<?php
/**
 * Scoped bearer token service.
 *
 * @package AgentFirewall
 */

declare(strict_types=1);

namespace AgentFirewall\Auth;

use AgentFirewall\Model\Agent;
use AgentFirewall\Repository\AgentRepository;

defined( 'ABSPATH' ) || exit;

/**
 * Generates, stores, and verifies agent bearer tokens (ADR-7).
 *
 * Tokens are `ag_live_` + 43 base64url chars (256 bits of randomness).
 * Only the SHA-256 hash is persisted; the plaintext is returned exactly
 * once at issuance and never logged.
 */
final class TokenService {

	/**
	 * Recognizable token prefix (greppable in leak scans).
	 */
	private const PREFIX = 'ag_live_';

	/**
	 * Constructor.
	 *
	 * @param AgentRepository $agents Agent repository.
	 */
	public function __construct( private readonly AgentRepository $agents ) {
	}

	/**
	 * Issue a fresh token for an agent, replacing any previous one.
	 *
	 * @param int $agent_id Agent id.
	 * @return string The plaintext token; show it once, never store it.
	 */
	public function issue( int $agent_id ): string {
		$random = random_bytes( 32 );
		$suffix = rtrim( strtr( base64_encode( $random ), '+/', '-_' ), '=' );
		$token  = self::PREFIX . $suffix;

		$this->agents->update_token_hash( $agent_id, hash( 'sha256', $token ) );

		return $token;
	}

	/**
	 * Revoke an agent's token.
	 *
	 * @param int $agent_id Agent id.
	 */
	public function revoke( int $agent_id ): void {
		$this->agents->update_token_hash( $agent_id, null );
	}

	/**
	 * Verify a presented bearer token.
	 *
	 * @param string $token Presented token.
	 * @return Agent|null The active agent on success; null on any failure.
	 */
	public function verify( string $token ): ?Agent {
		if ( ! str_starts_with( $token, self::PREFIX ) ) {
			return null;
		}

		$presented_hash = hash( 'sha256', $token );
		$agent          = $this->agents->find_by_token_hash( $presented_hash );

		if ( null === $agent || null === $agent->token_hash ) {
			return null;
		}

		if ( ! hash_equals( $agent->token_hash, $presented_hash ) ) {
			return null;
		}

		if ( 'active' !== $agent->status ) {
			return null;
		}

		return $agent;
	}
}