<?php

namespace Code\Module;

use Code\Web\HTTPSig;
use Code\Web\HTTPHeaders;
use Code\Lib\Verify;
use Code\Web\Controller;

/**
 * OpenWebAuth verifier and token generator
 * See spec/OpenWebAuth/Home.md
 * Requests to this endpoint should be signed using HTTP Signatures
 * using the 'Authorization: Signature' authentication method
 * If the signature verifies a token is returned.
 *
 * This token may be exchanged for an authenticated cookie.
 */
class Owa extends Controller
{

    public function init()
    {
        $ret = ['success' => false];
        $authHeader = (new HTTPHeaders())->getAuthHeader();

        if (str_starts_with(trim($authHeader), 'Signature')) {
            $sigblock = HTTPSig::parse_sigheader($authHeader);
            if ($sigblock) {
                $keyId = $sigblock['keyId'];
                $parsed = parse_url($keyId);
                if (str_starts_with($parsed['scheme'],'http')) {
                    unset($parsed['fragment']);
                    unset($parsed['query']);
                    $keyId = unparse_url($parsed);
                }
                else {
                    $keyId = str_replace('acct:', '', $keyId);
                }

                if ($keyId) {
                    $r = q(
                        "select * from hubloc left join xchan on hubloc_hash = xchan_hash 
								where (hubloc_addr = '%s' or hubloc_id_url = '%s' or xchan_hash = '%s') 
								  and hubloc_deleted = 0 and xchan_pubkey != '' 
								ORDER BY hubloc_id desc",
                        dbesc($keyId),
                        dbesc($keyId),
                        dbesc($keyId)
                    );
                    if (!$r) {
                        $found = discover_resource($keyId, verify: false);
                        if ($found) {
                            $r = q(
                                "select * from hubloc left join xchan on hubloc_hash = xchan_hash 
								    where (hubloc_addr = '%s' or hubloc_id_url = '%s' or xchan_hash = '%s') 
								      and hubloc_deleted = 0 and xchan_pubkey != '' 
								    ORDER BY hubloc_id desc",
                                dbesc($keyId),
                                dbesc($keyId),
                                dbesc($keyId)
                            );
                        }
                    }
                    if ($r) {
                        foreach ($r as $hubloc) {
                            $verified = HTTPSig::verify(file_get_contents('php://input'), $hubloc['xchan_pubkey']);
                            if ($verified && $verified['header_signed'] && $verified['header_valid'] && ($verified['content_valid'] || (!$verified['content_signed']))) {
                                logger('OWA header: ' . print_r($verified, true), LOGGER_DATA);
                                logger('OWA success: ' . $hubloc['hubloc_addr'], LOGGER_DATA);
                                $ret['success'] = true;
                                $token = random_string(32);
                                Verify::create('owt', 0, $token, $hubloc['hubloc_addr']);
                                $result = '';
                                openssl_public_encrypt($token, $result, $hubloc['xchan_pubkey']);
                                $ret['encrypted_token'] = base64url_encode($result);
                                break;
                            } else {
                                logger('OWA fail: ' . $hubloc['hubloc_id'] . ' ' . $hubloc['hubloc_addr']);
                            }
                        }
                    }
                }
            }
        }
        json_return_and_die($ret, 'application/x-nomad+json');
    }
}