<?php

use Firebase\JWT\JWT;

class PDND 
{

  const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";

  const GRANT_TYPE = "client_credentials";
  
  /**
   * getVoucher
   *
   * @param  String $purpose
   * @param  ?Array $tracking_evidence
   * @param  ?Array $parameters
   * 
   * @return ?stdClass
   */
  public static function getVoucher(String $purpose, ?Array $tracking_evidence = [],  ?Array $parameters = []) : ?stdClass {
    if(isset($tracking_evidence["forced"])) {
      unset($tracking_evidence["forced"]);
    }  

    if(empty($parameters)){
      $parameters = self::getPDNDConfigParameters();
    } 
  
    self::validateParams($parameters, $purpose);
  
    $tracking_evidence["iss"] = $parameters["jwt"]["cid"];
    $tracking_evidence["jti"] = \Ramsey\Uuid\Uuid::uuid6()->toString();
    $tracking_evidence["iat"] = strtotime("now");
    $tracking_evidence["nbf"] = strtotime("now");
    $tracking_evidence["exp"] = strtotime("+10 minute");
    $tracking_evidence["purposeId"] = $parameters["purposes"][$purpose];


    $privateKeys = self::getPrivateKey($parameters);

    $tracking_evidence_jwt = JWT::encode($tracking_evidence, $privateKeys, $parameters["jwt"]["alg"], $parameters["jwt"]["kid"]);

    $client_assertion = [
      "iss"       => $parameters["jwt"]["cid"],
      "sub"       => $parameters["jwt"]["cid"],
      "aud"       => $parameters["jwt"]["aud"],
      "jti"       => \Ramsey\Uuid\Uuid::uuid6()->toString(),
      "nbf"       => strtotime("now"),
      "iat"       => strtotime("now"),
      "exp"       => strtotime("+10 minute"),
      "purposeId" => $parameters["purposes"][$purpose],
      "client_id" => $parameters["jwt"]["cid"],
      "digest"    => [
        "alg"   => "SHA256",
        "value" => hash("SHA256", $tracking_evidence_jwt)
      ]
    ];

    $client_assertion_jwt = JWT::encode($client_assertion, $privateKeys, $parameters["jwt"]["alg"], $parameters["jwt"]["kid"]);

    $body = [
      "client_id" => $parameters["jwt"]["cid"],
      "client_assertion" => $client_assertion_jwt,
      "client_assertion_type" => $parameters["jwt"]["cat"],
      "grant_type" => $parameters["jwt"]["grt"]
    ];

    $curl = curl_init();
    curl_setopt($curl, CURLOPT_URL, $parameters["jwt"]["eas"]);
    curl_setopt($curl, CURLOPT_POST, TRUE);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);
    curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, FALSE);
    curl_setopt($curl, CURLOPT_HEADER, FALSE);
    curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
    curl_setopt($curl, CURLOPT_HTTPHEADER, [
        "Encoding: UTF-8",
        "Http-Method: POST",
        "Connection: Keep-Alive",
        "Content-Type: application/x-www-form-urlencoded",
        "User-Agent: TUTTOGARE.V3",
    ]);
    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($body));
    
    $response = curl_exec($curl);
  
    if(! empty($response) && curl_getinfo($curl, CURLINFO_HTTP_CODE) == 200) {
      $response = json_decode($response);
      $response->tracking_evidence = (object) $tracking_evidence;
      $response->tracking_evidence_jwt = $tracking_evidence_jwt;
      $response->client_assertion = (object) $client_assertion;
      return $response;
    }
    
    if(DEVELOP_ENV) {
      dump("Errore PDND", $response, curl_error($curl), intval(curl_getinfo($curl, CURLINFO_HTTP_CODE)));
      return null;
    }
    throw new Exception(curl_error($curl), intval(curl_getinfo($curl, CURLINFO_HTTP_CODE)));

  }
  
  /**
   * Obtain the private key for the provided public key ID.
   *
   * @return OpenSSLAsymmetricKey|resource|false
   */
  private static function getPrivateKey(Array $parameters)
  {
    $privateKeys = null;
    $err = "GetPrivateKey err.01 - empty params";
    if(!empty($parameters)){
      if(!empty($parameters['private-key'])){
        $privateKeys = self::getPrivateKeyFromConfig($parameters);
        $err = "GetPrivateKey err.02 - empty config";
      }elseif(!empty($parameters["jwt"]["kid"])){
        $privateKeys = self::getPrivateKeyFromString($parameters["jwt"]["kid"]);
        $err = "GetPrivateKey err.03 - empty file";
      }
    }

    if(empty($privateKeys)){
      throw new Exception("Private key not found - {$err}");
    }else{
      return $privateKeys;
    }

  }

  /**
   * getPrivateKeyFromConfig
   *
   * @param  Array $parameters
   * @return OpenSSLAsymmetricKey|false
   */
  private static function getPrivateKeyFromString(String $public_key_id)
  {
    $key = substr(__DIR__,0,strpos(__DIR__,"/public_html"))."/pdnd/{$public_key_id}";
    if(file_exists($key)) {

      return openssl_pkey_get_private("file://{$key}");

    }

    throw new Exception("Private key not found for id {$public_key_id}");
  }
  
  /**
   * getPrivateKeyFromConfig
   *
   * @param  Array $parameters
   * @return OpenSSLAsymmetricKey|false
   */
  private static function getPrivateKeyFromConfig(Array $parameters)
  {
    if(!empty($parameters['private-key'])){
      
      try {
        $key = base64_decode($parameters['private-key']);
        return openssl_pkey_get_private($key);
      } catch (\Throwable $th) {
        throw new Exception("Error private key into configuration");
      }
    }
    throw new Exception("Private key not found in configuration");
  }


  /**
   * Obtain the public key for the provided public key ID.
   *
   * @param  mixed $public_key_id
   * @return OpenSSLAsymmetricKey|resource|false
   */
  static function getPublicKey(String $public_key_id) {
   
    $key = substr(__DIR__,0,strpos(__DIR__,"/public_html"))."/pdnd/{$public_key_id}.pub";
    if(file_exists($key)) {

      return openssl_pkey_get_public("file://{$key}");

    }

    throw new Exception("Public key not found for id {$public_key_id}");

  }
  
  /**
   * Retrieve the configuration parameters for PDND.
   *
   * @return Array
   */
  private static function getPDNDConfigParameters() : Array {
    
    global $config;
    return $config["pdnd"];

  }


  /**
   * validateParams
   *
   * @param  Array $parameters
   * @param  String $purpose
   * @return void
   */
  private static function validateParams(Array $parameters, $purpose) 
  {
    if(empty($parameters["purposes"][$purpose])) {
      throw new Exception("Err.01 - The purpose ID '{$purpose}' for accessing the provider's resources is not included in the configuration file.");
    }

    if(empty($parameters["jwt"]["cid"])){
      throw new Exception("Err.02 - Empty JWT cid params");
    }

    if(empty($parameters["jwt"]["aud"])){
      throw new Exception("Err.03 - Empty JWT aud params");
    }

    if(empty($parameters["jwt"]["alg"])){
      throw new Exception("Err.04 - Empty JWT alg params");
    }

    if(empty($parameters["jwt"]["kid"])){
      throw new Exception("Err.05 - Empty JWT kid params");
    }

    if(empty($parameters["jwt"]["cat"])){
      throw new Exception("Err.05 - Empty JWT cat params");
    }

    if(empty($parameters["jwt"]["grt"])){
      throw new Exception("Err.05 - Empty JWT jrt params");
    }

  }

}