<?php
/**
 * Tamper-proof hash chain for activity logs.
 *
 * Each row stores a SHA-256 over (prev_hash + canonical(row)). Any
 * after-the-fact tampering with row contents — or insertion/deletion
 * of rows — breaks the chain and is detectable by `verify()`.
 *
 * @package ActivityPilot
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class APWPM_Integrity {

	const SECRET_OPTION = 'apwpm_hashchain_secret';
	const LAST_HASH_OPT = 'apwpm_hashchain_last';

	public static function enabled() {
		$s = (array) get_option( 'apwpm_settings', array() );
		return ! empty( $s['enable_hashchain'] );
	}

	/**
	 * Lazily ensure the per-site secret exists. Used as an HMAC key so
	 * verifiers also need DB access — defends against blind tampering.
	 */
	public static function secret() {
		$secret = get_option( self::SECRET_OPTION );
		if ( ! $secret ) {
			$secret = wp_generate_password( 64, true, true );
			update_option( self::SECRET_OPTION, $secret, false );
		}
		return $secret;
	}

	/**
	 * Annotate a row about to be inserted with prev_hash + row_hash.
	 * Hooked into the logger via `apwpm_pre_insert_row`.
	 */
	public static function annotate( $row, $event ) {
		if ( ! self::enabled() || ! is_array( $row ) ) {
			return $row;
		}
		if ( ! in_array( 'row_hash', APWPM_DB::columns(), true ) ) {
			return $row; // Schema not yet migrated.
		}
		$row['prev_hash'] = (string) get_option( self::LAST_HASH_OPT, '' );
		$row['row_hash']  = self::hash( $row );
		update_option( self::LAST_HASH_OPT, $row['row_hash'], false );
		return $row;
	}

	/**
	 * Canonical hash for a row. Excludes id (unknown at insert time)
	 * and row_hash itself.
	 */
	public static function hash( array $row ) {
		$payload = array(
			$row['prev_hash'] ?? '',
			$row['blog_id']   ?? 0,
			$row['user_id']   ?? 0,
			$row['action_type'] ?? '',
			$row['object_type'] ?? '',
			$row['object_id']   ?? 0,
			$row['object_title'] ?? '',
			$row['description'] ?? '',
			$row['context']     ?? '',
			$row['severity']    ?? '',
			$row['ip_address']  ?? '',
			$row['created_at']  ?? '',
		);
		return hash_hmac( 'sha256', wp_json_encode( $payload ), self::secret() );
	}

	/**
	 * Walk the log forward verifying the hash chain. Returns the first
	 * row id that fails verification, or 0 if the chain is intact.
	 */
	public static function verify( $limit = 1000 ) {
		if ( ! in_array( 'row_hash', APWPM_DB::columns(), true ) ) {
			return array( 'ok' => true, 'checked' => 0 );
		}
		$limit = max( 1, (int) $limit );

		$rows = APWPM_DB::get_logs_for_verify( $limit );

		$prev = '';
		foreach ( (array) $rows as $row ) {
			$copy = $row;
			unset( $copy['id'], $copy['row_hash'] );
			$copy['prev_hash'] = $prev;
			$expected           = self::hash( $copy );
			if ( ! hash_equals( $expected, (string) $row['row_hash'] ) ) {
				return array(
					'ok'      => false,
					'broken_at' => (int) $row['id'],
					'checked' => count( $rows ),
				);
			}
			$prev = $row['row_hash'];
		}
		return array( 'ok' => true, 'checked' => count( $rows ) );
	}
}