<?php
/** Schema and builders for encrypted callback-binding states. */
if (!defined('ABSPATH')) {
    exit;
}
class Akkedli_V2_Binding_State
{
    public static function matches_envelope($envelope, $missing, $expected)
    {
        try {
            $actual = $envelope === $missing ? null : Akkedli_V2_Crypto::decrypt($envelope);
        } catch (Throwable $error) {
            unset($error);
            return false;
        }
        return is_array($expected) && Akkedli_Connector_State::is_valid($expected)
            && is_array($actual) && hash_equals(
                wp_json_encode($expected, JSON_UNESCAPED_SLASHES),
                wp_json_encode($actual, JSON_UNESCAPED_SLASHES)
            );
    }
    public static function valid($state)
    {
        if (!is_array($state) || !isset($state['mode'])) {
            return false;
        }
        if ('v2_failed' === $state['mode']) {
            return Akkedli_V2_Strict_JSON::exact_keys($state, array('schema_version', 'mode', 'legacy_backup'))
                && 1 === $state['schema_version'] && Akkedli_Connector_State::is_valid_backup($state['legacy_backup']);
        }
        $keys = array('schema_version', 'mode', 'credential_id', 'secret', 'protocol_version',
            'callback_url', 'legacy_backup', 'poll_started_at', 'next_attempt_at',
            'attempt_count', 'automatic_stopped');
        if ('v2_pending' !== $state['mode'] || !Akkedli_V2_Strict_JSON::exact_keys($state, $keys)
            || 1 !== $state['schema_version'] || 1 !== $state['protocol_version']
            || !is_string($state['credential_id'])
            || !preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/D', $state['credential_id'])
            || !is_string($state['secret']) || !is_int($state['poll_started_at'])
            || $state['poll_started_at'] < 1 || !is_int($state['next_attempt_at'])
            || $state['next_attempt_at'] < 0 || !is_int($state['attempt_count'])
            || $state['attempt_count'] < 0 || $state['attempt_count'] > 8
            || !is_bool($state['automatic_stopped'])
            || ($state['automatic_stopped'] ? 0 !== $state['next_attempt_at']
                : (0 === $state['attempt_count'] && $state['next_attempt_at'] < 1))
            || !Akkedli_Connector_State::is_valid_backup($state['legacy_backup'])
            || !Akkedli_V2_Callback_URL::is_canonical($state['callback_url'])) {
            return false;
        }
        try {
            $secret = Akkedli_V2_Crypto::base64url_decode($state['secret']);
        } catch (Throwable $error) {
            unset($error);
            return false;
        }
        return 32 === strlen($secret);
    }
    public static function pending(array $credentials, array $backup, $now)
    {
        return array('schema_version' => 1, 'mode' => 'v2_pending',
            'credential_id' => $credentials['credential_id'], 'secret' => $credentials['secret'],
            'protocol_version' => 1, 'callback_url' => $credentials['callback_url'],
            'legacy_backup' => $backup, 'poll_started_at' => $now,
            'next_attempt_at' => $now + 45, 'attempt_count' => 0, 'automatic_stopped' => false);
    }
    public static function verified(array $pending)
    {
        $state = array('schema_version' => 1, 'mode' => 'v2',
            'credential_id' => $pending['credential_id'], 'secret' => $pending['secret'],
            'protocol_version' => 1, 'outbox_recovery_pending' => true);
        $legacy = $pending['legacy_backup']['api_key'];
        if ($legacy['present'] && '' !== $legacy['value']) {
            $state['legacy_callback_key'] = $legacy['value'];
        }
        return $state;
    }
    public static function failed(array $pending)
    {
        return array('schema_version' => 1, 'mode' => 'v2_failed', 'legacy_backup' => $pending['legacy_backup']);
    }
    public static function authority_lost($credential_id)
    {
        $state = Akkedli_Connector_State::load();
        if (!is_string($credential_id) || !is_array($state) || 'v2' !== $state['mode']
            || !hash_equals($credential_id, $state['credential_id'])) return false;
        $failed = array('schema_version' => 1, 'mode' => 'v2_failed',
            'legacy_backup' => Akkedli_Connector_State::create_legacy_backup());
        return Akkedli_Connector_State::replace($failed, $state);
    }
}