<?php
/**
 * HappyFenceNG Total Enterprise Security Plugin
 * HAPPYWPRESS is a RazorVue Trademark.
 *
 * @package     HappyFenceNG
 * @developer   Simonluca Scillitani
 * @copyright   2025 RazorVue di Scillitani Simonluca
 * @link        https://razorvue.it
 * @author      RazorVue di Scillitani Simonluca
 * @brand       HappyWPress
 * @uri         https://happywpress.com
 * @set all
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**PHPCS -> code compliance: we put useful comments where needed.. */
class HappyFence2KeyManager extends HappyFenceNGSystem {

	/**PHPCS -> code compliance: we put useful comments where needed..
	 *
	 * @var string $key ..
	 * */
	private string $key;

	/**PHPCS -> code compliance: we put useful comments where needed.. */
	private function initialize_key(): void {
		$provider = defined( 'HAPPYFENCENG_KEY_PROVIDER' ) ? HAPPYFENCENG_KEY_PROVIDER : 'default';

		switch ( $provider ) {
			case 'vault':
				$this->key = $this->get_key_from_vault();
				break;
			case 'env':
				$this->key = $this->get_key_from_env();
				break;
			case 'default':
			default:
				$this->key = $this->get_key_from_wp();
				break;
		}

		$this->validate_fingerprint( $provider );
	}

	/**PHPCS -> code compliance: we put useful comments where needed.. */
	private function get_key_from_wp(): string {
		$key_material  = defined( 'HAPPYFENCENG_ENCRYPTION_KEY' ) ? HAPPYFENCENG_ENCRYPTION_KEY : AUTH_KEY;
		$salt_material = defined( 'HAPPYFENCENG_ENCRYPTION_SALT' ) ? HAPPYFENCENG_ENCRYPTION_SALT : SECURE_AUTH_SALT;
		return hash( 'sha256', $key_material . $salt_material );
	}

	/**PHPCS -> code compliance: we put useful comments where needed.. */
	private function get_key_from_env(): string {
		$key  = sanitize_text_field( wp_unslash( $_ENV['HAPPYFENCENG_ENCRYPTION_KEY'] ?? HappyFenceNGPlaceholder::EMPTY_STRING ) );
		$salt = sanitize_text_field( wp_unslash( $_ENV['HAPPYFENCENG_ENCRYPTION_SALT'] ?? HappyFenceNGPlaceholder::EMPTY_STRING ) );
		if ( ! $key || ! $salt ) {
			self::raiseException( __( 'HappyFence: encryption environment variables not found.', 'happyfenceng-total-enterprise-security' ) );
		}
		return hash( 'sha256', $key . $salt );
	}

	/**PHPCS -> code compliance: we put useful comments where needed.. */
	private function get_key_from_vault(): string {
		self::raiseException( __( 'HappyFence: "vault" provider is not yet implemented.', 'happyfenceng-total-enterprise-security' ) );
	}

	/**PHPCS -> code compliance: we put useful comments where needed..
	 *
	 * @param string $provider ..
	 */
	private function validate_fingerprint( string $provider ): void {
		$current_fingerprint = hash( 'sha256', $provider );
		$stored_fingerprint  = get_option( 'happyfenceng_encryption_fingerprint' );

		if ( $stored_fingerprint && HappyFenceNGPROC::not_equals( $stored_fingerprint, $current_fingerprint ) ) {
			self::raiseException( __( 'HappyFence: CRITICAL ERROR – encryption key mismatch detected. Plugin halted for your safety. FIREWALL DOWN!!!!', 'happyfenceng-total-enterprise-security' ) );

		}

		if ( ! $stored_fingerprint ) {
			update_option( 'happyfenceng_encryption_fingerprint', $current_fingerprint );
		}
	}

	/**PHPCS -> code compliance: we put useful comments where needed.. */
	public function get_key(): string {
		$this::initialize_key();
		return $this->key;
	}
}
