<?php

/**
 * Entry viewer shortcode
 *
 * @package Caldera_Forms
 * @author    Josh Pollock <[email protected]>
 * @license   GPL-2.0+
 * @link
 * @copyright 2016 CalderaWP LLC
 */
class Caldera_Forms_API_Token {

	/**
	 * Create an API token
	 *
	 * Used as a possible way of authenticating for GET only. Don't use for POST.
	 *
	 * @since 1.5.0
	 *
	 * @param string $lowest_role The lowest user role -- IE editor -- that this token is valid for. Use "public" to make public.
	 * @param string $form_id Form ID to generate token for.
	 *
	 * @return string
	 */
	public static function make_token( $lowest_role, $form_id ){

		/**
		 * Filter secret portion of API token
		 *
		 * @since 1.5.0
		 *
		 * @param string $secret Secret thing to use
		 * @param string $form_id ID of form generating/checking token on
		 */
		$secret = apply_filters( 'caldera_forms_api_token_secret', get_option( 'caldera_forms_api_token_secret', NONCE_SALT . md5_file( __FILE__ ) ), $form_id  );
		return sha1( 'cf_viewer_' . $lowest_role . $secret  . $form_id );

	}

	/**
	 * Check a token
	 *
	 * @since 1.5.0
	 *
	 * @param string $token Token to check
	 * @param string $form_id Form ID to check based on.
	 * @param WP_User|null $user Optional. User to check for sufficient role of. Defaults to current user. If null and not logged in, only "public" is checked for.
	 *
	 * @return bool
	 */
	public static function check_token( $token, $form_id, WP_User $user = null ){
		if (  null == $user  ) {
			$user = get_user_by( 'ID', get_current_user_id() );
		}

		if( null == $user ){
			return self::verify_token( $token, 'public', $form_id );
		}

		foreach( array_merge( array_keys( caldera_forms_get_roles() ), array('public') ) as $role ){
			if( true == self::verify_token( $token, $role, $form_id ) ){
				return true;
			}
		}

		return false;

	}

	/**
	 * Check a token against a role
	 *
	 * @since 1.5.0
	 *
	 * @param string $check_token Token to check.
	 * @param string $role User role to check against.
	 * @param string $form_id ID of form this token is for.
	 *
	 * @return bool
	 */
	protected static function verify_token( $check_token, $role, $form_id ){
		return hash_equals( self::make_token( $role, $form_id ), $check_token );

	}

}