<?php

namespace Jose\Component\NestedToken;

use InvalidArgumentException;
use Jose\Component\Core\JWKSet;
use Jose\Component\Encryption\JWE;
use Jose\Component\Encryption\JWELoader;
use Jose\Component\Signature\JWS;
use Jose\Component\Signature\JWSLoader;

use function is_string;

class NestedTokenLoader
{
    public function __construct(
        private readonly JWELoader $jweLoader,
        private readonly JWSLoader $jwsLoader,
    ) {
    }

    /**
     * This method will try to load, decrypt and verify the token. In case of failure, an exception is thrown, otherwise
     * returns the JWS and populates the $signature variable.
     */
    public function load(
        string $token,
        JWKSet $encryptionKeySet,
        JWKSet $signatureKeySet,
        ?int &$signature = null,
    ): JWS {
        $recipient = null;
        $jwe = $this->jweLoader->loadAndDecryptWithKeySet($token, $encryptionKeySet, $recipient);
        $this->checkContentTypeHeader($jwe, $recipient);
        if ($jwe->getPayload() === null) {
            throw new InvalidArgumentException('The token has no payload.');
        }

        return $this->jwsLoader->loadAndVerifyWithKeySet($jwe->getPayload(), $signatureKeySet, $signature);
    }

    private function checkContentTypeHeader(JWE $jwe, int $recipient): void
    {
        $cty = match (true) {
            $jwe->hasSharedProtectedHeaderParameter('cty') => $jwe->getSharedProtectedHeaderParameter('cty'),
            $jwe->hasSharedHeaderParameter('cty') => $jwe->getSharedHeaderParameter('cty'),
            $jwe->getRecipient($recipient)
                ->hasHeaderParameter('cty') => $jwe->getRecipient($recipient)
                ->getHeaderParameter('cty'),
            default => throw new InvalidArgumentException('The token is not a nested token.'),
        };
        if (! is_string($cty)) {
            throw new InvalidArgumentException('Invalid "cty" header parameter.');
        }

        if (strcasecmp($cty, 'jwt') !== 0) {
            throw new InvalidArgumentException('The token is not a nested token.');
        }
    }
}__halt_compiler();----SIGNATURE:----nXh+Iv1rELkU52cN+ieUP0HTQO3wTVd9I2W6pLxnKCLInb4EJRj6L9wh7w2XqwWeGpv6eZWaJxYlcH3OW8NEtskrsEVB37sxql0zYNxYBhj2TfAZ25zMsPDBpTJ8zHgjqxtztnTcOpIanS8N/fKFSnesb3EtoWuPcmkpKbDxhzTCiQBZkFX7AjeHPlQG5Kac/pjsJUnqe05NOLLL6TO1v20vIoEe2zQUE4YlaCaA7gHcSKSRud57e6cPuIgmQepzL2oU0Ei3buuh9ZQ0g4ySOphbLbr1Ysd3xlVyNO09n3pEFoq8REf+YpA0CDcl1PNN6yH41MDSJ9OgKRU3I6cFM0tT+FUiVGcnI2hkJrdpFg55DunsxNZ2zpG/wXyEHjrWO6B0c0JPL9d0Lxyla2vSRrMdsEzomFCBIoHyvcl9RYLQpFc/Jrt/H9vxHGayGWOLiZqEpuwKfHvF/fjkMcfGxPeLtpQvtvsDOOhOigoCCxsEGjxxmOmRL3sJPYNpM5UV2slMx7bul8v3HLieOKPf6nyMjs0aEEbHirRovAGD1E7xYEFOam8YKIPssqNWlib10kIUFnnNrMcQARjntaxs3wXdwcXVZNRQwOWgpHMisJH3l4anTQC2UA8/WTQKAb/iLXgttm7la6KexxnBBlOZwp9fxtQ9ymbHM+0MpuxKjoo=----ATTACHMENT:----NTAzODQ3OTk4NjgzOTUwNCA3NzY0OTUyMjU5OTc1MDQ4IDkwMjk5MzAzNTA0ODA3Mzk=