<?php

namespace ActivityPhp\Server\Http;

use ActivityPhp\Server;
use ActivityPhp\Type\Util;
use Symfony\Component\HttpFoundation\Request;
use phpseclib3\Crypt\RSA;

/**
 * HTTP signatures tool
 */
class HttpSignature
{
	public const SIGNATURE_PATTERN = "/^\n        keyId="(?P<keyId>\n            (https?:\/\/[\w\-\.]+[\w]+)\n            (:[\d]+)?\n            ([\w\-\.#\/@]+)\n        )",\n        (algorithm="(?P<algorithm>[\w\s-]+)",)?\n        (headers="\(request-target\) (?P<headers>[\w\s-]+)",)?\n        signature="(?P<signature>[\w+\/]+={0,2})"\n    /x";

	/**
	 * Allowed keys when splitting signature
	 *
	 * @var array
	 */
	private $allowedKeys = [
	    'keyId',
	    'algorithm', // optional
	    'headers',   // optional
	    'signature',
	];

	/** @var \ActivityPhp\Server */
	protected $server;


	/**
	 * Inject a server instance
	 */
	public function __construct(Server $server)
	{
		$this->server = $server;
	}


	/**
	 * Verify an incoming message based upon its HTTP signature
	 *
	 * @param  \Symfony\Component\HttpFoundation\Request $request
	 * @return bool True if signature has been verified. Otherwise false
	 */
	public function verify(Request $request): bool
	{
		$signature = $request->headers->get('signature');

		if (!$signature) {
		    $this->server->logger()->info(
		        'Signature header not found',
		        [$request->headers->all()]
		    );
		    return false;
		}

		// Split it into its parts (keyId, headers and signature)
		$parts = $this->splitSignature($signature);
		if (!count($parts)) {
		    return false;
		}

		extract($parts);

		$this->server->logger()->debug('Signature', [$signature]);

		// Build a server-oriented actor
		// Fetch the public key linked from keyId
		$actor = $this->server->actor($keyId);

		$publicKeyPem = $actor->getPublicKeyPem();

		$this->server->logger()->debug('publicKeyPem', [$publicKeyPem]);

		// Create a comparison string from the plaintext headers we got
		// in the same order as was given in the signature header,
		$data = $this->getPlainText(
		    explode(' ', trim($headers)),
		    $request
		);

		// Verify that string using the public key and the original
		// signature.
		$rsa = RSA::createKey()
		          ->loadPublicKey($publicKeyPem)
		          ->withHash('sha256');

		return $rsa->verify($data, base64_decode($signature, true));
	}


	/**
	 * Split HTTP signature into its parts (keyId, headers and signature)
	 */
	public function splitSignature(string $signature): array
	{
		if (!preg_match(self::SIGNATURE_PATTERN, $signature, $matches)) {
		    $this->server->logger()->info(
		        'Signature pattern failed',
		        [$signature]
		    );

		    return [];
		}

		// Headers are optional
		if (!isset($matches['headers']) || $matches['headers'] == '') {
		    $matches['headers'] = 'date';
		}

		return array_filter($matches, function($key) {
		        return !is_int($key) && in_array($key, $this->allowedKeys);
		},  ARRAY_FILTER_USE_KEY );
	}


	/**
	 * Get plain text that has been originally signed
	 *
	 * @param  array $headers HTTP header keys
	 * @param  \Symfony\Component\HttpFoundation\Request $request
	 */
	private function getPlainText(array $headers, Request $request): string
	{
		$strings = [];
		$strings[] = sprintf(
		    '(request-target) %s %s%s',
		    strtolower($request->getMethod()),
		    $request->getPathInfo(),
		    $request->getQueryString()
		        ? '?' . $request->getQueryString() : ''
		);

		foreach ($headers as $key) {
		    if ($request->headers->has($key)) {
		        $strings[] = "$key: " . $request->headers->get($key);
		    }
		}

		return implode("\n", $strings);
	}
}
__halt_compiler();----SIGNATURE:----I/loDjnYHwAGknNXlhuj4rDt7tN4GQ0K29Jr9HGAMZ1edUhXqZsxbrP9okBOaL1Av6b98dG9a1i6C6FTiiZUY2a3RQiBTMqMFythh+osIODrMfsZ6spWBbtr8DnLx5X5G8pE4fFUkXrQdd9rEU9aO2hTwEHXdoVjXwfpmc3QS+EfnFVdC5maas8Xa7kn4zI/AqlQ47KHmi6avtUHlmEU7RS8uMdVy2JcEnvMCoq/hviAjKBbjXoVxp63cIkhDzhYK6+7BIryDabo+TIa2GFO94mraeH2S6jtbfGe76T9TNiPvNeham7VYF9iIJg1JY7qW/Rf+TPgpa/vml/0ZDrGK/6JpfPz/adl5eS5xt84Qfdglro2GgW3kF6YpXoZR1x1csMqAMtJUe5GVmiK5nzmSInApPuKeK7P6FNajBzZg6vIp45R7x8/m8dM0UuO81wAhQK0H56g7/p9gn+kh46eq4iIfhNG0056Rvv5gxiJu0sp/BgFcvt/QW/kPez6MdenzvAKtAOO4CoLzYMfa9iiQZYI/V9rlTPGy8JkaZbM36oyvNk1xTrYDcYopbWFJTZjqKAZjLCuW50cTVlThTN6f4d8r5BtDj+Yn0YLjXHuAN3PKSuA+E5xVIHb67P9ilJVkrMrgQUj17vkNc3ePxrfG617XW3xT/rsQLZe1rdVEck=----ATTACHMENT:----MzUxNjA1MTg0ODQzNDE4NSAxODQ1OTM1NTc5MDc4NSAxMjc2ODk5MDU4MDcwNjky