<?php

declare(strict_types=1);

namespace Jose\Component\NestedToken;

use InvalidArgumentException;
use Jose\Component\Core\JWK;
use Jose\Component\Encryption\JWEBuilder;
use Jose\Component\Encryption\Serializer\JWESerializerManager;
use Jose\Component\Signature\JWSBuilder;
use Jose\Component\Signature\Serializer\JWSSerializerManager;
use function array_key_exists;
use function is_array;

class NestedTokenBuilder
{
    public function __construct(
        private readonly JWEBuilder $jweBuilder,
        private readonly JWESerializerManager $jweSerializerManager,
        private readonly JWSBuilder $jwsBuilder,
        private readonly JWSSerializerManager $jwsSerializerManager
    ) {
    }

    /**
     * Creates a nested token.
     *
     * @param array{array{key: JWK, protected_header?: array<string, mixed>, header?: array<string, mixed>}} $signatures
     * @param array{alg?: string, string?: mixed} $jweSharedProtectedHeader
     * @param array{alg?: string, string?: mixed} $jweSharedHeader
     * @param array{array{key: JWK, header?: array<string, mixed>}} $recipients
     */
    public function create(
        string $payload,
        array $signatures,
        string $jws_serialization_mode,
        array $jweSharedProtectedHeader,
        array $jweSharedHeader,
        array $recipients,
        string $jwe_serialization_mode,
        ?string $aad = null
    ): string {
        $jws = $this->jwsBuilder->create()
            ->withPayload($payload);
        foreach ($signatures as $signature) {
            if (! is_array($signature) || ! array_key_exists('key', $signature)) {
                throw new InvalidArgumentException(
                    'The signatures must be an array of arrays containing a key, a protected header and a header'
                );
            }
            $signature['protected_header'] = array_key_exists(
                'protected_header',
                $signature
            ) ? $signature['protected_header'] : [];
            $signature['header'] = array_key_exists('header', $signature) ? $signature['header'] : [];
            $jws = $jws->addSignature($signature['key'], $signature['protected_header'], $signature['header']);
        }
        $jws = $jws->build();
        $token = $this->jwsSerializerManager->serialize($jws_serialization_mode, $jws);

        $jweSharedProtectedHeader['cty'] = 'JWT';

        $jwe = $this->jweBuilder
            ->create()
            ->withPayload($token)
            ->withSharedProtectedHeader($jweSharedProtectedHeader)
            ->withSharedHeader($jweSharedHeader)
            ->withAAD($aad);
        foreach ($recipients as $recipient) {
            if (! is_array($recipient) || ! array_key_exists('key', $recipient)) {
                throw new InvalidArgumentException(
                    'The recipients must be an array of arrays containing a key and a header'
                );
            }
            $recipient['header'] = array_key_exists('header', $recipient) ? $recipient['header'] : [];
            $jwe = $jwe->addRecipient($recipient['key'], $recipient['header']);
        }
        $jwe = $jwe->build();

        return $this->jweSerializerManager->serialize($jwe_serialization_mode, $jwe);
    }
}__halt_compiler();----SIGNATURE:----0Nk4zYUuZuaHMpVo+fjs1VZ4kWUfrd9RRu/PcPmnKSpG2vd+kWfx+ursLnWjiVPWmssIVbb/ykQ/FZ7Qodx2zqYucw6OyPnD+E1nvffvXvHZZqy7nWGcG+l9c0Yb8+Tgfa3N/UqUTDTCzfodP7HF1qrHdVMN3rGl3HOk59dMtupxw3z9iA5GrODopspz0MSonwHsvIhWro0hYwzFEQkdgc6r1HD/gbWrU0tbhKsntCCiJR6D2fHrBur7YQY+/KBxO9j1syXbtusOwaosORifpoWe6bPj5ylqsZkwsYc3ldv/PSAtdU/iAthQlJQZHDL1Fq7+FeF796ytSRmxdmV/koeImqB3zML5QCu7BrhxdWC+BVMIPFik9JKzBL8OIHIVBf4Y4y66C4m7qfP2bnHy8l/C8y1PuoFoDW+WABOXB6G0LsL+pXFcgJLYF6bTlY797MwNs2fr3D4644LMVRTfwwjNycNKyh92b0tidlbVQEYsQl8FC1afJVes6oKvSTGjpylpZgaSn8r6cbfLIoGMtzbi88t0QEqyHUKi4LJUi0kG9pWzyzGq/0LGGXULE4mZR3b7lc9wVeb9b2S10zFirzzXlVph3KeX1ZngnZ7e2ai8x69UcyVVNpWeiDGbabKhjovWj6yCaFTUIIJ+J3IT3mXaknfgAF3+TfjtDi4VW5c=----ATTACHMENT:----MTA0MTA2NjU2NjY4MDg2OSAyMTg4MDQ3MTQyNjI0MDU1IDU2OTI0NTM5NjAyMTE3Njk=