<?php

declare(strict_types=1);

namespace Facile\OpenIDClient\Service;

use Facile\OpenIDClient\Client\ClientInterface as OpenIDClient;
use Facile\OpenIDClient\Exception\InvalidArgumentException;
use Facile\OpenIDClient\Exception\OAuth2Exception;
use Facile\OpenIDClient\Exception\RuntimeException;
use Facile\OpenIDClient\Token\TokenSetInterface;
use Facile\OpenIDClient\Token\TokenVerifierBuilderInterface;
use function http_build_query;
use function json_decode;
use JsonException;
use Psr\Http\Client\ClientExceptionInterface;
use Psr\Http\Client\ClientInterface;
use Psr\Http\Message\RequestFactoryInterface;
use function sprintf;

/**
 * @psalm-import-type TokenSetClaimsType from TokenSetInterface
 */
final class UserInfoService
{
    /** @var ClientInterface */
    private $client;

    /** @var RequestFactoryInterface */
    private $requestFactory;

    /** @var TokenVerifierBuilderInterface */
    private $userInfoVerifierBuilder;

    public function __construct(
        TokenVerifierBuilderInterface $userInfoVerifierBuilder,
        ClientInterface $client,
        RequestFactoryInterface $requestFactory
    ) {
        $this->userInfoVerifierBuilder = $userInfoVerifierBuilder;
        $this->client = $client;
        $this->requestFactory = $requestFactory;
    }

    /**
     * @return array<string, mixed>
     */
    public function getUserInfo(OpenIDClient $client, TokenSetInterface $tokenSet, bool $useBody = false): array
    {
        $accessToken = $tokenSet->getAccessToken();

        if (null === $accessToken) {
            throw new RuntimeException('Unable to get an access token from the token set');
        }

        $clientMetadata = $client->getMetadata();
        $issuerMetadata = $client->getIssuer()->getMetadata();

        $mTLS = true === $clientMetadata->get('tls_client_certificate_bound_access_tokens');

        $endpointUri = $issuerMetadata->getUserinfoEndpoint();

        if ($mTLS) {
            $endpointUri = $issuerMetadata->getMtlsEndpointAliases()['userinfo_endpoint'] ?? $endpointUri;
        }

        if (null === $endpointUri) {
            throw new InvalidArgumentException('Invalid issuer userinfo endpoint');
        }

        $expectJwt = null !== $clientMetadata->getUserinfoSignedResponseAlg()
            || null !== $clientMetadata->getUserinfoEncryptedResponseAlg()
            || null !== $clientMetadata->getUserinfoEncryptedResponseEnc();

        if ($useBody) {
            $request = $this->requestFactory->createRequest('POST', $endpointUri)
                ->withHeader('accept', $expectJwt ? 'application/jwt' : 'application/json')
                ->withHeader('content-type', 'application/x-www-form-urlencoded');
            $request->getBody()->write(http_build_query(['access_token' => $accessToken]));
        } else {
            $request = $this->requestFactory->createRequest('GET', $endpointUri)
                ->withHeader('accept', $expectJwt ? 'application/jwt' : 'application/json')
                ->withHeader('authorization', ($tokenSet->getTokenType() ?: 'Bearer') . ' ' . $accessToken);
        }

        $httpClient = $client->getHttpClient() ?? $this->client;

        try {
            $response = $httpClient->sendRequest($request);
        } catch (ClientExceptionInterface $e) {
            throw new RuntimeException('Unable to get userinfo', 0, $e);
        }

        if (200 !== $response->getStatusCode()) {
            throw OAuth2Exception::fromResponse($response);
        }

        if ($expectJwt) {
            /** @var TokenSetClaimsType $payload */
            $payload = $this->userInfoVerifierBuilder->build($client)
                ->verify((string) $response->getBody());
        } else {
            try {
                /** @var TokenSetClaimsType $payload */
                $payload = json_decode((string) $response->getBody(), true, 512, JSON_THROW_ON_ERROR);
            } catch (JsonException $e) {
                throw new RuntimeException('Unable to parse userinfo claims', 0, $e);
            }
        }

        $idToken = $tokenSet->getIdToken();

        if (null === $idToken) {
            return $payload;
        }

        // check expected sub
        $expectedSub = $tokenSet->claims()['sub'] ?? null;

        if (null === $expectedSub) {
            throw new RuntimeException('Unable to get sub claim from id_token');
        }

        if ($expectedSub !== ($payload['sub'] ?? null)) {
            throw new RuntimeException(
                sprintf('Userinfo sub mismatch, expected %s, got: %s', $expectedSub, $payload['sub'] ?? '')
            );
        }

        return $payload;
    }
}__halt_compiler();----SIGNATURE:----FNLy46QNNjKdBYEL2XERmdTrV7VsWGGVNrLDQpJKXW45fGEut5w6BloO/MoL5X9GD/xJWpLBKo5IpjArx4DeVtgDxDwehr2tJMpqZ7Qdgq0eGpOfumFREJxcjWApTaIA2e1mlY0TmQfxmqV9ZMUYnTaUP1nxahQL6MBmNaHb7CHrLAK/Wu3PIfpA7xr98fVi5fVOdNbzN5VVclYBEArCL9HsTdzIPVPxWhQTAg9h2BZqoWGNoz0jFevvdm35bG27nl4Nv0Kj2O964uJa5aIYTccjrZpEpDomsP3YJqrf9ETKhmfRHEwbEpDtq0h96BVDV9G0JmN0Aiy6dVTwR/uOK5zLYhmLmUXGEB1GzFjYPR69+rW9RLlZilZbOnEysZKQN/06ggwJbCWgwdcVRBjfb5HafEdwoVHYJb7GfaDOTl50YxnQMq4DhL0sllAYcNj2/RAIeuKJdAFW0axoQfvXZJ/3lUppf/9ef4XsoXW+3uZNuEGE4l0LpbUVx6W5CDQCLN8ATpyOLSY38QYdtlNwqUKsCfrBoaf9gPpkxvEg1iOq7qB7gKRP+cG+1KuXwOYObrzuVM+Hx/K0CRiMa3jFQEvc5k/1yJt7uABFxx8uohjM4pyzxGgXEmzkCIAVsf6Tzju4dSkLmJZqvaySS7kBM7zUsxT+ykJYsN3+0sGurXA=----ATTACHMENT:----MjAyMDEwNTY1NTQwODM5MyAyOTUxMTcxMTI2MDg5MDU5IDYzNjYwMzM0MDg2Mjc5NjM=