<?php

namespace Drupal\user_provisioning\Helpers;

use Drupal\Core\Render\Markup;
use Drupal\user_provisioning\moUserProvisioningConstants;

/**
 * Helper for user-specific provisioning tab data.
 */
class moProviderSpecificProvisioning {
  /**
   * Module image assets URL path.
   *
   * @var string
   */
  private string $urlPath;
  /**
   * Base URL of the Drupal site.
   *
   * @var string
   */
  private string $baseUrl;

  /**
   * Constructor for the Provider Specific Provisioning tab.
   */
  public function __construct() {
    $base_url = \Drupal::request()->getSchemeAndHttpHost() . \Drupal::request()->getBaseUrl();
    $this->baseUrl = $base_url;
    $this->urlPath = $base_url . '/' . \Drupal::service('extension.list.module')->getPath('user_provisioning') . '/images';
  }

  /**
   * Returns providers for provider-specific provisioning.
   *
   * @return array
   *   Provider cards for rendering.
   */
  public function providerList(): array {
    $tab_url = $this->baseUrl . moUserProvisioningConstants::USER_PROVISIONING . '?tab_name=provider_specific_provisioning';
    return [
      Markup::create('<a href="' . $tab_url . '&app_name=Azure AD B2C"><img class="mo_user_provisioning_under_disabled mo_user_provisioning_img_logo" alt="Azure AD B2C" src="' . $this->urlPath . '/azure.png"><br><strong>Azure AD B2C</strong>  </a>'),
      Markup::create('<a href="' . $tab_url . '&app_name=AWS Cognito"><img class="mo_user_provisioning_under_disabled mo_user_provisioning_img_logo" alt="AWS Cognito" src="' . $this->urlPath . '/cognito.png"><br><strong>AWS Cognito</strong>  </a>'),
      Markup::create('<a href="' . $tab_url . '&app_name=miniorange"><img class="mo_user_provisioning_under_disabled mo_user_provisioning_img_logo" alt="miniorange" src="' . $this->urlPath . '/miniorange.png" ><br><strong>Miniorange</strong>  </a>'),
      Markup::create('<a href="' . $tab_url . '&app_name=Salesforce"><img class="mo_user_provisioning_under_disabled mo_user_provisioning_img_logo" alt="Salesforce" src="' . $this->urlPath . '/salesforce.png" ><br><strong>Salesforce</strong>  </a>'),
      Markup::create('<a href="' . $tab_url . '&app_name=Okta"><img class="mo_user_provisioning_under_disabled mo_user_provisioning_img_logo" alt="Okta" src="' . $this->urlPath . '/okta.png" ><br><strong>Okta</strong>  </a>'),
    ];

  }

  /**
   * Encrypts provider-specific data.
   *
   * @param string $data
   *   The plain-text data to encrypt.
   * @param string $key
   *   The encryption key.
   *
   * @return string
   *   The encrypted value encoded in base64.
   */
  public function encrypt_data(string $data, string $key): string {
    $method = 'AES-256-CBC';

    // Generate a proper 32-byte key.
    $key = hash('sha256', $key, TRUE);

    $ivLength = openssl_cipher_iv_length($method);
    $iv = random_bytes($ivLength);

    $encrypted = openssl_encrypt($data, $method, $key, OPENSSL_RAW_DATA, $iv);

    if ($encrypted === FALSE) {
      \Drupal::logger('user_provisioning')->error('Encryption failed');
      return '';
    }

    return base64_encode($iv . $encrypted);
  }

  /**
   * Decrypts provider-specific data.
   *
   * @param string $data
   *   The encrypted value encoded in base64.
   * @param string $key
   *   The encryption key.
   *
   * @return bool|string
   *   Decrypted value on success, or FALSE on failure.
   */
  public function decrypt_data(string $data, string $key): string|false {
    $method = 'AES-256-CBC';

    $key = hash('sha256', $key, TRUE);
    $decoded = base64_decode($data, TRUE);

    if ($decoded === FALSE) {
      return FALSE;
    }

    $ivLength = openssl_cipher_iv_length($method);
    $iv = substr($decoded, 0, $ivLength);
    $ciphertext = substr($decoded, $ivLength);

    return openssl_decrypt($ciphertext, $method, $key, OPENSSL_RAW_DATA, $iv);
  }

}
