<?php

namespace WPMailSMTP\Vendor\Aws\Token;

use WPMailSMTP\Vendor\Aws\Exception\TokenException;
use WPMailSMTP\Vendor\GuzzleHttp\Promise;
/**
 * Token that comes from the SSO provider
 */
class SsoTokenProvider implements \WPMailSMTP\Vendor\Aws\Token\RefreshableTokenProviderInterface
{
    use ParsesIniTrait;
    const ENV_PROFILE = 'AWS_PROFILE';
    private $ssoProfileName;
    private $filename;
    private $ssoOidcClient;
    /**
     * Constructs a new SsoTokenProvider object, which will fetch a token from an authenticated SSO profile
     * @param string $ssoProfileName The name of the profile that contains the sso_session key
     * @param int    $filename Name of the config file to sso profile from
     */
    public function __construct($ssoProfileName, $filename = null, $ssoOidcClient = null)
    {
        $profileName = \getenv(self::ENV_PROFILE) ?: 'default';
        $this->ssoProfileName = !empty($ssoProfileName) ? $ssoProfileName : $profileName;
        $this->filename = !empty($filename) ? $filename : self::getHomeDir() . '/.aws/config';
        $this->ssoOidcClient = $ssoOidcClient;
    }
    /*
     * Loads cached sso credentials
     *
     * @return PromiseInterface
     */
    public function __invoke()
    {
        return \WPMailSMTP\Vendor\GuzzleHttp\Promise\Coroutine::of(function () {
            if (!@\is_readable($this->filename)) {
                throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Cannot read profiles from {$this->filename}");
            }
            $profiles = self::loadProfiles($this->filename);
            if (!isset($profiles[$this->ssoProfileName])) {
                throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Profile {$this->ssoProfileName} does not exist in {$this->filename}.");
            }
            $ssoProfile = $profiles[$this->ssoProfileName];
            if (empty($ssoProfile['sso_session'])) {
                throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Profile {$this->ssoProfileName} in {$this->filename} must contain an sso_session.");
            }
            $sessionProfileName = 'sso-session ' . $ssoProfile['sso_session'];
            if (empty($profiles[$sessionProfileName])) {
                throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Profile {$this->ssoProfileName} does not exist in {$this->filename}");
            }
            $sessionProfileData = $profiles[$sessionProfileName];
            if (empty($sessionProfileData['sso_start_url']) || empty($sessionProfileData['sso_region'])) {
                throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Profile {$this->ssoProfileName} in {$this->filename} must contain the following keys: " . "sso_start_url and sso_region.");
            }
            $tokenLocation = self::getTokenLocation($ssoProfile['sso_session']);
            if (!@\is_readable($tokenLocation)) {
                throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Unable to read token file at {$tokenLocation}");
            }
            $tokenData = $this->getTokenData($tokenLocation);
            $this->validateTokenData($tokenLocation, $tokenData);
            (yield new \WPMailSMTP\Vendor\Aws\Token\SsoToken($tokenData['accessToken'], $tokenData['expiresAt'], isset($tokenData['refreshToken']) ? $tokenData['refreshToken'] : null, isset($tokenData['clientId']) ? $tokenData['clientId'] : null, isset($tokenData['clientSecret']) ? $tokenData['clientSecret'] : null, isset($tokenData['registrationExpiresAt']) ? $tokenData['registrationExpiresAt'] : null, isset($tokenData['region']) ? $tokenData['region'] : null, isset($tokenData['startUrl']) ? $tokenData['startUrl'] : null));
        });
    }
    /**
     * Refreshes the token
     * @return mixed|null
     */
    public function refresh()
    {
        try {
            //try to reload from disk
            $token = $this();
            if ($token instanceof \WPMailSMTP\Vendor\Aws\Token\SsoToken && !$token->shouldAttemptRefresh()) {
                return $token;
            }
        } finally {
            //if reload from disk fails, try refreshing
            $tokenLocation = self::getTokenLocation($this->ssoProfileName);
            $tokenData = $this->getTokenData($tokenLocation);
            if (empty($this->ssoOidcClient) || empty($tokenData['startUrl'])) {
                throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Cannot refresh this token without an 'ssooidcClient' " . "and a 'start_url'");
            }
            $response = $this->ssoOidcClient->createToken([
                'clientId' => $tokenData['clientId'],
                'clientSecret' => $tokenData['clientSecret'],
                'grantType' => 'refresh_token',
                // REQUIRED
                'refreshToken' => $tokenData['refreshToken'],
            ]);
            if ($response['@metadata']['statusCode'] == 200) {
                $tokenData['accessToken'] = $response['accessToken'];
                $tokenData['expiresAt'] = \time() + $response['expiresIn'];
                $tokenData['refreshToken'] = $response['refreshToken'];
                $token = new \WPMailSMTP\Vendor\Aws\Token\SsoToken($tokenData['accessToken'], $tokenData['expiresAt'], $tokenData['refreshToken'], isset($tokenData['clientId']) ? $tokenData['clientId'] : null, isset($tokenData['clientSecret']) ? $tokenData['clientSecret'] : null, isset($tokenData['registrationExpiresAt']) ? $tokenData['registrationExpiresAt'] : null, isset($tokenData['region']) ? $tokenData['region'] : null, isset($tokenData['startUrl']) ? $tokenData['startUrl'] : null);
                $this->writeNewTokenDataToDisk($tokenData, $tokenLocation);
                return $token;
            }
        }
    }
    public function shouldAttemptRefresh()
    {
        $tokenLocation = self::getTokenLocation($this->ssoProfileName);
        $tokenData = $this->getTokenData($tokenLocation);
        return \strtotime("-10 minutes") >= \strtotime($tokenData['expiresAt']);
    }
    /**
     * @param $sso_session
     * @return string
     */
    public static function getTokenLocation($sso_session)
    {
        return self::getHomeDir() . '/.aws/sso/cache/' . \mb_convert_encoding(\sha1($sso_session), "UTF-8") . ".json";
    }
    /**
     * @param $tokenLocation
     * @return array
     */
    function getTokenData($tokenLocation)
    {
        return \json_decode(\file_get_contents($tokenLocation), \true);
    }
    /**
     * @param $tokenData
     * @param $tokenLocation
     * @return mixed
     */
    private function validateTokenData($tokenLocation, $tokenData)
    {
        if (empty($tokenData['accessToken']) || empty($tokenData['expiresAt'])) {
            throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Token file at {$tokenLocation} must contain an access token and an expiration");
        }
        $expiration = \strtotime($tokenData['expiresAt']);
        if ($expiration === \false) {
            throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Cached SSO token returned an invalid expiration");
        } elseif ($expiration < \time()) {
            throw new \WPMailSMTP\Vendor\Aws\Exception\TokenException("Cached SSO token returned an expired token");
        }
        return $tokenData;
    }
    /**
     * @param array $tokenData
     * @param string $tokenLocation
     * @return void
     */
    private function writeNewTokenDataToDisk(array $tokenData, $tokenLocation)
    {
        $tokenData['expiresAt'] = \gmdate('Y-m-d\\TH:i:s\\Z', $tokenData['expiresAt']);
        \file_put_contents($tokenLocation, \json_encode(\array_filter($tokenData)));
    }
}
