instance #1's lesson), which is one reason the integration
 * suite runs on MySQL.
 *
 * @package AgentAdapt
 */

defined( 'ABSPATH' ) || exit;

/**
 * Replay cache.
 */
final class AgentAdapt_Replay {

	/**
	 * Claim a jti. True the first time, false on any reuse.
	 *
	 * @param string $kind    assertion|client|browser|dpop — separate namespaces.
	 * @param string $issuer  Who minted it (client_id, or DPoP key thumbprint).
	 * @param string $jti     The jti claim.
	 * @param int    $expires Unix time after which the JWT is dead anyway.
	 */
	public static function claim( string $kind, string $issuer, string $jti, int $expires ): bool {
		global $wpdb;
		$hash = hash( 'sha256', $kind . "\n" . $issuer . "\n" . $jti );
		$t    = AgentAdapt_Schema::table( 'replay' );
		// Keep the row a little past expiry so leeway on `exp` can't reopen it.
		$keep = max( $expires, time() ) + AgentAdapt_Jose::LEEWAY + 60;
		$rows = $wpdb->query( $wpdb->prepare( "INSERT IGNORE INTO %i (jti_hash, expires) VALUES (%s, %d)", $t, $hash, $keep ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
		return 1 === (int) $rows;
	}

	/**
	 * Delete expired rows.
	 */
	public static function purge(): void {
		global $wpdb;
		$t = AgentAdapt_Schema::table( 'replay' );
		$wpdb->query( $wpdb->prepare( "DELETE FROM %i WHERE expires < %d", $t, time() ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
	}
}