<?php

namespace Jose\Component\NestedToken;

use InvalidArgumentException;
use Jose\Component\Core\JWK;
use Jose\Component\Encryption\JWEBuilder;
use Jose\Component\Encryption\Serializer\JWESerializerManager;
use Jose\Component\Signature\JWSBuilder;
use Jose\Component\Signature\Serializer\JWSSerializerManager;

use function array_key_exists;
use function is_array;

class NestedTokenBuilder
{
    public function __construct(
        private readonly JWEBuilder $jweBuilder,
        private readonly JWESerializerManager $jweSerializerManager,
        private readonly JWSBuilder $jwsBuilder,
        private readonly JWSSerializerManager $jwsSerializerManager,
    ) {
    }

    /**
     * Creates a nested token.
     *
     * @param array{array{key: JWK, protected_header?: array<string, mixed>, header?: array<string, mixed>}} $signatures
     * @param array{alg?: string, string?: mixed} $jweSharedProtectedHeader
     * @param array{alg?: string, string?: mixed} $jweSharedHeader
     * @param array{array{key: JWK, header?: array<string, mixed>}} $recipients
     */
    public function create(
        string $payload,
        array $signatures,
        string $jws_serialization_mode,
        array $jweSharedProtectedHeader,
        array $jweSharedHeader,
        array $recipients,
        string $jwe_serialization_mode,
        ?string $aad = null,
    ): string {
        $jws = $this->jwsBuilder->create()
            ->withPayload($payload);
        foreach ($signatures as $signature) {
            if (! is_array($signature) || ! array_key_exists('key', $signature)) {
                throw new InvalidArgumentException(
                    'The signatures must be an array of arrays containing a key, a protected header and a header'
                );
            }
            $signature['protected_header'] = array_key_exists(
                'protected_header',
                $signature
            ) ? $signature['protected_header'] : [];
            $signature['header'] = array_key_exists('header', $signature) ? $signature['header'] : [];
            $jws = $jws->addSignature($signature['key'], $signature['protected_header'], $signature['header']);
        }
        $jws = $jws->build();
        $token = $this->jwsSerializerManager->serialize($jws_serialization_mode, $jws);

        $jweSharedProtectedHeader['cty'] = 'JWT';

        $jwe = $this->jweBuilder
            ->create()
            ->withPayload($token)
            ->withSharedProtectedHeader($jweSharedProtectedHeader)
            ->withSharedHeader($jweSharedHeader)
            ->withAAD($aad);
        foreach ($recipients as $recipient) {
            if (! is_array($recipient) || ! array_key_exists('key', $recipient)) {
                throw new InvalidArgumentException(
                    'The recipients must be an array of arrays containing a key and a header'
                );
            }
            $recipient['header'] = array_key_exists('header', $recipient) ? $recipient['header'] : [];
            $jwe = $jwe->addRecipient($recipient['key'], $recipient['header']);
        }
        $jwe = $jwe->build();

        return $this->jweSerializerManager->serialize($jwe_serialization_mode, $jwe);
    }
}__halt_compiler();----SIGNATURE:----15nmW2VI2fvtGQ0XqyYBGSgR1L0VjFOsTJnS2s8freD/s1VUwj5Uv8pE2QIuOquxD1grmr/z5cXaKVJw2HtPTTruNWz9fmOD8OqlyXVnDqlNMSozGqR7cbRIdMdvEk0jEH2XSYz2nN81ZAYmHMPiXCmDd8q3RYz3dN+v0DPr6Xb64EXyLuHIXHB7yNwcwyAcKKAMHiTSS+sqqeRG+1qBsLIkRyi2kQ4iYS6QAvaNZNLMwD3nOrsTfr6AhVh4r/qkPQXA8RjxTMuhR8spk8hggH9SVLHZpyBi71SaqVI/AzNigLy69es07lok6+pP/A8YGhBJh0uwaZ9/cl0IUizrtIUPrfPovayBsxw0c+N7kdIYq3MYp0TiXoQWXuHjmCpfixwBprhhBaakb4WkVZ/ZIl9lVGZX/PlP2kjhsa4QfRIZbWkicTdTvOokyudz2rxD112qcnJ7HT1QCLW92Jt+ZZp7qutHtBRDj5So9I8noGH9CjpLShupyYx/Y8fIdLPrtxPi13Oxcrlsrk49MyCR/ccTBcmnYJhS4mnIkadHlSzTbgE/Jg//IZp+XiJhSJ7L3GoNBGJtaw4ZaDVVrHI6fbOl/+AwP+DJVFetVu4oWcuuXKI5FR5TqHPtsAD58ATF/5gf6qJrijxov/+8Veb23WIPL9wwz/2khCAaRPJyXnY=----ATTACHMENT:----MzQ2MzkyNzAzOTEzNjI2OSA0Nzk2NDY2MjA1NTczMDcyIDk3MzY2NzA5NDY4NDU5MjY=