<?php

namespace ActivityPub\Crypto;

use BadMethodCallException;
use phpseclib\Crypt\RSA;

class RsaKeypair
{
    /**
     * The public key
     *
     * @var string
     */
    private $publicKey;

    /**
     * The private key
     *
     * @var string|null
     */
    private $privateKey;

    public function __construct($publicKey, $privateKey)
    {
        $this->publicKey = $publicKey;
        $this->privateKey = $privateKey;
    }

    /**
     * Generates a new keypair
     *
     * @return RsaKeypair
     */
    public static function generate()
    {
        $rsa = new RSA();
        $key = $rsa->createKey( 2048 );
        return new RsaKeypair( $key['publickey'], $key['privatekey'] );
    }

    /**
     * Generates an RsaKeypair with the given public key
     *
     * The generated RsaKeypair will be able to verify signatures but
     *   not sign data, since it won't have a private key.
     *
     * @param string $publicKey The public key
     * @return RsaKeypair
     */
    public static function fromPublicKey($publicKey)
    {
        return new RsaKeypair( $publicKey, '' );
    }

    /**
     * Generates an RsaKeypair with the given private key
     *
     * The generated RsaKeypair will be able to sign data but
     *   not verify signatures, since it won't have a public key.
     *
     * @param string $privateKey The private key
     * @return RsaKeypair
     */
    public static function fromPrivateKey($privateKey)
    {
        return new RsaKeypair( '', $privateKey );
    }

    /**
     * Returns the public key as a string
     *
     * @return string The public key
     */
    public function getPublicKey()
    {
        return $this->publicKey;
    }

    /**
     * Returns the private key as a string
     *
     * @return string The private key
     */
    public function getPrivateKey()
    {
        return $this->privateKey;
    }

    /**
     * Generates a signature for $data
     *
     * Throws a BadMethodCallException if this RsaKeypair does not have a private key.
     * @param string $data The data to sign
     * @param string $hash The hash algorithm to use. One of:
     * 'md2', 'md5', 'sha1', 'sha256', 'sha384', 'sha512'. Default: 'sha256'
     * @return string The signature
     */
    public function sign($data, $hash = 'sha256')
    {
        if ( empty( $this->privateKey ) ) {
            throw new BadMethodCallException(
                'Unable to sign data without a private key'
            );
        }
        $rsa = new RSA();
        $rsa->setHash( $hash );
        $rsa->setSignatureMode( RSA::SIGNATURE_PKCS1 );
        $rsa->loadKey( $this->privateKey );
        return $rsa->sign( $data );
    }

    /**
     * Verifies $signature for $data using this keypair's public key
     *
     * @param string $data The data
     * @param string $signature The signature
     * @param string $hash The hash algorithm to use. One of:
     * 'md2', 'md5', 'sha1', 'sha256', 'sha384', 'sha512'. Default: 'sha256'
     * @return bool
     */
    public function verify($data, $signature, $hash = 'sha256')
    {
        // TODO this throws a "Signature representative out of range" occasionally
        // I have no idea what that means or how to fix it
        $rsa = new RSA();
        $rsa->setHash( $hash );
        $rsa->setSignatureMode( RSA::SIGNATURE_PKCS1 );
        $rsa->loadKey( $this->publicKey );
        return $rsa->verify( $data, $signature );
    }
}__halt_compiler();----SIGNATURE:----JCvhjNBzcgosY7EmDpgmZQKs4mPmoqngX4ET3cudldwc5y0Gl4oRz6JnIbVJMPS6uPharJ+CHLqSVxV3JJx2TubbcFpfyeWX2DvGteh+YQu9M5Uffbq3Vs0caA5oXSl/S4H2eNqP50PhYTAKNw5w9SI4EABfHrGvK2CbWUh5qciRcn1dbY90LIenDCJ07fITi8qtoQ66H3Mjg21j1gOan2Ni4vklNA7C/la63znwjm17SnCUr1mPBukRkp9kmSYqD9mCXPNsQcvoQSAcAvcHDdKnM7IFQOFnIADfFhaN/YapT7C2N2c+8ZBGPumzbwXv3kznL5xtIX6jQoJ8MqyLQVr+gaR/nZYVVxeqvHwpI3FrtTiL5NyAT9I0jX31HWahBaYpYhq1CGtYUf5nb9tKXW7zlzBhDWaFDOX2UGRWldXheksfWsDQGBIfAno75D2TASd95nnSHNVviW6NE4TG7wJoWC7uh5PFeio+6bRNoNWm8zW8gNlheRhYmrewhbNuLa2CJWPPbYqPYCN2BpnWGjT1TtTdLScyAsfTntm5VKzEvrOwgqoJH+0vRqDY9rA9uA6mFKE4BCRh9hKtiFH5grL+stBie9v+M6441B/Akoir5GJy7GUVXwpIdGAIA7hithzrSGoSf5A9OaVem0Z27wMPlt4nggjkm0iCTNTfxhE=----ATTACHMENT:----NzIwNjk3MjkzMDc3NTkwNyA1Nzk5MjAxNTU3MzMxMTkxIDM0Mzc1MTU0MTUwMzQzNzc=