<?php

declare(strict_types=1);

namespace Facile\OpenIDClient\AuthMethod;

use function class_exists;
use function Facile\OpenIDClient\base64url_encode;
use Facile\OpenIDClient\Client\ClientInterface as OpenIDClient;
use Facile\OpenIDClient\Exception\InvalidArgumentException;
use Facile\OpenIDClient\Exception\LogicException;
use function Facile\OpenIDClient\get_endpoint_uri;
use function Facile\OpenIDClient\jose_secret_key;
use Jose\Component\Core\AlgorithmManager;
use Jose\Component\Signature\Algorithm\HS256;
use Jose\Component\Signature\JWSBuilder;
use Jose\Component\Signature\Serializer\CompactSerializer;
use Jose\Component\Signature\Serializer\JWSSerializer;
use function json_encode;
use function random_bytes;
use function time;

final class ClientSecretJwt extends AbstractJwtAuth
{
    /** @var null|JWSBuilder */
    private $jwsBuilder;

    /** @var JWSSerializer */
    private $jwsSerializer;

    /**
     * ClientSecretJwt constructor.
     */
    public function __construct(
        ?JWSBuilder $jwsBuilder = null,
        ?JWSSerializer $jwsSerializer = null
    ) {
        $this->jwsBuilder = $jwsBuilder;
        $this->jwsSerializer = $jwsSerializer ?? new CompactSerializer();
    }

    public function getSupportedMethod(): string
    {
        return 'client_secret_jwt';
    }

    private function getJwsBuilder(): JWSBuilder
    {
        if (null !== $this->jwsBuilder) {
            return $this->jwsBuilder;
        }

        if (! class_exists(HS256::class)) {
            throw new LogicException('To use the client_secret_jwt auth method you should install web-token/jwt-signature-algorithm-hmac package');
        }

        return $this->jwsBuilder = new JWSBuilder(new AlgorithmManager([new HS256()]));
    }

    protected function createAuthJwt(OpenIDClient $client, array $claims = []): string
    {
        $clientSecret = $client->getMetadata()->getClientSecret();

        if (null === $clientSecret) {
            throw new InvalidArgumentException($this->getSupportedMethod() . ' cannot be used without client_secret metadata');
        }

        $clientId = $client->getMetadata()->getClientId();

        $jwk = jose_secret_key($clientSecret);

        $time = time();
        $jti = base64url_encode(random_bytes(32));

        $payload = json_encode($claims +
            [
                'iss' => $clientId,
                'sub' => $clientId,
                'aud' => get_endpoint_uri($client, 'token_endpoint'),
                'iat' => $time,
                'exp' => $time + 60,
                'jti' => $jti,
            ], JSON_THROW_ON_ERROR);

        $jws = $this->getJwsBuilder()->create()
            ->withPayload($payload)
            ->addSignature($jwk, ['alg' => 'HS256', 'jti' => $jti])
            ->build();

        return $this->jwsSerializer->serialize($jws, 0);
    }
}__halt_compiler();----SIGNATURE:----rMbr/M8HUVNyjAUrSJ0wiLt2iqlA60r1DpoKa9ExfWfQAhAKm4+txqmG1ojCLN3qiMJsJGa+ByFh2xToq/gmBiJQErDuAJqjaB9IlQG9pFXEz5+s9hyIrl9qFA9+y9e3idIbY6rYRpMViWBOyaWNGBgc8j9i/ArVRNGtiU4dd5+lT+bEOt6vBSCNuZLfqvpA3lE72Deztia9UIl30E0nWBNCk9yBAa7sDkKLxR2Wzg2hV7whDMkyTP07eNM4MjIjBElP1/aGUqLxKqumaC2j12+rFED0QVf4pHtpFM9BPReLpXC3BNQXEvX1CtzxEisUH9chrjWQ1hLcLrhWXQxd8AUfuiveMh4kLLjfbdiSPNjJAlJ6fEZbF62xoa+4Qg3SVd/pIT6Pd97VZy1zSDaWGKV0WkJggg6pwFQvBp4SswU8LoHBQPWvqjcOgiKUx4jAj+0E+UcDUjrbIj9XUpV6mvCQnGdtIw6muRm2eeAYuPq9yyyua66UgdtEHXVkRaiZEeZfmYYgNjvudyeROdsK/0KOjTs/2ZX0zU1H2dLflZLUsGSxbH4GfQDZfBaFSUaZXul1VCBvjijFQsi/8o+ltXwnkQ6Imm6DI1TBnvsLIlB8r/wCNyVysyMYgXT1vJRSIgigKRxJLkqRNBaI7kKLHr6AeAvDxsyOBC/ZdbIO0Lc=----ATTACHMENT:----MTA5MTc5MjQ5OTEyODYwMCA5ODE2NTgwMTQ1ODMzMDggNzQxMTQzMTAyMTExNTQxNQ==