<?php

/**
 * Chill is a software for social workers
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

declare(strict_types=1);

namespace Chill\MainBundle\Security\PasswordRecover;

use Chill\MainBundle\Entity\User;
use DateTime;
use DateTimeImmutable;
use DateTimeInterface;
use Psr\Log\LoggerInterface;
use UnexpectedValueException;
use function bin2hex;
use function hash;
use function hex2bin;
use function random_bytes;
use function strlen;
use function trim;

class TokenManager
{
    public const HASH = 'h';

    public const TIMESTAMP = 'ts';

    public const TOKEN = 't';

    public const TOKEN_LENGTH = 24;

    public const USERNAME_CANONICAL = 'u';

    /**
     * @var LoggerInterface
     */
    protected $logger;

    /**
     * @var string
     */
    protected $secret;

    public function __construct($secret, LoggerInterface $logger)
    {
        $this->secret = $secret;
        $this->logger = $logger;
    }

    public function generate(User $user, DateTimeInterface $expiration)
    {
        $token = random_bytes(self::TOKEN_LENGTH);
        $username = $user->getUsernameCanonical();

        if (empty($username)) {
            throw new UnexpectedValueException('username should not be empty to generate a token');
        }

        $timestamp = $expiration->getTimestamp();
        $hash = hash('sha1', $token . $username . $timestamp . $this->secret);

        return [
            self::HASH => $hash,
            self::TOKEN => bin2hex($token),
            self::TIMESTAMP => $timestamp,
            self::USERNAME_CANONICAL => $username,
        ];
    }

    public function verify($hash, $token, User $user, string $timestamp)
    {
        $token = hex2bin(trim($token));

        if (strlen($token) !== self::TOKEN_LENGTH) {
            return false;
        }

        $username = $user->getUsernameCanonical();
        $date = DateTimeImmutable::createFromFormat('U', $timestamp);

        if ($date < new DateTime('now')) {
            $this->logger->info('receiving a password recover token with expired '
                . 'validity');

            return false;
        }

        $expected = hash('sha1', $token . $username . $timestamp . $this->secret);

        if ($expected !== $hash) {
            return false;
        }

        return true;
    }
}