<?php
/**
 * Derive a site-local HMAC key without WordPress option writes.
 *
 * @package Px320\SiteAudit
 */

declare(strict_types=1);

namespace Px320\SiteAudit\Security;

use Px320\SiteAudit\Filesystem\WordPressPathProvider;
use Throwable;
use wpdb;

final class LocalHashKey {
	private const SECRET_CONSTANTS = array(
		'AUTH_KEY',
		'SECURE_AUTH_KEY',
		'LOGGED_IN_KEY',
		'NONCE_KEY',
		'AUTH_SALT',
		'SECURE_AUTH_SALT',
		'LOGGED_IN_SALT',
		'NONCE_SALT',
	);

	/** @var callable(string):(?string) */
	private $secret_source;

	/** @var callable():string */
	private $context_source;

	/**
	 * @param callable(string):(?string)|null $secret_source  Testable defined-constant reader.
	 * @param callable():string|null          $context_source Testable non-persisted site context.
	 */
	public function __construct( ?callable $secret_source = null, ?callable $context_source = null ) {
		$paths                = new WordPressPathProvider();
		$this->secret_source  = $secret_source ?? static function ( string $name ): ?string {
			if ( ! defined( $name ) ) {
				return null;
			}

			$value = constant( $name );

			return is_string( $value ) && '' !== $value ? $value : null;
		};
		$this->context_source = $context_source ?? static function () use ( $paths ): string {
			global $wpdb;

			$root    = '' !== $paths->wordpress_root() ? $paths->wordpress_root() : 'wordpress-root-unavailable';
			$prefix  = $wpdb instanceof wpdb ? $wpdb->prefix : 'wordpress-prefix-unavailable';
			$blog_id = function_exists( 'get_current_blog_id' ) ? (string) get_current_blog_id() : '0';

			return $root . "\0" . $prefix . "\0" . $blog_id;
		};
	}

	public function derive(): string {
		$material = array();
		foreach ( self::SECRET_CONSTANTS as $name ) {
			try {
				$value = call_user_func( $this->secret_source, $name );
			} catch ( Throwable $exception ) {
				$value = null;
			}

			if ( is_string( $value ) && '' !== $value ) {
				$material[] = $value;
			}
		}

		try {
			$context = call_user_func( $this->context_source );
		} catch ( Throwable $exception ) {
			$context = 'wordpress-context-unavailable';
		}

		if ( ! is_string( $context ) || '' === $context ) {
			$context = 'wordpress-context-unavailable';
		}

		$secret_digest = hash( 'sha256', empty( $material ) ? 'no-defined-wordpress-secret' : implode( "\0", $material ), true );

		return hash_hmac( 'sha256', $context, $secret_digest );
	}
}