<?php

declare(strict_types=1);

namespace Jose\Component\NestedToken;

use InvalidArgumentException;
use Jose\Component\Core\JWKSet;
use Jose\Component\Encryption\JWE;
use Jose\Component\Encryption\JWELoader;
use Jose\Component\Signature\JWS;
use Jose\Component\Signature\JWSLoader;
use function is_string;

class NestedTokenLoader
{
    public function __construct(
        private readonly JWELoader $jweLoader,
        private readonly JWSLoader $jwsLoader
    ) {
    }

    /**
     * This method will try to load, decrypt and verify the token. In case of failure, an exception is thrown, otherwise
     * returns the JWS and populates the $signature variable.
     */
    public function load(string $token, JWKSet $encryptionKeySet, JWKSet $signatureKeySet, ?int &$signature = null): JWS
    {
        $recipient = null;
        $jwe = $this->jweLoader->loadAndDecryptWithKeySet($token, $encryptionKeySet, $recipient);
        $this->checkContentTypeHeader($jwe, $recipient);
        if ($jwe->getPayload() === null) {
            throw new InvalidArgumentException('The token has no payload.');
        }

        return $this->jwsLoader->loadAndVerifyWithKeySet($jwe->getPayload(), $signatureKeySet, $signature);
    }

    private function checkContentTypeHeader(JWE $jwe, int $recipient): void
    {
        $cty = match (true) {
            $jwe->hasSharedProtectedHeaderParameter('cty') => $jwe->getSharedProtectedHeaderParameter('cty'),
            $jwe->hasSharedHeaderParameter('cty') => $jwe->getSharedHeaderParameter('cty'),
            $jwe->getRecipient($recipient)
                ->hasHeaderParameter('cty') => $jwe->getRecipient($recipient)
                ->getHeaderParameter('cty'),
            default => throw new InvalidArgumentException('The token is not a nested token.'),
        };
        if (! is_string($cty)) {
            throw new InvalidArgumentException('Invalid "cty" header parameter.');
        }

        if (strcasecmp($cty, 'jwt') !== 0) {
            throw new InvalidArgumentException('The token is not a nested token.');
        }
    }
}__halt_compiler();----SIGNATURE:----GnZvDxsdun9RVG/ZTSLGX+AjMkOAJtLTgUGbH4VUzt0xPWtjJZFlbDMR1BOLTPqBrKNvPtpMsaF6bwNR76gb4f13qP7IGFfOaAfc5GikY4lYzhsq060NxxLvAfS+5c1fsrZ8bLYLJEQbw4GJYIXop9r+dI5fHXhFVG4vBqZyzfT5cDjpWMSlpwenjnB0ucrI4nC+FRAwQ4EnMI4V0VWUbPwjXnEHrZ0a/Z/XHDXhBi2ZdcCVAYTSMq2ArofpCZe6R0dE4fdZ7bT4BV9PYju/fDOIFbwVZ4Bn9P9zqjrv4Jv0pBFy0UIfS6PEOeZxBKTAaMq+JwZkCGzMS4hasyS+leK3RhCI7YOwhJ+KXQJgp16UWK5ulcxsNTQ+aEiw72JfeDxzdqTiWhhOlnkWwKpPiExNM3+jFYulLK98gSAuYssrB6CVhSPUvsJJWgQxoseiSEJMov2cDwHzcr1dYbSBIJl78kL65bl4EwpYTy2haesHDf1Cwot8QdhDPR2vEhjkh094bQJAMRUA19gIgi1lGRuiwatuP3aFtpRdxjeVesVRAmOWbgDl9wJSVnACNM5ExDLZJGJFHfCBngNHjY0Kn7P8oxOjryMF7/v3dn+SRVj8gF3v9D6+i/nBbYgcIWm8nET5nNZYDddSAdv3raPB1d6lBlUM+EthbrzCiVHLQac=----ATTACHMENT:----MTU2NzUyMjk4MTE2ODEzNCA5NjAwNjgxNTc2MTA1MDYwIDc5NDg3MzE1OTMzNzc0MjQ=