<?php

declare(strict_types=1);

namespace App\Security;

use Random\RandomException;

final class ApiKeyGenerator
{
    /**
     * Generates a cryptographically secure API key.
     * It combines a prefix for identification with a strong random string.
     * Consider storing the hash of this key, not the key itself, in the database.
     *
     * @param string $prefix A short identifier for the key's purpose (e.g., 'usr_', 'svc_').
     * @param int $length The desired length of the random part of the key.
     * @return string The generated API key.
     * @throws RandomException If a suitable random source cannot be found.
     */
    public static function generate(string $prefix = 'api_', int $length = 32): string
    {
        // Ensure the prefix is safe and only contains alphanumeric characters or underscores.
        // We limit the prefix length to prevent overly long keys.
        $prefix = preg_replace('/[^a-zA-Z0-9_]/', '', $prefix);
        if (strlen($prefix) > 8) {
            $prefix = substr($prefix, 0, 8);
        }

        // Generate random bytes and convert to hexadecimal.
        // Each byte becomes two hexadecimal characters, so divide length by 2 for bytes.
        $bytes = random_bytes((int) ceil($length / 2));
        $key = bin2hex($bytes);

        // Truncate or pad to ensure the final key length (after prefix) is exact if needed.
        // For simplicity, we just take the required length from the hex string.
        $key = substr($key, 0, $length);

        return $prefix . $key;
    }

    /**
     * Hashes an API key for secure storage.
     *
     * @param string $apiKey The raw API key to hash.
     * @return string The hashed API key.
     */
    public static function hashApiKey(string $apiKey): string
    {
        // Use a strong, adaptive hashing algorithm like bcrypt or argon2i/d.
        // PASSWORD_ARGON2ID is recommended for general-purpose hashing as of PHP 7.4+.
        return password_hash($apiKey, PASSWORD_ARGON2ID);
    }

    /**
     * Verifies a raw API key against a stored hash.
     *
     * @param string $apiKey The raw API key provided by the client.
     * @param string $hashedApiKey The hashed API key retrieved from storage.
     * @return bool True if the key is valid, false otherwise.
     */
    public static function verifyApiKey(string $apiKey, string $hashedApiKey): bool
    {
        return password_verify($apiKey, $hashedApiKey);
    }
}

// --- Example Usage ---
// $newApiKey = ApiKeyGenerator::generate('app_');
// echo "Generated Key: " . $newApiKey . "\n";

// $hashedKey = ApiKeyGenerator::hashApiKey($newApiKey);
// echo "Hashed Key: " . $hashedKey . "\n";

// $isValid = ApiKeyGenerator::verifyApiKey($newApiKey, $hashedKey);
// echo "Key is valid: " . ($isValid ? 'Yes' : 'No') . "\n";

// $invalidKey = ApiKeyGenerator::verifyApiKey('invalid_key_string', $hashedKey);
// echo "Invalid key check: " . ($invalidKey ? 'Yes' : 'No') . "\n";

<?php

declare(strict_types=1);

namespace App\Security;

use DateTimeImmutable;

// A simplified example for demonstration. In a real application, you would use a robust JWT library
// like lcobucci/jwt or firebase/php-jwt for production-grade security and features.
// This class demonstrates the core concepts of token generation and validation.

final class BearerTokenManager
{
    private string $secretKey;

    public function __construct(string $secretKey)
    {
        // Ensure a strong, unique secret key is used. Load from environment variables.
        if (empty($secretKey) || strlen($secretKey) < 32) {
            throw new \InvalidArgumentException('A strong secret key is required for token management.');
        }
        $this->secretKey = $secretKey;
    }

    /**
     * Generates a simple bearer token for a user.
     * In a real system, this would typically be a JWT with claims (user ID, roles, expiry).
     *
     * @param int $userId The ID of the user.
     * @param array $payload Additional data to encode into the token.
     * @param int $expirySeconds Token expiration time in seconds.
     * @return string The generated bearer token.
     */
    public function generateToken(int $userId, array $payload = [], int $expirySeconds = 3600): string
    {
        $header = base64_encode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
        
        $issuedAt = (new DateTimeImmutable())->getTimestamp();
        $expiresAt = $issuedAt + $expirySeconds;

        $claims = array_merge([ // Standard JWT claims
            'iss' => 'your-api-domain.com', // Issuer
            'aud' => 'your-api-client.com', // Audience
            'sub' => (string) $userId, // Subject (user ID)
            'iat' => $issuedAt, // Issued at
            'exp' => $expiresAt, // Expiration time
        ], $payload);

        $body = base64_encode(json_encode($claims));

        $signature = hash_hmac('sha256', "{$header}.{$body}", $this->secretKey, true);
        $encodedSignature = base64_encode($signature);

        return "{$header}.{$body}.{$encodedSignature}";
    }

    /**
     * Validates a bearer token.
     *
     * @param string $token The bearer token to validate.
     * @return array|null The token payload if valid, null otherwise.
     */
    public function validateToken(string $token): ?array
    {
        $parts = explode('.', $token);
        if (count($parts) !== 3) {
            return null; // Invalid token format
        }

        list($headerEncoded, $bodyEncoded, $signatureEncoded) = $parts;

        // 1. Verify signature
        $expectedSignature = hash_hmac('sha256', "{$headerEncoded}.{$bodyEncoded}", $this->secretKey, true);
        if (!hash_equals($expectedSignature, base64_decode($signatureEncoded))) {
            return null; // Invalid signature
        }

        // 2. Decode payload
        $payload = json_decode(base64_decode($bodyEncoded), true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            return null; // Malformed payload
        }

        // 3. Check expiration (exp claim)
        if (!isset($payload['exp']) || $payload['exp'] < (new DateTimeImmutable())->getTimestamp()) {
            return null; // Token expired or no expiration set
        }
        
        // 4. Implement further checks (iss, aud, nbf, jti for replay prevention) in a real scenario.

        return $payload;
    }
}

// --- Example Usage ---
// $secret = getenv('JWT_SECRET_KEY') ?: 'super_secret_key_at_least_32_characters_long_replace_me';
// $tokenManager = new BearerTokenManager($secret);

// $userId = 123;
// $extraData = ['role' => 'admin'];
// $token = $tokenManager->generateToken($userId, $extraData, 3600); // Expires in 1 hour
// echo "Generated Token: " . $token . "\n";

// // Simulate validation
// $validatedPayload = $tokenManager->validateToken($token);
// if ($validatedPayload) {
//     echo "Token is valid. User ID: " . $validatedPayload['sub'] . ", Role: " . $validatedPayload['role'] . "\n";
// } else {
//     echo "Token validation failed.\n";
// }

// // Simulate an expired token (for testing, would require modifying the 'exp' claim or waiting)
// // For a real test, you'd need to mock time or generate a token with a past expiry.
// $expiredToken = $tokenManager->generateToken($userId, $extraData, -100); // Already expired
// $isExpired = $tokenManager->validateToken($expiredToken);
// if (!$isExpired) {
//     echo "Expired token correctly rejected.\n";
// }

<?php

declare(strict_types=1);

namespace App\Http\Middleware;

use Psr\Http\Message\ServerRequestInterface as Request;
use Psr\Http\Server\RequestHandlerInterface as RequestHandler;
use Psr\Http\Message\ResponseInterface as Response;
use Laminas\Diactoros\Response\JsonResponse;

// This example assumes you have a PSR-7/PSR-15 compatible request/response handling setup
// and a Redis client available. Install 'predis/predis' or 'symfony/redis'
// for a production application.

final class RateLimitingMiddleware
{
    private \Redis $redisClient; // Or a more generic cache interface
    private int $limit;
    private int $windowSeconds;

    /**
     * @param \Redis $redisClient An initialized Redis client instance.
     * @param int $limit The maximum number of requests allowed within the window.
     * @param int $windowSeconds The time window in seconds (e.g., 60 for 1 minute).
     */
    public function __construct(\Redis $redisClient, int $limit, int $windowSeconds)
    {
        $this->redisClient = $redisClient;
        $this->limit = $limit;
        $this->windowSeconds = $windowSeconds;
    }

    /**
     * Processes a request and applies rate limiting.
     */
    public function process(Request $request, RequestHandler $handler): Response
    {
        // Identify the client. This could be by API key, IP address, or authenticated user ID.
        // For simplicity, we use the client's IP address here.
        // In a real API, use the API key or authenticated user ID for finer-grained control.
        $identifier = $request->getServerParams()['REMOTE_ADDR'] ?? 'unknown_ip';
        // For API key based limiting, you'd extract the API key from the request header.
        // $apiKey = $request->getHeaderLine('X-API-Key');
        // $identifier = 'api_key:' . $apiKey;

        $key = 'rate_limit:' . $identifier;

        // Using Redis INCR and EXPIRE for a simple fixed-window counter.
        // We increment the counter for the identifier and set/reset its expiration.
        $currentCount = $this->redisClient->incr($key);

        // Set expiration ONLY if it's a new key. If the key already exists, do not overwrite TTL.
        // This is crucial for fixed-window to work correctly.
        if ($currentCount === 1) {
            $this->redisClient->expire($key, $this->windowSeconds);
        }

        if ($currentCount > $this->limit) {
            // Rate limit exceeded. Return a 429 Too Many Requests response.
            $response = new JsonResponse([
                'status' => 'error',
                'message' => 'Rate limit exceeded. Please try again later.'
            ], 429);

            // Include informative headers for clients
            $response = $response->withHeader('X-RateLimit-Limit', (string) $this->limit);
            $response = $response->withHeader('X-RateLimit-Remaining', '0');
            // Calculate the time until the next reset, assuming a fixed window from now.
            $resetTime = time() + $this->redisClient->ttl($key);
            $response = $response->withHeader('X-RateLimit-Reset', (string) $resetTime);

            return $response;
        }

        // If not limited, proceed with the request and add rate limit headers
        $response = $handler->handle($request);

        // Calculate remaining requests for informative headers
        $remaining = $this->limit - $currentCount;
        $resetTime = time() + $this->redisClient->ttl($key);
        
        return $response
            ->withHeader('X-RateLimit-Limit', (string) $this->limit)
            ->withHeader('X-RateLimit-Remaining', (string) $remaining)
            ->withHeader('X-RateLimit-Reset', (string) $resetTime);
    }
}

// --- Example Usage (Conceptual for a framework like Slim/Laravel) ---
/*
// In your application bootstrap or service provider:
$redis = new \Redis();
$redis->connect('127.0.0.1', 6379);

$rateLimiter = new RateLimitingMiddleware($redis, 100, 60); // 100 requests per minute

// For a PSR-15 compliant middleware stack (e.g., using laminas/stratigility):
// $app->pipe($rateLimiter);

// For a framework like Laravel, you would typically integrate this via a custom middleware
// and define routes that use it.

// Example of a simulated request (no actual web server, just for logic testing):
/*
class MockRequest implements Request { /* ... * /}
class MockHandler implements RequestHandler { /* ... * /}

$mockRedis = new \Redis();
$mockRedis->connect('127.0.0.1', 6379);
$mockRedis->del('rate_limit:127.0.0.1'); // Clear for test

$middleware = new RateLimitingMiddleware($mockRedis, 3, 60);
$mockRequest = (new \Laminas\Diactoros\ServerRequest()) // Example using Laminas Diactoros
    ->withServerParams(['REMOTE_ADDR' => '127.0.0.1']);

$mockHandler = new class implements RequestHandler {
    public function handle(Request $request): Response {
        return new JsonResponse(['message' => 'Success'], 200);
    }
};

for ($i = 0; $i < 5; $i++) {
    $response = $middleware->process($mockRequest, $mockHandler);
    echo "Status: " . $response->getStatusCode() . "\n";
    echo "Remaining: " . $response->getHeaderLine('X-RateLimit-Remaining') . "\n";
}

*/

<?php

declare(strict_types=1);

namespace App\Security;

// Assuming a simple Key-Value store or database access layer for API keys.
// In a real application, this would interact with your ORM or a dedicated repository.

final class ApiKeyRepository
{
    // In a real application, this would be a database table or persistent store.
    // Storing hashes, not plain keys.
    private array $apiKeyStore = [
        'valid_key_hash_1' => ['id' => 1, 'active' => true, 'clientId' => 'clientA'],
        'valid_key_hash_2' => ['id' => 2, 'active' => true, 'clientId' => 'clientB'],
        'revoked_key_hash_3' => ['id' => 3, 'active' => false, 'clientId' => 'clientC'],
    ];

    /**
     * Finds an API key record by its hashed value.
     * In production, this would query a database.
     *
     * @param string $hashedKey The hashed API key to search for.
     * @return array|null The API key record if found and active, null otherwise.
     */
    public function findActiveKeyByHash(string $hashedKey): ?array
    {
        $record = $this->apiKeyStore[$hashedKey] ?? null;
        if ($record && $record['active']) {
            return $record;
        }
        return null;
    }

    /**
     * Revokes an API key by marking it as inactive.
     * In production, this would update a database record.
     *
     * @param string $hashedKey The hashed API key to revoke.
     * @return bool True if revocation was successful, false otherwise.
     */
    public function revokeKey(string $hashedKey): bool
    {
        if (isset($this->apiKeyStore[$hashedKey])) {
            $this->apiKeyStore[$hashedKey]['active'] = false;
            // In a real system, you'd persist this change.
            return true;
        }
        return false;
    }

    /**
     * Creates a new API key record.
     * In production, this would insert into a database.
     *
     * @param string $hashedKey The hashed new API key.
     * @param string $clientId The client ID associated with the key.
     * @return array The new API key record.
     */
    public function createKey(string $hashedKey, string $clientId): array
    {
        $newId = count($this->apiKeyStore) + 1;
        $record = [
            'id' => $newId,
            'active' => true,
            'clientId' => $clientId,
            'createdAt' => (new \DateTimeImmutable())->format('Y-m-d H:i:s')
        ];
        $this->apiKeyStore[$hashedKey] = $record;
        return $record;
    }

    /**
     * Rotates an API key: deactivates the old one and generates a new one.
     * This is a simplified example. A full rotation would involve client communication.
     *
     * @param string $oldHashedKey The hash of the key to be rotated.
     * @param string $clientId The client ID associated with the key.
     * @return string|null The raw new API key if successful, null otherwise.
     */
    public function rotateKey(string $oldHashedKey, string $clientId): ?string
    {
        if (!$this->findActiveKeyByHash($oldHashedKey)) {
            return null; // Old key not found or not active
        }

        $this->revokeKey($oldHashedKey); // Deactivate old key

        try {
            $newRawKey = ApiKeyGenerator::generate('rot_');
            $newHashedKey = ApiKeyGenerator::hashApiKey($newRawKey);
            $this->createKey($newHashedKey, $clientId);
            return $newRawKey; // Return raw key for client to use
        } catch (\Exception $e) {
            // Log error, handle exception
            error_log("Error during key rotation: " . $e->getMessage());
            return null;
        }
    }
}

// --- Example Usage ---
// $repository = new ApiKeyRepository();

// // Simulate checking a valid key
// $clientProvidedKey = 'valid_key_for_clientA'; // Imagine this is from client
// $hashedClientProvidedKey = ApiKeyGenerator::hashApiKey($clientProvidedKey); // Hash for lookup
// // This is simplified. In real life, ApiKeyGenerator::verifyApiKey would be used
// // to check the client's raw key against a stored hash from the database.
// // Let's use our predefined hashes for demo:
// $storedKeyHash = 'valid_key_hash_1'; // Assume this is retrieved from DB for clientA

// if (ApiKeyGenerator::verifyApiKey($clientProvidedKey, ApiKeyGenerator::hashApiKey($clientProvidedKey))) {
//     $keyRecord = $repository->findActiveKeyByHash(ApiKeyGenerator::hashApiKey($clientProvidedKey));
//     if ($keyRecord) {
//         echo "Client A key is valid and active.\n";
//     } else {
//         echo "Client A key invalid or inactive.\n";
//     }
// } else {
//     echo "Client A provided an incorrect key.\n";
// }

// // Simulate revocation
// $keyToRevoke = 'valid_key_hash_2'; // Hashed key for clientB
// if ($repository->revokeKey($keyToRevoke)) {
//     echo "Key " . $keyToRevoke . " revoked successfully.\n";
// }
// $revokedCheck = $repository->findActiveKeyByHash($keyToRevoke);
// if (!$revokedCheck) {
//     echo "Revoked key is correctly inactive.\n";
// }

// // Simulate rotation (requires a raw key for the old one for demo)
// $oldKeyForRotation = 'some_old_key_value'; // This is the raw key client used
// $oldHashedKeyForRotation = ApiKeyGenerator::hashApiKey($oldKeyForRotation);
// // To make this example runnable, we need to create an active key first.
// $repository->createKey($oldHashedKeyForRotation, 'clientD');

// $newKey = $repository->rotateKey($oldHashedKeyForRotation, 'clientD');
// if ($newKey) {
//     echo "Key rotated. New raw key for Client D: " . $newKey . "\n";
//     $oldKeyStatus = $repository->findActiveKeyByHash($oldHashedKeyForRotation);
//     echo "Old key active after rotation? " . ($oldKeyStatus ? 'Yes' : 'No') . "\n";
// } else {
//     echo "Key rotation failed.\n";
// }