<?php

namespace Modules\Marketplace\Services;

use RuntimeException;

final class PackageVerifier
{
    public function verify(string $path, array $manifest, ?string $expectedChecksum = null): array
    {
        if (! is_file($path)) {
            throw new RuntimeException("Package archive [$path] does not exist.");
        }
        $actual = hash_file('sha256', $path);
        $expected = $expectedChecksum ?: ($manifest['checksum'] ?? null);
        if (config('marketplace.require_checksum', true) && blank($expected)) {
            throw new RuntimeException('A SHA-256 checksum is required.');
        }
        if (filled($expected) && ! hash_equals(strtolower((string) $expected), strtolower($actual))) {
            throw new RuntimeException('Package checksum verification failed.');
        }
        if (config('marketplace.require_signature', false) && blank($manifest['signature'] ?? null)) {
            throw new RuntimeException('A package signature is required.');
        }

        return ['verified' => true, 'checksum' => $actual, 'signature_present' => filled($manifest['signature'] ?? null)];
    }
}