<?php

declare(strict_types=1);

namespace App\Services\Pireon;

use Illuminate\Contracts\Session\Session;

/**
 * Keeps the signed-in panel user's token set in the session and transparently
 * refreshes it when it ages out.
 *
 * Tokens live in the session rather than the database on purpose: they are
 * per-session credentials, and logging out or the session expiring should take
 * them with it.
 */
class TokenStore
{
    protected const KEY = 'pireon.token';

    /** Which client issued it: a refresh token only works with that one. */
    protected const ISSUER = 'pireon.token_issuer';

    public function __construct(
        protected Session $session,
        protected PireonClient $client,
    ) {}

    /**
     * @param  bool|null  $viaRedirect  Whether the redirect flow's client
     *                                  issued it; null keeps what was said.
     */
    public function put(AccessToken $token, ?bool $viaRedirect = null): void
    {
        $this->session->put(self::KEY, $token->toArray());

        if ($viaRedirect !== null) {
            $this->session->put(self::ISSUER, $viaRedirect ? 'redirect' : 'password');
        }
    }

    public function get(): ?AccessToken
    {
        $state = $this->session->get(self::KEY);

        return is_array($state) ? AccessToken::fromArray($state) : null;
    }

    public function forget(): void
    {
        $this->session->forget([self::KEY, self::ISSUER]);
    }

    /**
     * The current access token, refreshed first if it has expired.
     *
     * Returns null when there is no token, or when the refresh failed — the
     * caller should treat that as "this session is no longer authenticated"
     * and send the user back through the login flow.
     */
    public function accessToken(): ?string
    {
        $token = $this->get();

        if ($token === null) {
            return null;
        }

        if (! $token->hasExpired()) {
            return $token->accessToken;
        }

        if (! $token->isRefreshable()) {
            $this->forget();

            return null;
        }

        try {
            $issuer = $this->session->get(self::ISSUER) === 'redirect'
                ? PireonClient::forRedirect()
                : $this->client;
            $refreshed = $issuer->refresh($token->refreshToken);
        } catch (PireonException) {
            // The refresh token was revoked or expired upstream.
            $this->forget();

            return null;
        }

        $this->put($refreshed);

        return $refreshed->accessToken;
    }
}