<?php
/**
 * Session Tokens (spec 4.2–4.3): opaque, random, short-lived, stored only as
 * SHA-256 hashes, and bound to the DPoP key in the request that obtained them
 * (`jkt`). Looked up on every request, so revocation and sign-out apply at
 * once (spec 4.9 SHOULD).
 *
 * The agent must not depend on token contents (spec 4.2), so there are none:
 * no JWT, nothing to decrypt, nothing to leak.
 *
 * @package AgentAdapt
 */

defined( 'ABSPATH' ) || exit;

/**
 * Token store.
 */
final class AgentAdapt_Tokens {

	/**
	 * Session Token lifetime. "Hours, not days" (spec 4.2).
	 */
	public const SESSION_TTL = HOUR_IN_SECONDS;

	/**
	 * URL-safe random string with $bytes of entropy.
	 *
	 * @param int $bytes Random bytes.
	 */
	public static function random( int $bytes ): string {
		return rtrim( strtr( base64_encode( random_bytes( $bytes ) ), '+/', '-_' ), '=' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- base64url of random bytes, not obfuscation.
	}

	/**
	 * Issue a DPoP-bound Session Token for a Session.
	 *
	 * @param string $session_id Session.
	 * @param string $scope      Space-separated granted scopes ('' signed out).
	 * @param string $jkt        DPoP key thumbprint the token is bound to.
	 * @param int    $user_id    Account the token is signed in to (0 = signed out).
	 * @param string $resource   For a Bearer token (no jkt): the one resource it works at (spec 4.3).
	 * @return array{token: string, expires_in: int}
	 */
	public static function issue_session_token( string $session_id, string $scope, string $jkt, int $user_id = 0, string $resource = '' ): array {
		global $wpdb;
		$token = 'agc_st_' . self::random( 32 );
		$wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery
			AgentAdapt_Schema::table( 'tokens' ),
			array(
				'token_hash' => hash( 'sha256', $token ),
				'session_id' => $session_id,
				'kind'       => 'session',
				'scope'      => $scope,
				'user_id'    => $user_id,
				'jkt'        => '' === $jkt ? null : $jkt,
				'resource'   => '' === $jkt && '' !== $resource ? $resource : null,
				'expires'    => time() + self::SESSION_TTL,
			)
		);
		return array( 'token' => $token, 'expires_in' => self::SESSION_TTL );
	}

	/**
	 * A live token record, or null.
	 *
	 * @param string $token Presented token.
	 * @return array<string,mixed>|null
	 */
	public static function find( string $token ): ?array {
		global $wpdb;
		if ( ! str_starts_with( $token, 'agc_st_' ) || strlen( $token ) > 128 ) {
			return null;
		}
		$t   = AgentAdapt_Schema::table( 'tokens' );
		$row = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM %i WHERE token_hash = %s", $t, hash( 'sha256', $token ) ), ARRAY_A ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
		if ( ! $row || (int) $row['expires'] < time() ) {
			return null;
		}
		return $row;
	}

	/**
	 * Delete every token of these Sessions (Session, browser and handoff
	 * tokens alike) and every token signed in to the account (WordPress's
	 * personal-data eraser), so nothing keeps working for them.
	 *
	 * @param string[] $session_ids Sessions.
	 * @param int      $user_id     Account.
	 * @return int Tokens deleted.
	 */
	public static function delete_for( array $session_ids, int $user_id ): int {
		global $wpdb;
		$t = AgentAdapt_Schema::table( 'tokens' );
		$n = $user_id > 0 ? (int) $wpdb->query( $wpdb->prepare( 'DELETE FROM %i WHERE user_id = %d', $t, $user_id ) ) : 0; // phpcs:ignore WordPress.DB.DirectDatabaseQuery
		foreach ( array_chunk( array_values( array_filter( array_map( 'strval', $session_ids ) ) ), 200 ) as $chunk ) {
			// phpcs:disable WordPress.DB.DirectDatabaseQuery,WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare,WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber,PluginCheck.Security.DirectDB.UnescapedDBParameter -- one %s placeholder per Session; the table name is %i.
			$n += (int) $wpdb->query(
				$wpdb->prepare(
					'DELETE FROM %i WHERE session_id IN (' . implode( ',', array_fill( 0, count( $chunk ), '%s' ) ) . ')',
					array_merge( array( $t ), $chunk )
				)
			);
			// phpcs:enable
		}
		return $n;
	}

	/**
	 * Delete expired tokens.
	 */
	public static function purge(): void {
		global $wpdb;
		$t = AgentAdapt_Schema::table( 'tokens' );
		$wpdb->query( $wpdb->prepare( "DELETE FROM %i WHERE expires < %d", $t, time() ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
	}
}