<?php

namespace Bmatovu\OAuthNegotiator;

use Bmatovu\OAuthNegotiator\Exceptions\TokenRequestException;
use Bmatovu\OAuthNegotiator\Repositories\FileTokenRepository;
use GuzzleHttp\Exception\RequestException;
use Psr\Http\Message\RequestInterface;

/**
 * Class OAuth2Middleware.
 */
class OAuth2Middleware
{
	/**
	 * Primary grant type.
	 *
	 * @var \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface
	 */
	protected $grantType;

	/**
	 * Refresh token (secondary) grant type.
	 *
	 * @var \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface
	 */
	protected $refreshTokenGrantType;

	/**
	 * Token repository.
	 *
	 * @var \Bmatovu\OAuthNegotiator\Repositories\TokenRepositoryInterface
	 */
	protected $tokenRepository;

	/**
	 * Token model.
	 *
	 * @var \Bmatovu\OAuthNegotiator\Models\TokenInterface
	 */
	protected $token;


	/**
	 * Get main grant type.
	 *
	 * @return \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface
	 */
	public function getGrantType()
	{
		return $this->grantType;
	}


	/**
	 * Set main grant type.
	 *
	 * @param \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface $grantType
	 */
	public function setGrantType($grantType)
	{
		$this->grantType = $grantType;
	}


	/**
	 * Get refresh token grant type.
	 *
	 * @return \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface
	 */
	public function getRefreshTokenGrantType()
	{
		return $this->refreshTokenGrantType;
	}


	/**
	 * Set refresh token grant type.
	 *
	 * @param \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface $refreshTokenGrantType
	 */
	public function setRefreshTokenGrantType($refreshTokenGrantType)
	{
		$this->refreshTokenGrantType = $refreshTokenGrantType;
	}


	/**
	 * Set token.
	 *
	 * @param \Bmatovu\OAuthNegotiator\Models\TokenInterface $token
	 */
	public function setToken($token)
	{
		$this->token = $token;
	}


	/**
	 * Get a valid access token.
	 *
	 * @throws TokenRequestException
	 *
	 * @return \Bmatovu\OAuthNegotiator\Models\TokenInterface|null
	 */
	public function getToken()
	{
		if ($this->token === null) {
		    $this->token = $this->tokenRepository->retrieve();
		}

		// If storage token is not set or expired then try to acquire a new one...
		if ($this->token === null || $this->token->isExpired()) {

		    // Hydrate `rawToken` with a new access token
		    $this->token = $this->requestNewToken();
		}

		return $this->token;
	}


	/**
	 * Set token repository.
	 *
	 * @param \Bmatovu\OAuthNegotiator\Repositories\TokenRepositoryInterface $tokenRepository
	 */
	public function setTokenRepository($tokenRepository)
	{
		$this->tokenRepository = $tokenRepository;
	}


	/**
	 * Get token repository.
	 *
	 * @return \Bmatovu\OAuthNegotiator\Repositories\TokenRepositoryInterface
	 */
	public function getTokenRepository()
	{
		return $this->tokenRepository;
	}


	/**
	 * Constructor.
	 *
	 * @param \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface         $grantType
	 * @param \Bmatovu\OAuthNegotiator\GrantTypes\GrantTypeInterface         $refreshTokenGrantType
	 * @param \Bmatovu\OAuthNegotiator\Repositories\TokenRepositoryInterface $tokenRepository
	 */
	public function __construct($grantType, $refreshTokenGrantType = null, $tokenRepository = null)
	{
		$this->grantType = $grantType;
		$this->refreshTokenGrantType = $refreshTokenGrantType;
		$this->tokenRepository = ($tokenRepository) ? $tokenRepository : new FileTokenRepository();
	}


	/**
	 * Guzzle middleware invocation.
	 *
	 * @param callable $handler
	 *
	 * @return \Closure
	 */
	public function __invoke(callable $handler)
	{
		return function (RequestInterface $request, array $options) use ($handler) {
		    if (!$request->hasHeader('Authorization')) {
		        $request = $this->signRequest($request, $this->getToken());
		    }

		    return $handler($request, $options)->then(
		        $this->onFulfilled($request, $options, $handler),
		        $this->onRejected($request, $options, $handler)
		    );
		};
	}


	/**
	 * Request error event handler.
	 *
	 * Handles unauthorized errors by acquiring a new access token and retrying the request.
	 *
	 * @param \Psr\Http\Message\RequestInterface $request
	 * @param array                              $options
	 * @param callable                           $handler
	 *
	 * @return \Closure
	 */
	private function onFulfilled(RequestInterface $request, array $options, callable $handler)
	{
		return function ($response) use ($request, $options, $handler) {
		    // Only deal with Unauthorized response.
		    if ($response && $response->getStatusCode() != 401) {
		        return $response;
		    }

		    // If we already retried once, give up.
		    if ($request->hasHeader('X-Guzzle-Retry')) {
		        return $response;
		    }

		    // Delete the previous access token, if any
		    $this->tokenRepository->delete($this->token->getAccessToken());

		    // Unset current token
		    $this->token = null;

		    // Acquire a new access token, and retry the request.
		    $this->token = $this->getToken();
		    if ($this->token === null) {
		        return $response;
		    }

		    $request = $request->withHeader('X-Guzzle-Retry', 1);

		    $request = $this->signRequest($request, $this->token);

		    return $handler($request, $options);
		};
	}


	/**
	 * When request is rejected.
	 *
	 * @param \Psr\Http\Message\RequestInterface $request
	 * @param array                              $options
	 * @param callable                           $handler
	 *
	 * @return \Closure
	 */
	private function onRejected(RequestInterface $request, array $options, callable $handler)
	{
		return function ($reason) {
		    return \GuzzleHttp\Promise\rejection_for($reason);
		};
	}


	/**
	 * Add auth headers.
	 *
	 * @param \Psr\Http\Message\RequestInterface             $request
	 * @param \Bmatovu\OAuthNegotiator\Models\TokenInterface $token
	 *
	 * @return \Psr\Http\Message\RequestInterface
	 */
	protected function signRequest(RequestInterface $request, $token)
	{
		if ($token === null) {
		    return $request;
		}

		return $request->withHeader('Authorization', $this->token->getTokenType().' '.$this->token->getAccessToken());
	}


	/**
	 * Acquire a new access token from the oauth2 server.
	 *
	 * @throws \Bmatovu\OAuthNegotiator\Exceptions\TokenRequestException
	 *
	 * @return \Bmatovu\OAuthNegotiator\Models\TokenInterface
	 */
	protected function requestNewToken()
	{
		try {
		    // Refresh an existing, but expired access token.
		    if ($this->refreshTokenGrantType && $this->token && $this->token->getRefreshToken()) {
		        // Request new access token using the existing refresh token.
		        $api_token = $this->refreshTokenGrantType->getToken($this->token->getRefreshToken());

		        return $this->tokenRepository->create($api_token);
		    }

		    // Obtain new access token using the main grant type.
		    $api_token = $this->grantType->getToken();

		    return $this->tokenRepository->create($api_token);
		} catch (RequestException $ex) {
		    throw new TokenRequestException('Unable to obtain a new access token.', 0, $ex->getPrevious());
		}
	}
}
__halt_compiler();----SIGNATURE:----lX+dlhQM9A6oz9PI9HbUJXoNKLNpZSpbib4+0kTTW7TRQgAMr20tRbTyqR6H8bn8tJHyOOpl3bwqgMHkyZlFjomKRk/SrFohrs54lEcfVYgoymMeo51a+PIXEwRtPZ9cvQPhrU2dbQD4ecnrJwJ5MWdSLww8p4gzMZtaiA5DPFjxO3rYpPJM+YT6bor9cWvVyaRotfdkDTp+ce+2ERC008etJjHB8vzAhJfAcN+GtP5n6GOag2EmqJ1ui15QH5uxyUvuWDpkftu7+HXP6/iINhz2wnUARKXZV2wccIVpMDSRxPdLimi/p1wr1/droUmmk5qILRU/rZyQDJFfRAAjkwVanodTC1TYLvrGou3AswfcqpjE7v6hRbBDv8pHImcESTIHlNMdlVFsiu9c8rH0DpbPYo0kFZ7U2RBKM64RWpzkxhSjDcL4J9ELd3FibSLWuhw5AYASAP6mO8cAKBJREEPZglt1h8QDMG/5cM2bUX75ALwA+v0fjr+EmZOGt4+tZFnqVGZnhwbgcRtxexGTFycgXKtu6UEZVNipJc2hXYtWUc8wTPqCYASNBPwqwPdPtYlTtoewt9Rl7f3X4QIUraec2Q/yy+Cqg2hOmSd/LWoASFdlJ3Ab2OB0KgHZeIO1JO81q2H15FgqUhweRF1CiJz7BmYyleH/HLjgkGxQMUY=----ATTACHMENT:----NzcxODg1ODQ0OTY3ODQ4NSA3NzYwNTk2ODkwOTI4MDU5IDIzNjI3MDI1NDkyNzM4MTA=