<?php
/**
 * CommerceBird Security Configuration
 *
 * @package CommerceBird\Admin\Security
 */

namespace CommerceBird\Admin\Security;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class SecurityConfig {

	/**
	 * Rate limiting configuration.
	 */
	const RATE_LIMIT_REQUESTS_PER_MINUTE = 60;
	const RATE_LIMIT_REQUESTS_PER_HOUR   = 300;

	/**
	 * Session and nonce configuration.
	 */
	const NONCE_LIFETIME  = 43200; // 12 hours.
	const SESSION_TIMEOUT = 1800; // 30 minutes.

	/**
	 * Security headers configuration.
	 */
	const SECURITY_HEADERS = array(
		'X-Content-Type-Options' => 'nosniff',
		'X-Frame-Options'        => 'SAMEORIGIN',
		'X-XSS-Protection'       => '1; mode=block',
		'Referrer-Policy'        => 'strict-origin-when-cross-origin',
	);

	/**
	 * Allowed capabilities for different actions.
	 */
	const REQUIRED_CAPABILITIES = array(
		'subscription_get' => 'manage_woocommerce',
		'settings_get'     => 'manage_woocommerce',
		'settings_set'     => 'manage_woocommerce',
		'settings_reset'   => 'manage_woocommerce',
	);

	/**
	 * Input validation patterns.
	 */
	const VALIDATION_PATTERNS = array(
		'token'           => '/^[a-zA-Z0-9_-]{10,}$/',
		'subscription_id' => '/^\d+$/',
		'email'           => '/^[^\s@]+@[^\s@]+\.[^\s@]+$/',
	);

	/**
	 * Data encryption settings.
	 */
	const ENCRYPTION_METHOD = 'AES-256-CBC';
	const HASH_ALGORITHM    = 'sha256';

	/**
	 * Security logging configuration.
	 */
	const LOG_SECURITY_EVENTS = true;
	const LOG_RETENTION_DAYS  = 30;
	const LOG_MAX_ENTRIES     = 1000;

	/**
	 * Get security headers for AJAX responses.
	 *
	 * @return array Security headers.
	 */
	public static function get_security_headers(): array {
		return self::SECURITY_HEADERS;
	}

	/**
	 * Check if action requires specific capability.
	 *
	 * @param string $action Action name.
	 * @return string|false Required capability or false if none.
	 */
	public static function get_required_capability( string $action ) {
		return self::REQUIRED_CAPABILITIES[ $action ] ?? false;
	}

	/**
	 * Get validation pattern for field type.
	 *
	 * @param string $field_type Field type.
	 * @return string|false Validation pattern or false if none.
	 */
	public static function get_validation_pattern( string $field_type ) {
		return self::VALIDATION_PATTERNS[ $field_type ] ?? false;
	}

	/**
	 * Generate secure random token.
	 *
	 * @param int $length Token length.
	 * @return string Generated token.
	 */
	public static function generate_secure_token( int $length = 32 ): string {
		return bin2hex( random_bytes( $length / 2 ) );
	}

	/**
	 * Hash sensitive data.
	 *
	 * @param string $data Data to hash.
	 * @param string $salt Salt for hashing.
	 * @return string Hashed data.
	 */
	public static function hash_data( string $data, string $salt = '' ): string {
		return hash( self::HASH_ALGORITHM, $data . $salt );
	}

	/**
	 * Encrypt sensitive data for storage.
	 *
	 * @param string $data Data to encrypt.
	 * @param string $key Encryption key.
	 * @return string Encrypted data.
	 */
	public static function encrypt_data( string $data, string $key ): string {
		$iv        = openssl_random_pseudo_bytes( openssl_cipher_iv_length( self::ENCRYPTION_METHOD ) );
		$encrypted = openssl_encrypt( $data, self::ENCRYPTION_METHOD, $key, 0, $iv );
		return base64_encode( $encrypted . '::' . $iv );
	}

	/**
	 * Decrypt sensitive data.
	 *
	 * @param string $data Encrypted data.
	 * @param string $key Encryption key.
	 * @return string|false Decrypted data or false on failure.
	 */
	public static function decrypt_data( string $data, string $key ) {
		$data  = base64_decode( $data );
		$parts = explode( '::', $data, 2 );

		if ( count( $parts ) !== 2 ) {
			return false;
		}

		return openssl_decrypt( $parts[0], self::ENCRYPTION_METHOD, $key, 0, $parts[1] );
	}
}
