<?php

namespace App\Services\Woo;

use App\Models\WooStore;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Str;
use RuntimeException;

class InstallTokenService
{
    /** @return array{token: string, store: WooStore} */
    public function issue(WooStore $store): array
    {
        $ttl = max(1, (int) config('woo.install_token_ttl_minutes', 10));
        $payload = [
            'store_id' => $store->id,
            'public_id' => $store->public_id,
            'nonce' => Str::random(16),
            'exp' => now()->addMinutes($ttl)->timestamp,
        ];

        return [
            'token' => Crypt::encryptString(json_encode($payload, JSON_THROW_ON_ERROR)),
            'store' => $store,
        ];
    }

    public function consume(string $token): WooStore
    {
        try {
            $payload = json_decode(Crypt::decryptString($token), true, 512, JSON_THROW_ON_ERROR);
        } catch (\Throwable) {
            throw new RuntimeException('Invalid or expired install token.');
        }

        if (! is_array($payload) || ($payload['exp'] ?? 0) < now()->timestamp) {
            throw new RuntimeException('Install token has expired.');
        }

        $store = WooStore::query()->whereKey($payload['store_id'] ?? 0)->first();
        if (! $store || $store->public_id !== ($payload['public_id'] ?? null)) {
            throw new RuntimeException('Install token does not match a store.');
        }

        return $store;
    }

    public function issuePluginToken(WooStore $store): string
    {
        $plain = Str::random(48);
        $store->update([
            'plugin_token_hash' => hash('sha256', $plain),
            'status' => WooStore::STATUS_ACTIVE,
            'connected_at' => $store->connected_at ?? now(),
        ]);

        return $plain;
    }

    public function verifyPluginToken(WooStore $store, ?string $plain): bool
    {
        if ($plain === null || $plain === '' || ! $store->plugin_token_hash) {
            return false;
        }

        return hash_equals($store->plugin_token_hash, hash('sha256', $plain));
    }
}