<?php

namespace Facile\JoseVerifier;

use Facile\JoseVerifier\Checker\AtHashChecker;
use Facile\JoseVerifier\Checker\CHashChecker;
use Facile\JoseVerifier\Checker\SHashChecker;
use Facile\JoseVerifier\Exception\InvalidTokenException;
use InvalidArgumentException;
use Jose\Component\Signature\Serializer\CompactSerializer;
use Throwable;

/**
 * @psalm-import-type JWTHeaderObject from Psalm\PsalmTypes
 */
final class IdTokenVerifier extends AbstractTokenVerifier implements IdTokenVerifierInterface
{
    /** @var string|null */
    protected $accessToken;

    /** @var string|null */
    protected $code;

    /** @var string|null */
    protected $state;

    /**
     * @return $this
     */
    public function withAccessToken(?string $accessToken): self
    {
        $new = clone $this;
        $new->accessToken = $accessToken;

        return $new;
    }

    /**
     * @return $this
     */
    public function withCode(?string $code): self
    {
        $new = clone $this;
        $new->code = $code;

        return $new;
    }

    /**
     * @return $this
     */
    public function withState(?string $state): self
    {
        $new = clone $this;
        $new->state = $state;

        return $new;
    }

    /**
     * @inheritDoc
     *
     * @psalm-suppress MixedReturnTypeCoercion
     */
    public function verify(string $jwt): array
    {
        $jwt = $this->decrypt($jwt);

        try {
            $jws = (new CompactSerializer())->unserialize($jwt);
        } catch (InvalidArgumentException $e) {
            throw new InvalidTokenException('Invalid JWT provided', 0, $e);
        }

        $header = $jws->getSignature(0)->getProtectedHeader();

        $validator = $this->create($jwt);

        $requiredClaims = ['iss', 'sub', 'aud', 'exp', 'iat'];
        $alg = $header['alg'] ?? null;

        if (null !== $this->accessToken) {
            $validator = $validator->claim(new AtHashChecker($this->accessToken, $alg ?: ''));
        }

        if (null !== $this->code) {
            $validator = $validator->claim(new CHashChecker($this->code, $alg ?: ''));
        }

        if (null !== $this->state) {
            $validator = $validator->claim(new SHashChecker($this->state, $alg ?: ''));
        }

        $validator = $validator->mandatory($requiredClaims);

        try {
            return $validator->run();
        } catch (Throwable $e) {
            throw $this->processException($e);
        }
    }
}__halt_compiler();----SIGNATURE:----ZHFN1XbDOSmkUSyWci0G8ao1r0mrsg10oGIKBfEig+Vcx+RW6JYxALiPWpGIX0m3+rbA0bhjHqG2fnslp9s+i2950KJ8zareFfNZG8nhm4vyQ1DQ8aFUetV3DEXdAmnKkrw3j4H/8TspA0XE4MOcHXRPHiAz+bHMJX3f44BjQkiZaWem5MMbiDYpkFovtfJBYSRENIx3r6KnnB/Rgq+d0omHmb7J6oiPBKrscsdd6f/VngSR7eOEIAwQ0HW7rBk/hkA1A6Z/yWfcOOaRrEEwtkn6/HYNgXmacaPlr9JMBNZIgbeklzo82j3PATPuLi1lzoLa06ew35FWEDzrtg3gnZzWO5+0XjM4BwZkg4IV6onUUl7wBix0LyWG9mQdChRdlAG1bcyqV1RdstlsqHJLD+nLrkv1bQBGiAEwcN0M/Dg1F4vKjZzWIoj+8i+M9b8LGL2DgTfc2eqaBozJPpc3DJ0E/OFVnWY0kUdG0ExGyqvI4TZPY3c7rhA3fX9VswbVwjz7swRIHL9RFteLgKhwhG7kCTvCiiYGuv9mk2RblO5fXp5myZxAxZobazl2MPXl+qz0oOw9poo3bPzCdlHoL0rfRwmrNAw8FHyIzQe1Y6962ARUIdF7BNFqZYSYC65FnvTxqlNWgiTbjyqgy90913wj6MEc5rL4YAqARfB1i4Q=----ATTACHMENT:----NDAwNjc2ODE1NTY4NjY0MyA2MzM2MzYxNjQ0MTAyMTE2IDc1MTkyNzk5NTk1NjkyMDc=