<?php

namespace App\Services\Licensing;

use RuntimeException;

final class LicenseTokenVerifier
{
    public function verify(string $token): array
    {
        $parts = explode('.', trim($token));
        if (count($parts) !== 3 || $parts[0] !== 'RS3') {
            throw new RuntimeException('Invalid licence token.');
        }
        $payload = $this->decode($parts[1]);
        $signature = $this->decode($parts[2]);
        $public = base64_decode((string) config('rsync-studio.public_key'), true);
        if ($public === false || strlen($public) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES) {
            throw new RuntimeException('Server licence public key is invalid.');
        }
        if (! sodium_crypto_sign_verify_detached($signature, $payload, $public)) {
            throw new RuntimeException('Licence token signature is invalid.');
        }
        $decoded = json_decode($payload, true, flags: JSON_THROW_ON_ERROR);

        return is_array($decoded) ? $decoded : throw new RuntimeException('Licence token payload is invalid.');
    }

    private function decode(string $value): string
    {
        $value = strtr($value, '-_', '+/');
        $value .= str_repeat('=', (4 - strlen($value) % 4) % 4);
        $out = base64_decode($value, true);
        if ($out === false) {
            throw new RuntimeException('Invalid Base64URL value.');
        }

        return $out;
    }
}