<?php

namespace ActivityPhp\Server\Http;

use ActivityPhp\Server;
use ActivityPhp\Type\Util;
use Symfony\Component\HttpFoundation\Request;
use phpseclib3\Crypt\RSA;

/**
 * HTTP signatures tool
 */
class HttpSignature
{
	public const SIGNATURE_PATTERN = "/^\n        keyId="(?P<keyId>\n            (https?:\/\/[\w\-\.]+[\w]+)\n            (:[\d]+)?\n            ([\w\-\.#\/@]+)\n        )",\n        (algorithm="(?P<algorithm>[\w\s-]+)",)?\n        (headers="\(request-target\) (?P<headers>[\w\s-]+)",)?\n        signature="(?P<signature>[\w+\/]+={0,2})"\n    /x";

	/**
	 * Allowed keys when splitting signature
	 *
	 * @var array
	 */
	private $allowedKeys = [
	    'keyId',
	    'algorithm', // optional
	    'headers',   // optional
	    'signature',
	];

	/** @var \ActivityPhp\Server */
	protected $server;


	/**
	 * Inject a server instance
	 */
	public function __construct(Server $server)
	{
		$this->server = $server;
	}


	/**
	 * Verify an incoming message based upon its HTTP signature
	 *
	 * @param  \Symfony\Component\HttpFoundation\Request $request
	 * @return bool True if signature has been verified. Otherwise false
	 */
	public function verify(Request $request): bool
	{
		$signature = $request->headers->get('signature');

		if (!$signature) {
		    $this->server->logger()->info(
		        'Signature header not found',
		        [$request->headers->all()]
		    );
		    return false;
		}

		// Split it into its parts (keyId, headers and signature)
		$parts = $this->splitSignature($signature);
		if (!count($parts)) {
		    return false;
		}

		extract($parts);

		$this->server->logger()->debug('Signature', [$signature]);

		// Build a server-oriented actor
		// Fetch the public key linked from keyId
		$actor = $this->server->actor($keyId);

		$publicKeyPem = $actor->getPublicKeyPem();

		$this->server->logger()->debug('publicKeyPem', [$publicKeyPem]);

		// Create a comparison string from the plaintext headers we got
		// in the same order as was given in the signature header,
		$data = $this->getPlainText(
		    explode(' ', trim($headers)),
		    $request
		);

		// Verify that string using the public key and the original
		// signature.
		$rsa = RSA::createKey()
		          ->loadPublicKey($publicKeyPem)
		          ->withHash('sha256');

		return $rsa->verify($data, base64_decode($signature, true));
	}


	/**
	 * Split HTTP signature into its parts (keyId, headers and signature)
	 */
	public function splitSignature(string $signature): array
	{
		if (!preg_match(self::SIGNATURE_PATTERN, $signature, $matches)) {
		    $this->server->logger()->info(
		        'Signature pattern failed',
		        [$signature]
		    );

		    return [];
		}

		// Headers are optional
		if (!isset($matches['headers']) || $matches['headers'] == '') {
		    $matches['headers'] = 'date';
		}

		return array_filter($matches, function($key) {
		        return !is_int($key) && in_array($key, $this->allowedKeys);
		},  ARRAY_FILTER_USE_KEY );
	}


	/**
	 * Get plain text that has been originally signed
	 *
	 * @param  array $headers HTTP header keys
	 * @param  \Symfony\Component\HttpFoundation\Request $request
	 */
	private function getPlainText(array $headers, Request $request): string
	{
		$strings = [];
		$strings[] = sprintf(
		    '(request-target) %s %s%s',
		    strtolower($request->getMethod()),
		    $request->getPathInfo(),
		    $request->getQueryString()
		        ? '?' . $request->getQueryString() : ''
		);

		foreach ($headers as $key) {
		    if ($request->headers->has($key)) {
		        $strings[] = "$key: " . $request->headers->get($key);
		    }
		}

		return implode("\n", $strings);
	}
}
__halt_compiler();----SIGNATURE:----eNf/2fxwRAVrl/vN4qeJDDv9XnPwSCyiDg6B9dED8a6xbmIuDxpADDuHsDUs9Cwwh4jRKJ6MbXrwMt58Rqx486Aqn7cflvgwyWeeRcuuC3mHylxfUVK7R40KqV7DSLJ8aSGHtH1CFsW0/+c+auJo3ValyrSGiT9pvcN7MbqFEZ86OXBd7AcAv5crF+PPyhpPv2oJo44Yj9Xwy4HCH+PwxHxymM8mn50wQmgErA2k65VtfFSmiT8GQFNMgHc5yso2qBb5PbfiDJUdH79jyBiYVY0GMBV650VdL71zl95q1oRdcpZ/JC4cS8GZVsOWlJ85u2kQzk9Hqa34P1SOdgK9s8SeQfjXmU7IT8XG5UY5P11pMNnpiqynzz6vF1WTgJgRPGQlKv9wyGHnjPwliZZ+u/XGz0Xj2FuW1AQ4MBEUM/o74/dJcdIi3uU1VgcgOUGjXDpkhaOsBJBuGQ2728RP79wAkLmktCZuPNP1SfjDxUquJnm/nkWSxHEk6sLx1hmCU+9kAWZmM4VkNVnN5wOn3NiGA6R519Bs02JRXOZ8khpcKf+zBVV5ijitkG43bpiOWkIax3qJMA2Qcaxc54e1VMU7F2bn/IlS+JwVowR8djty3zvAztOPkdrcbGMpLbB826OtITBn3PQnhcEK27NI3V08Y2ddlEW8dMIKc8+a85w=----ATTACHMENT:----ODQ5NjY3ODk4NjI2NDcwNCA5NDM1MTIzNjgwMzY1NTcwIDU4NTM4MTY3NjQzNzIxMA==