<?php
/**
 * Crypto — AES-256-CTR streaming encryption for password-protected backups.
 *
 * CTR is a stream cipher: ciphertext length == plaintext length (no padding),
 * so encryption composes with the streaming archive format and stays
 * memory-safe. The key is PBKDF2-derived from the user's password + a per-backup
 * salt; a random IV per entry is stored (plaintext) in the entry header.
 *
 * @package AI_SiteArk
 * Copyright (c) 2026 AtoZ INFOWAY INC.
 * Licensed under the GNU General Public License, version 2 or later.
 */

namespace AtoZ\SiteArk\Helpers;

defined( 'ABSPATH' ) || exit;

/**
 * Class Crypto
 */
class Crypto {

	const CIPHER = 'aes-256-ctr';
	const ITER   = 100000;

	/**
	 * Whether encryption is available on this host.
	 *
	 * @return bool
	 */
	public static function available() {
		return function_exists( 'openssl_encrypt' ) && function_exists( 'hash_pbkdf2' );
	}

	/**
	 * Random 16-byte salt.
	 *
	 * @return string
	 */
	public static function salt() {
		return random_bytes( 16 );
	}

	/**
	 * Random 16-byte IV.
	 *
	 * @return string
	 */
	public static function iv() {
		return random_bytes( 16 );
	}

	/**
	 * Derive a 32-byte key from a password + salt.
	 *
	 * @param string $password Password.
	 * @param string $salt     Salt bytes.
	 * @return string
	 */
	public static function key( $password, $salt ) {
		return hash_pbkdf2( 'sha256', (string) $password, $salt, self::ITER, 32, true );
	}

	/**
	 * Encrypt a whole (small) buffer.
	 *
	 * @param string $plain Plaintext.
	 * @param string $key   Key.
	 * @param string $iv    IV.
	 * @return string
	 */
	public static function enc( $plain, $key, $iv ) {
		return openssl_encrypt( $plain, self::CIPHER, $key, OPENSSL_RAW_DATA, $iv );
	}

	/**
	 * Decrypt a whole (small) buffer.
	 *
	 * @param string $cipher Ciphertext.
	 * @param string $key    Key.
	 * @param string $iv     IV.
	 * @return string|false
	 */
	public static function dec( $cipher, $key, $iv ) {
		return openssl_decrypt( $cipher, self::CIPHER, $key, OPENSSL_RAW_DATA, $iv );
	}

	/**
	 * Advance a 128-bit big-endian counter IV by N blocks.
	 *
	 * @param string $iv     IV bytes.
	 * @param int    $blocks Blocks to add.
	 * @return string
	 */
	public static function iv_add( $iv, $blocks ) {
		$b = array_values( unpack( 'C16', $iv ) );
		$c = (int) $blocks;
		for ( $i = 15; $i >= 0 && $c > 0; $i-- ) {
			$sum   = $b[ $i ] + ( $c & 0xFF );
			$b[ $i ] = $sum & 0xFF;
			$c     = ( $c >> 8 ) + ( $sum >> 8 );
		}
		return pack( 'C16', ...$b );
	}

	/**
	 * Blocks consumed by a byte length (CTR advances one block per 16 bytes).
	 *
	 * @param int $bytes Byte length.
	 * @return int
	 */
	public static function blocks( $bytes ) {
		return intdiv( $bytes, 16 ) + ( ( $bytes % 16 ) ? 1 : 0 );
	}

	/**
	 * Derive the 32-byte MAC subkey from the encryption key. Encrypt-then-MAC must NOT reuse the
	 * cipher key as the MAC key, so we derive an independent key from it with a fixed label
	 * (HKDF-Expand-style single-block). Both backup and restore hold the cipher key, so both
	 * arrive at the same MAC key with no extra material stored.
	 *
	 * @param string $enc_key Raw 32-byte cipher key.
	 * @return string Raw 32-byte MAC key.
	 */
	public static function mac_key( $enc_key ) {
		return hash_hmac( 'sha256', 'aisv-mac-v1', (string) $enc_key, true );
	}

	/**
	 * Keyed integrity tag (HMAC-SHA256) over a whole file, streamed so a multi-gigabyte volume
	 * never sits in memory. This is the authentication half of Encrypt-then-MAC: it binds the
	 * ciphertext to the password, so tampering can't be forged (unlike the unkeyed .sha256).
	 *
	 * @param string $path    File to authenticate (the encrypted volume).
	 * @param string $enc_key Raw 32-byte cipher key.
	 * @return string Lowercase-hex tag, or '' if unavailable.
	 */
	public static function file_mac( $path, $enc_key ) {
		if ( ! function_exists( 'hash_hmac_file' ) || ! is_string( $path ) || ! is_file( $path ) || '' === (string) $enc_key ) {
			return '';
		}
		$mac = @hash_hmac_file( 'sha256', $path, self::mac_key( $enc_key ) ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
		return is_string( $mac ) ? $mac : '';
	}
}