<?php

/**
 * This program is copyrighted by Franz Geffke (Softmax Co., Ltd.)
 */

namespace ones\oidc;

include_once "lib/flow.php";
include_once "lib/device.php";
include_once "lib/openid.php";
include_once "lib/device_jwt.php";


class OnesOidc
{
    // Get device properties
    // - client_id
    // - private_key
    public function get_device_properties(
        $deviceConfigPath,
        $devicePrivateKeyPath
    ) {
        return get_device_properties(
            $deviceConfigPath,
            $devicePrivateKeyPath
        );
    }

    // Get OpenID configuration
    // - provider_metadata
    public function get_openid_info(
        $host
    ) {
        return get_openid_info($host);
    }

    /**
     * User CIBA authentication flow
     * - Loops check_ciba_status_loop until success
     * 
     * @return array(
     *   'access_token' => string,
     *   'access_token_content' => array(
     *      'idp_role' => string,
     *      'username' => string,
     *      'matrix_id' => string,
     *      'jti' => string,
     *      'sub' => string,
     *      'iat' => int,
     *      'exp' => int,
     *      'client_id' => string,
     *      'iss' => string,
     *      'aud' => string
     *   ),
     *   'id_token' => string,
     *   'id_token_content' => array(
     *      'sub' => string,
     *      'domain' => string,
     *      'username' => string,
     *      'usernameWithoutDomain' => string,
     *      'title' => string,
     *      'name' => string,
     *      'firstName' => string,
     *      'lastName' => string,
     *      'localizedFirstName' => string,
     *      'localizedLastName' => string,
     *      'at_hash' => string,
     *      'urn:openid:params:jwt:claim:auth_req_id' => string,
     *      'aud' => string,
     *      'exp' => int,
     *      'iat' => int,
     *      'iss' => string
     *   ),
     *   'refresh_token' => string,
     *   'expires_in' => int,
     *   'scope' => string
     * )
     */
    public function user_ciba_auth(
        string $loginHint,
        string $clientId,
        string $privateKey,
        array $providerMetadata,
        array $providerJwks,
        string $resourceUri,
        string $bindingMessage = 'Please authorize this request',
        string $scope = 'openid profile'
    ) {
        return user_ciba_auth(
            $loginHint,
            $clientId,
            $privateKey,
            $providerMetadata,
            $providerJwks,
            $resourceUri,
            $bindingMessage,
            $scope
        );
    }

    /**
     * User consent flow
     * 
     * @param string $userId The user ID
     * @param string $clientId The client ID
     * @param string $privateKey The private key
     * @param array $providerMetadata The provider metadata
     * @param string $resourceUri The resource URI
     * @param string $host The host URL
     * @param array $consentSettings The consent settings
     * @param string $consentReason Reason for requesting consent
     */
    public function user_consent_flow(
        string $userId,
        string $clientId,
        string $privateKey,
        array $providerMetadata,
        string $resourceUri,
        string $host,
        array $consentSettings,
        string $consentReason
    ) {
        return user_consent_flow(
            $userId,
            $clientId,
            $privateKey,
            $providerMetadata,
            $resourceUri,
            $host,
            // request fields
            // 'ones_auth_consent_content_first_name' => 'firstName',
            // 'ones_auth_consent_content_last_name' => 'lastName',
            // 'ones_auth_consent_content_localized_first_name' => 'localizedFirstName',
            // 'ones_auth_consent_content_localized_last_name' => 'localizedLastName',
            // 'ones_auth_consent_content_identity_document_number' => 'identityDocumentNumber',
            // 'ones_auth_consent_content_identity_document_issue_date' => 'identityDocumentIssueDate',
            // 'ones_auth_consent_content_identity_document_expiry_date' => 'identityDocumentExpiryDate',
            // 'ones_auth_consent_content_date_of_birth' => 'dateOfBirth',
            // 'ones_auth_consent_content_email' => 'email',
            // 'ones_auth_consent_content_phone_number' => 'phoneNumber',
            $consentSettings,
            // request reason
            $consentReason
        );
    }

    /**
     * User CIBA authentication and consent flow
     * 1. user_ciba_auth
     * 2. user_consent_flow
     */
    public function user_ciba_auth_and_consent(
        string $loginHint,
        string $clientId,
        string $privateKey,
        array $providerMetadata,
        array $providerJwks,
        string $resourceUri,
        string $host,
        array $consentSettings,
        string $consentReason
    ) {
        return user_ciba_auth_and_consent(
            $loginHint,
            $clientId,
            $privateKey,
            $providerMetadata,
            $providerJwks,
            $resourceUri,
            $host,
            $consentSettings,
            $consentReason
        );
    }

    /**
     * Make QR auth session
     * 
     * @param string $host The host URL
     * @param string $clientId The client ID
     * @param string $privateKey The private key
     * @param array $providerMetadata The provider metadata
     * 
     * @return array(
     *  'kind' => string,
     *  'sessionId' => string,
     *  'cbUrl' => string,
     *  'expIn' => int,
     *  'exp' => int,
     *  'interval' => int,
     *  'aud' => string,
     *  'authRequestId' => string,
     *  'cibaRequestInvoked' => bool,
     * )
     */
    public function make_qr_auth_session(
        string $host,
        string $clientId,
        string $privateKey,
        array $providerMetadata,
    ) {
        return make_qr_auth_session(
            $host,
            $clientId,
            $privateKey,
            $providerMetadata
        );
    }

    /**
     * Poll QR auth session and start CIBA flow if ready
     * 
     * @return array(
     *  'kind' => string,
     *  'sessionId' => string,
     *  'cbUrl' => string,
     *  'expIn' => int,
     *  'exp' => int,
     *  'interval' => int,
     *  'aud' => string,
     *  'authRequestId' => string,
     *  'cibaRequestInvoked' => bool,
     *  'loginHintToken' => string
     * )
     */
    public function poll_qr_auth_session(
        string $sessionId,
        string $clientId,
        string $privateKey,
        array $providerMetadata,
        string $resourceUri,
        string $host,
        string $bindingMessage = 'Please authorize this request',
        string $scope = 'openid profile'
    ) {
        return poll_qr_auth_session(
            $sessionId,
            $clientId,
            $privateKey,
            $providerMetadata,
            $resourceUri,
            $host,
            $bindingMessage,
            $scope
        );
    }

    /**
     * User CIBA status loop
     * - Pass the result of poll_qr_auth_session
     * 
     * @return array(
     *   'access_token' => string,
     *   'access_token_content' => array(
     *      'idp_role' => string,
     *      'username' => string,
     *      'matrix_id' => string,
     *      'jti' => string,
     *      'sub' => string,
     *      'iat' => int,
     *      'exp' => int,
     *      'client_id' => string,
     *      'iss' => string,
     *      'aud' => string
     *   ),
     *   'id_token' => string,
     *   'id_token_content' => array(
     *      'sub' => string,
     *      'domain' => string,
     *      'username' => string,
     *      'usernameWithoutDomain' => string,
     *      'title' => string,
     *      'name' => string,
     *      'firstName' => string,
     *      'lastName' => string,
     *      'localizedFirstName' => string,
     *      'localizedLastName' => string,
     *      'at_hash' => string,
     *      'urn:openid:params:jwt:claim:auth_req_id' => string,
     *      'aud' => string,
     *      'exp' => int,
     *      'iat' => int,
     *      'iss' => string
     *   ),
     *   'refresh_token' => string,
     *   'expires_in' => int,
     *   'scope' => string
     * )
     */
    public function check_ciba_status_loop(
        array $providerMetadata,
        array $providerJwks,
        string $quthRequestId,
        string $clientId,
        string $privateKey
    ) {
        return check_ciba_status_loop(
            $providerMetadata,
            $providerJwks,
            $quthRequestId,
            $clientId,
            $privateKey
        );
    }
}

?>