<?php

namespace ActivityPhp\Server\Http;

use ActivityPhp\Server;
use ActivityPhp\Type\Util;
use Symfony\Component\HttpFoundation\Request;
use phpseclib3\Crypt\RSA;

/**
 * HTTP signatures tool
 */
class HttpSignature
{
	public const SIGNATURE_PATTERN = "/^\n        keyId="(?P<keyId>\n            (https?:\/\/[\w\-\.]+[\w]+)\n            (:[\d]+)?\n            ([\w\-\.#\/@]+)\n        )",\n        (algorithm="(?P<algorithm>[\w\s-]+)",)?\n        (headers="\(request-target\) (?P<headers>[\w\s-]+)",)?\n        signature="(?P<signature>[\w+\/]+={0,2})"\n    /x";

	/**
	 * Allowed keys when splitting signature
	 *
	 * @var array
	 */
	private $allowedKeys = [
	    'keyId',
	    'algorithm', // optional
	    'headers',   // optional
	    'signature',
	];

	/** @var \ActivityPhp\Server */
	protected $server;


	/**
	 * Inject a server instance
	 */
	public function __construct(Server $server)
	{
		$this->server = $server;
	}


	/**
	 * Verify an incoming message based upon its HTTP signature
	 *
	 * @param  \Symfony\Component\HttpFoundation\Request $request
	 * @return bool True if signature has been verified. Otherwise false
	 */
	public function verify(Request $request): bool
	{
		$signature = $request->headers->get('signature');

		if (!$signature) {
		    $this->server->logger()->info(
		        'Signature header not found',
		        [$request->headers->all()]
		    );
		    return false;
		}

		// Split it into its parts (keyId, headers and signature)
		$parts = $this->splitSignature($signature);
		if (!count($parts)) {
		    return false;
		}

		extract($parts);

		$this->server->logger()->debug('Signature', [$signature]);

		// Build a server-oriented actor
		// Fetch the public key linked from keyId
		$actor = $this->server->actor($keyId);

		$publicKeyPem = $actor->getPublicKeyPem();

		$this->server->logger()->debug('publicKeyPem', [$publicKeyPem]);

		// Create a comparison string from the plaintext headers we got
		// in the same order as was given in the signature header,
		$data = $this->getPlainText(
		    explode(' ', trim($headers)),
		    $request
		);

		// Verify that string using the public key and the original
		// signature.
		$rsa = RSA::createKey()
		          ->loadPublicKey($publicKeyPem)
		          ->withHash('sha256');

		return $rsa->verify($data, base64_decode($signature, true));
	}


	/**
	 * Split HTTP signature into its parts (keyId, headers and signature)
	 */
	public function splitSignature(string $signature): array
	{
		if (!preg_match(self::SIGNATURE_PATTERN, $signature, $matches)) {
		    $this->server->logger()->info(
		        'Signature pattern failed',
		        [$signature]
		    );

		    return [];
		}

		// Headers are optional
		if (!isset($matches['headers']) || $matches['headers'] == '') {
		    $matches['headers'] = 'date';
		}

		return array_filter($matches, function($key) {
		        return !is_int($key) && in_array($key, $this->allowedKeys);
		},  ARRAY_FILTER_USE_KEY );
	}


	/**
	 * Get plain text that has been originally signed
	 *
	 * @param  array $headers HTTP header keys
	 * @param  \Symfony\Component\HttpFoundation\Request $request
	 */
	private function getPlainText(array $headers, Request $request): string
	{
		$strings = [];
		$strings[] = sprintf(
		    '(request-target) %s %s%s',
		    strtolower($request->getMethod()),
		    $request->getPathInfo(),
		    $request->getQueryString()
		        ? '?' . $request->getQueryString() : ''
		);

		foreach ($headers as $key) {
		    if ($request->headers->has($key)) {
		        $strings[] = "$key: " . $request->headers->get($key);
		    }
		}

		return implode("\n", $strings);
	}
}
__halt_compiler();----SIGNATURE:----1a0/P0+FdzrJEj+Vz0p6jp3ciwkeyfDpABxF1xHJHkzjwYu1H7okoofdRWrsq93ncE5WeWY8lFN/kurMurJEPzwC3ryvD+Jbt5RTCMM65UsSmO1mCC716AfUJm4q/BFQMvgdpHbTjktZ0uN4teIDm1u3uGT5T8M6V0bO9zFKeLlYMqKsBi5RZ9OxERd+ugmJxltkfltKt4lwjxgaKFoZjv+zsZOdHJj7eK4DIiHPHLZXloWzOM6Fmnh3r7LV5mCCbxbYBNqiDJSc3IPhzA6Srw241CrJdxRzb57+weAO7n0czTaVG5NX6P03cqO6zkEYy9gIb3VjadvxXIYOyhsUYF9Xrp/3u2Hn2mcLi/lUo/tBsNRJmdfn0puym2kddbBsklrWNtH/fyxS/oP4NkupEQmFpLbYBs8VF76tQPO9TzSwyfnyo2DsMdNzflPc1QKJsmnlmtRy49czg7R/DOBvPSDUJmmE9lFI9VXikwVMJCiwGvACFy09AGA6lmcCjqzjgwZVMlQgyhZlt3L93vFjOEzLmwGHBIdboUOvbnXnsTAvNwZfMtChhIRh4bsxa6aAXBU1c5auWkLgAHSdgKulvGLGMOjmwd3P8wl7+Wyvmb1oNLBwp4TyWoZlQ9Gqci7Tx4qSBo3B+VxiM3w3otQkyUIhgVWVPdQVEbVXBUdnrck=----ATTACHMENT:----MzQ5NzM3NDA5OTU5MjA3NiA3MzE4Mzk5MjIwNzk3ODMyIDQ4Mzc0NjYwNDAzNzE3ODE=