<?php

namespace App\Core;

/**
 * Advanced OWASP Security Helper
 * Handles AES-256-GCM encryption/decryption, HMAC Blind Indexing,
 * Bcrypt password hashing, and JWT validation.
 * Strict environment variable enforcement (No default fallbacks).
 */
class Security
{
    /**
     * Get the encryption key from environment (must be at least 16 chars for AES-256 derivation)
     */
    private static function getEncryptionKey(): string
    {
        $key = getenv('ENCRYPTION_KEY');
        if (!$key || strlen($key) < 16) {
            throw new \RuntimeException("Security Error: Missing or invalid ENCRYPTION_KEY in environment.");
        }
        return substr(hash('sha256', $key, true), 0, 32);
    }

    /**
     * Get HMAC Salt for Blind Indexing
     */
    private static function getHmacSalt(): string
    {
        $salt = getenv('HMAC_SALT');
        if (!$salt) {
            throw new \RuntimeException("Security Error: Missing HMAC_SALT in environment.");
        }
        return $salt;
    }

    /**
     * Get JWT Secret
     */
    private static function getJwtSecret(): string
    {
        $secret = getenv('JWT_SECRET');
        if (!$secret) {
            throw new \RuntimeException("Security Error: Missing JWT_SECRET in environment.");
        }
        return $secret;
    }

    /**
     * Encrypt text using AES-256-GCM
     */
    public static function encrypt(string $plainText): string
    {
        if ($plainText === '') {
            return '';
        }
        
        $key = self::getEncryptionKey();
        $iv = openssl_random_pseudo_bytes(12); // GCM standard IV is 12 bytes
        $tag = '';
        
        $ciphertext = openssl_encrypt(
            $plainText,
            'aes-256-gcm',
            $key,
            OPENSSL_RAW_DATA,
            $iv,
            $tag
        );

        if ($ciphertext === false) {
            return '';
        }

        // Return combined iv + tag + ciphertext base64 encoded
        return base64_encode($iv . $tag . $ciphertext);
    }

    /**
     * Decrypt text using AES-256-GCM
     */
    public static function decrypt(string $encryptedText): string
    {
        if ($encryptedText === '') {
            return '';
        }

        $key = self::getEncryptionKey();
        $data = base64_decode($encryptedText);
        
        // AES-256-GCM tag is 16 bytes, IV is 12 bytes
        if (strlen($data) < 28) {
            return '';
        }

        $iv = substr($data, 0, 12);
        $tag = substr($data, 12, 16);
        $ciphertext = substr($data, 28);

        $decrypted = openssl_decrypt(
            $ciphertext,
            'aes-256-gcm',
            $key,
            OPENSSL_RAW_DATA,
            $iv,
            $tag
        );

        return $decrypted !== false ? $decrypted : '';
    }

    /**
     * Generate Blind Index (HMAC-SHA256) for secure database queries
     */
    public static function blindIndex(string $value): string
    {
        if ($value === '') {
            return '';
        }
        $normalized = strtolower(trim($value));
        return hash_hmac('sha256', $normalized, self::getHmacSalt());
    }

    /**
     * Hash password using bcrypt
     */
    public static function hashPassword(string $password): string
    {
        return password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
    }

    /**
     * Verify password
     */
    public static function verifyPassword(string $password, string $hash): bool
    {
        return password_verify($password, $hash);
    }

    /**
     * Generate JWT Token with HMAC-SHA256 signature
     */
    public static function generateJWT(array $payload, int $expirySeconds = 86400): string
    {
        $appUrl = getenv('APP_URL') ?: 'https://saqel.intaleqapp.com';

        $header = self::base64UrlEncode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
        
        // Standard OWASP Claims
        $payload['iat'] = time();
        $payload['exp'] = time() + $expirySeconds;
        $payload['iss'] = $appUrl;
        $payload['aud'] = 'saqel_app';
        $payload['jti'] = bin2hex(random_bytes(16));
        
        $payloadEncoded = self::base64UrlEncode(json_encode($payload));
        
        $secret = self::getJwtSecret();
        $signature = hash_hmac('sha256', "$header.$payloadEncoded", $secret, true);
        $signatureEncoded = self::base64UrlEncode($signature);
        
        return "$header.$payloadEncoded.$signatureEncoded";
    }

    /**
     * Verify JWT Token and return payload if valid, false otherwise
     */
    public static function verifyJWT(string $token)
    {
        $parts = explode('.', $token);
        if (count($parts) !== 3) {
            return false;
        }

        list($headerEncoded, $payloadEncoded, $signatureEncoded) = $parts;

        $header = json_decode(self::base64UrlDecode($headerEncoded), true);
        if (!is_array($header) || ($header['alg'] ?? '') !== 'HS256' || ($header['typ'] ?? '') !== 'JWT') {
            return false;
        }
        
        $secret = self::getJwtSecret();
        if (!$secret) {
            return false;
        }

        $signature = self::base64UrlDecode($signatureEncoded);
        $expectedSignature = hash_hmac('sha256', "$headerEncoded.$payloadEncoded", $secret, true);
        
        if (!hash_equals($signature, $expectedSignature)) {
            return false;
        }
        
        $payload = json_decode(self::base64UrlDecode($payloadEncoded), true);
        $expectedIssuer = getenv('APP_URL') ?: 'https://saqel.intaleqapp.com';
        if (!$payload || !isset($payload['exp'], $payload['iat'], $payload['jti']) || time() >= $payload['exp']
            || ($payload['iss'] ?? '') !== $expectedIssuer || ($payload['aud'] ?? '') !== 'saqel_app') {
            return false;
        }
        
        return $payload;
    }

    /**
     * Alias for verifyJWT for backward compatibility
     */
    public static function decodeJwt(string $token)
    {
        return self::verifyJWT($token);
    }

    private static function base64UrlEncode(string $data): string
    {
        return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
    }

    private static function base64UrlDecode(string $data): string
    {
        return base64_decode(strtr($data, '-_', '+/') . str_repeat('=', (4 - strlen($data) % 4) % 4));
    }
}