<?php
define('TICKET_LIFETIME_SECONDS', 20 * 60);
define('EMAIL_VERIFICATION_LIFETIME_SECONDS', 60 * 60 * 24 * 3);
// A Paddle checkout can sit open well past the default 20-minute ticket lifetime before
// the buyer completes payment, so the ticket that maps the resulting webhook back to a
// user needs a much longer window than a login-flow ticket. The ticket only carries an
// identity claim — actually crediting an account still requires a validly signed Paddle
// webhook for a real transaction — so a long lifetime here doesn't weaken anything.
define('PURCHASE_TICKET_LIFETIME_SECONDS', 60 * 60 * 24);

function getTicketSecret(): string
{
    $secret = getenv('TICKET_SECRET');
    if ($secret === false || $secret === '') {
        error_log('ticket.php: TICKET_SECRET is not configured');
        throw new RuntimeException('Server misconfiguration');
    }

    return $secret;
}

function createTicket(int $userId, string $purpose = 'default', ?int $lifetimeSeconds = null): string
{
    $expiresAt = time() + ($lifetimeSeconds ?? TICKET_LIFETIME_SECONDS);
    $payload = $userId . '|' . $expiresAt . '|' . $purpose;
    $signature = hash_hmac('sha256', $payload, getTicketSecret());

    return base64_encode($payload . '.' . $signature);
}

function decodeTicket(string $ticket, string $purpose = 'default'): ?int
{
    $decoded = base64_decode($ticket, true);
    if ($decoded === false) {
        return null;
    }

    $separatorPosition = strrpos($decoded, '.');
    if ($separatorPosition === false) {
        return null;
    }

    $payload = substr($decoded, 0, $separatorPosition);
    $signature = substr($decoded, $separatorPosition + 1);

    $expectedSignature = hash_hmac('sha256', $payload, getTicketSecret());
    if (!hash_equals($expectedSignature, $signature)) {
        return null;
    }

    $parts = explode('|', $payload, 3);
    if (count($parts) !== 3 || !ctype_digit($parts[0]) || !ctype_digit($parts[1])) {
        return null;
    }

    [$userId, $expiresAt, $ticketPurpose] = $parts;

    if (!hash_equals($purpose, $ticketPurpose)) {
        return null;
    }

    if ((int) $expiresAt < time()) {
        return null;
    }

    return (int) $userId;
}

function ensurePasswordResetTicketsTable(PDO $pdo): void
{
    $pdo->exec('CREATE TABLE IF NOT EXISTS password_reset_tickets (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        token_hash TEXT NOT NULL UNIQUE,
        user_id INTEGER NOT NULL REFERENCES users(id),
        expires_at INTEGER NOT NULL,
        used_at TEXT,
        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
    )');
}

function createPasswordResetTicket(PDO $pdo, int $userId): string
{
    ensurePasswordResetTicketsTable($pdo);

    // Opportunistic cleanup: every new ticket also sweeps out rows that are long past
    // useful (expired for over a day), so this table doesn't grow unbounded without
    // needing a separate cron job.
    $pdo->prepare('DELETE FROM password_reset_tickets WHERE expires_at < :cutoff')
        ->execute(['cutoff' => time() - 86400]);

    $token = createTicket($userId, 'password_reset');

    $stmt = $pdo->prepare('INSERT INTO password_reset_tickets (token_hash, user_id, expires_at) VALUES (:token_hash, :user_id, :expires_at)');
    $stmt->execute([
        'token_hash' => hash('sha256', $token),
        'user_id' => $userId,
        'expires_at' => time() + TICKET_LIFETIME_SECONDS,
    ]);

    return $token;
}

// Validates signature/purpose/expiry only. Safe to call on GET to decide page
// state, since it never marks the ticket used.
function isPasswordResetTicketWellFormed(string $token): bool
{
    return decodeTicket($token, 'password_reset') !== null;
}

// Atomically claims the ticket: only the first caller to reach this for a given
// token gets a user id back, so a leaked or replayed reset link can reset the
// password at most once.
function consumePasswordResetTicket(PDO $pdo, string $token): ?int
{
    $userId = decodeTicket($token, 'password_reset');
    if ($userId === null) {
        return null;
    }

    ensurePasswordResetTicketsTable($pdo);

    $stmt = $pdo->prepare('UPDATE password_reset_tickets SET used_at = CURRENT_TIMESTAMP WHERE token_hash = :token_hash AND user_id = :user_id AND used_at IS NULL AND expires_at > :now');
    $stmt->execute([
        'token_hash' => hash('sha256', $token),
        'user_id' => $userId,
        'now' => time(),
    ]);

    return $stmt->rowCount() === 1 ? $userId : null;
}