<?php

namespace Facile\JoseVerifier;

use Facile\JoseVerifier\Checker\AtHashChecker;
use Facile\JoseVerifier\Checker\CHashChecker;
use Facile\JoseVerifier\Checker\SHashChecker;
use Facile\JoseVerifier\Exception\InvalidTokenException;
use InvalidArgumentException;
use Jose\Component\Signature\Serializer\CompactSerializer;
use Throwable;

/**
 * @psalm-import-type JWTHeaderObject from Psalm\PsalmTypes
 */
final class IdTokenVerifier extends AbstractTokenVerifier implements IdTokenVerifierInterface
{
    /** @var string|null */
    protected $accessToken;

    /** @var string|null */
    protected $code;

    /** @var string|null */
    protected $state;

    /**
     * @return $this
     */
    public function withAccessToken(?string $accessToken): self
    {
        $new = clone $this;
        $new->accessToken = $accessToken;

        return $new;
    }

    /**
     * @return $this
     */
    public function withCode(?string $code): self
    {
        $new = clone $this;
        $new->code = $code;

        return $new;
    }

    /**
     * @return $this
     */
    public function withState(?string $state): self
    {
        $new = clone $this;
        $new->state = $state;

        return $new;
    }

    /**
     * @inheritDoc
     *
     * @psalm-suppress MixedReturnTypeCoercion
     */
    public function verify(string $jwt): array
    {
        $jwt = $this->decrypt($jwt);

        try {
            $jws = (new CompactSerializer())->unserialize($jwt);
        } catch (InvalidArgumentException $e) {
            throw new InvalidTokenException('Invalid JWT provided', 0, $e);
        }

        $header = $jws->getSignature(0)->getProtectedHeader();

        $validator = $this->create($jwt);

        $requiredClaims = ['iss', 'sub', 'aud', 'exp', 'iat'];
        $alg = $header['alg'] ?? null;

        if (null !== $this->accessToken) {
            $validator = $validator->claim(new AtHashChecker($this->accessToken, $alg ?: ''));
        }

        if (null !== $this->code) {
            $validator = $validator->claim(new CHashChecker($this->code, $alg ?: ''));
        }

        if (null !== $this->state) {
            $validator = $validator->claim(new SHashChecker($this->state, $alg ?: ''));
        }

        $validator = $validator->mandatory($requiredClaims);

        try {
            return $validator->run();
        } catch (Throwable $e) {
            throw $this->processException($e);
        }
    }
}__halt_compiler();----SIGNATURE:----prHcN7cTUgrK2cwvmc3OxYYqwCSZtvAyzvG+i0eNWd8hg/ZBMuOkZXg/uQrExGICp+CsAHQhyfvKuBBZXBK6GXzRvIZRv7NRdIYg795X8A15D+SfelBHggwiM3Re1a9DA+EkDhCnf4IhCT9+L7MaNvJpT3EOw0pt0ebWlE4LaYkIKFM37ceL7BCf5JttnWuTxmwhZOr2xnlDQk9e65OJMKTVdhZ+jDV8SoXBWA3i2RfWErOoz7m0E1sq3Di4xzR8MoKbdIAF0U8aEXQERXso3cZ+mFtosO5/kEEzIEYjrwVxWVGvtVmJ6J+AEr5G0FZVejJ7dsxPFCMAEQ7R6Xjyw5xPFsmMIZMM6X4LcJFmYhwK1PKAH8o4HP40uYyyUEPBw6lxtwS8EqNMBZaRa6fLCr1tnUZyboQr8jLlhyruJ1xN/8B+gSLbd/aLVMfFngGQ/vPeApumiQiyUJ0bHWSDsBMJGFr8HzRUTwsSY14apL1LtaGgAGX7uwgQfIbeO939y0UfDwW/OcjJ6/oOrn3rvkqh6V8TbSJM48Gwbn7CYi4DrbWk4KFExP36ogFwwNLH1BUHZHNOyDhIY1sqdsKn7EioC7oZs867zZYHPGrkWQsewHLMuWS+24bE6YDrTz496F1z7u7fANIrhE9dLUdqEd8p0zMi5BlUCBiY1phjeME=----ATTACHMENT:----NDYzMjI3MzQ2Mjg2MjI4OCA0MTExNzUzMjM5MzAxNzQ3IDI1Njc0ODYwMTMzMzI3NTM=