<?php

/**
 * Class TwoFactorAuthentication
 *
 * Handles two-factor authentication functionality using TOTP (Time-based One-Time Password).
 * Internal implementation without external dependencies.
 */
class TwoFactorAuthentication {
    private $db;
    private $secretLength = 32;
    private $period = 30; // Time step in seconds
    private $digits = 6;  // Number of digits in TOTP code
    private $algorithm = 'sha1';
    private $issuer = 'Jilo';

    /**
     * Constructor
     *
     * @param PDO $database Database connection
     */
    public function __construct($database) {
        if ($database instanceof PDO) {
            $this->db = $database;
        } else {
            $this->db = $database->getConnection();
        }
    }

    /**
     * Enable 2FA for a user
     *
     * @param int $userId User ID
     * @return array Array containing success status and data (secret, QR code URL)
     */
    public function enable($userId) {
        try {
            // Check if 2FA is already enabled
            $stmt = $this->db->prepare('SELECT enabled FROM user_2fa WHERE user_id = ?');
            $stmt->execute([$userId]);
            $existing = $stmt->fetch(PDO::FETCH_ASSOC);

            if ($existing && $existing['enabled']) {
                return ['success' => false, 'message' => '2FA is already enabled'];
            }

            // Generate secret key
            $secret = $this->generateSecret();

            // Get user's username for the QR code
            $stmt = $this->db->prepare('SELECT username FROM users WHERE id = ?');
            $stmt->execute([$userId]);
            $user = $stmt->fetch(PDO::FETCH_ASSOC);

            // Generate backup codes
            $backupCodes = $this->generateBackupCodes();

            // Store in database
            $this->db->beginTransaction();

            $stmt = $this->db->prepare('
                INSERT INTO user_2fa (user_id, secret_key, backup_codes, enabled, created_at)
                VALUES (?, ?, ?, 0, NOW())
                ON DUPLICATE KEY UPDATE
                    secret_key = VALUES(secret_key),
                    backup_codes = VALUES(backup_codes),
                    enabled = VALUES(enabled),
                    created_at = VALUES(created_at)
            ');

            $stmt->execute([
                $userId,
                $secret,
                json_encode($backupCodes)
            ]);

            $this->db->commit();

            // Generate otpauth URL for QR code
            $otpauthUrl = $this->generateOtpauthUrl($user['username'], $secret);

            return [
                'success' => true,
                'data' => [
                    'secret' => $secret,
                    'otpauthUrl' => $otpauthUrl,
                    'backupCodes' => $backupCodes
                ]
            ];

        } catch (Exception $e) {
            if ($this->db->inTransaction()) {
                $this->db->rollBack();
            }
            return ['success' => false, 'message' => $e->getMessage()];
        }
    }

    /**
     * Verify a 2FA code
     *
     * @param int $userId User ID
     * @param string $code The verification code
     * @return bool True if verified, false otherwise
     */
    public function verify($userId, $code) {
        try {
            // Get user's 2FA settings
            $stmt = $this->db->prepare('
                SELECT secret_key, backup_codes, enabled
                FROM user_2fa
                WHERE user_id = ?
            ');
            $stmt->execute([$userId]);
            $tfa = $stmt->fetch(PDO::FETCH_ASSOC);

            if (!$tfa || !$tfa['enabled']) {
                return false;
            }

            // Check if it's a backup code
            if ($this->verifyBackupCode($userId, $code)) {
                return true;
            }

            // Verify TOTP code
            $currentTime = time();

            // Check current and adjacent time steps
            for ($timeStep = -1; $timeStep <= 1; $timeStep++) {
                $checkTime = $currentTime + ($timeStep * $this->period);
                if ($this->generateCode($tfa['secret_key'], $checkTime) === $code) {
                    // Update last used timestamp
                    $stmt = $this->db->prepare('
                        UPDATE user_2fa
                        SET last_used = NOW()
                        WHERE user_id = ?
                    ');
                    $stmt->execute([$userId]);
                    return true;
                }
            }

            return false;

        } catch (Exception $e) {
            error_log('2FA verification error: ' . $e->getMessage());
            return false;
        }
    }

    /**
     * Generate a TOTP code for a given secret and time
     *
     * @param string $secret The secret key
     * @param int $time Current Unix timestamp
     * @return string Generated code
     */
    private function generateCode($secret, $time) {
        $timeStep = floor($time / $this->period);
        $timeHex = str_pad(dechex($timeStep), 16, '0', STR_PAD_LEFT);

        // Convert hex time to binary
        $timeBin = '';
        for ($i = 0; $i < strlen($timeHex); $i += 2) {
            $timeBin .= chr(hexdec(substr($timeHex, $i, 2)));
        }

        // Get binary secret
        $secretBin = $this->base32Decode($secret);

        // Calculate HMAC
        $hash = hash_hmac($this->algorithm, $timeBin, $secretBin, true);

        // Get offset
        $offset = ord($hash[strlen($hash) - 1]) & 0xF;

        // Generate 4-byte code
        $code = (
            ((ord($hash[$offset]) & 0x7F) << 24) |
            ((ord($hash[$offset + 1]) & 0xFF) << 16) |
            ((ord($hash[$offset + 2]) & 0xFF) << 8) |
            (ord($hash[$offset + 3]) & 0xFF)
        ) % pow(10, $this->digits);

        return str_pad($code, $this->digits, '0', STR_PAD_LEFT);
    }

    /**
     * Generate a random secret key
     *
     * @return string Base32 encoded secret
     */
    private function generateSecret() {
        $random = random_bytes($this->secretLength);
        return $this->base32Encode($random);
    }

    /**
     * Base32 encode data
     *
     * @param string $data Data to encode
     * @return string Base32 encoded string
     */
    private function base32Encode($data) {
        $alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
        $binary = '';
        $encoded = '';

        // Convert to binary
        for ($i = 0; $i < strlen($data); $i++) {
            $binary .= str_pad(decbin(ord($data[$i])), 8, '0', STR_PAD_LEFT);
        }

        // Process 5 bits at a time
        for ($i = 0; $i < strlen($binary); $i += 5) {
            $chunk = substr($binary . '0000', $i, 5);
            $encoded .= $alphabet[bindec($chunk)];
        }

        return $encoded;
    }

    /**
     * Base32 decode data
     *
     * @param string $data Base32 encoded string
     * @return string Decoded data
     */
    private function base32Decode($data) {
        $alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
        $binary = '';
        $decoded = '';

        // Convert to binary
        for ($i = 0; $i < strlen($data); $i++) {
            $position = strpos($alphabet, $data[$i]);
            if ($position === false) continue;
            $binary .= str_pad(decbin($position), 5, '0', STR_PAD_LEFT);
        }

        // Process 8 bits at a time
        for ($i = 0; $i + 7 < strlen($binary); $i += 8) {
            $chunk = substr($binary, $i, 8);
            $decoded .= chr(bindec($chunk));
        }

        return $decoded;
    }

    /**
     * Generate otpauth URL for QR codes
     *
     * @param string $username Username
     * @param string $secret Secret key
     * @return string otpauth URL
     */
    private function generateOtpauthUrl($username, $secret) {
        return sprintf(
            'otpauth://totp/%s:%s?secret=%s&issuer=%s&algorithm=%s&digits=%d&period=%d',
            urlencode($this->issuer),
            urlencode($username),
            $secret,
            urlencode($this->issuer),
            strtoupper($this->algorithm),
            $this->digits,
            $this->period
        );
    }

    /**
     * Generate backup codes
     *
     * @param int $count Number of backup codes to generate
     * @return array Array of backup codes
     */
    private function generateBackupCodes($count = 8) {
        $codes = [];
        for ($i = 0; $i < $count; $i++) {
            $codes[] = bin2hex(random_bytes(4));
        }
        return $codes;
    }

    /**
     * Verify a backup code
     *
     * @param int $userId User ID
     * @param string $code The backup code to verify
     * @return bool True if verified, false otherwise
     */
    private function verifyBackupCode($userId, $code) {
        try {
            $stmt = $this->db->prepare('SELECT backup_codes FROM user_2fa WHERE user_id = ?');
            $stmt->execute([$userId]);
            $result = $stmt->fetch(PDO::FETCH_ASSOC);

            if (!$result) {
                return false;
            }

            $backupCodes = json_decode($result['backup_codes'], true);

            // Check if the code exists and hasn't been used
            $codeIndex = array_search($code, $backupCodes);
            if ($codeIndex !== false) {
                // Remove the used code
                unset($backupCodes[$codeIndex]);
                $backupCodes = array_values($backupCodes);

                // Update backup codes in database
                $stmt = $this->db->prepare('
                    UPDATE user_2fa
                    SET backup_codes = ?
                    WHERE user_id = ?
                ');
                $stmt->execute([json_encode($backupCodes), $userId]);

                return true;
            }

            return false;

        } catch (Exception $e) {
            error_log('Backup code verification error: ' . $e->getMessage());
            return false;
        }
    }

    /**
     * Disable 2FA for a user
     *
     * @param int $userId User ID
     * @return bool True if disabled successfully
     */
    public function disable($userId) {
        try {
            $stmt = $this->db->prepare('
                UPDATE user_2fa
                SET enabled = 0,
                    secret_key = NULL,
                    backup_codes = NULL
                WHERE user_id = ?
            ');
            return $stmt->execute([$userId]);

        } catch (Exception $e) {
            error_log('2FA disable error: ' . $e->getMessage());
            return false;
        }
    }

    /**
     * Check if 2FA is enabled for a user
     *
     * @param int $userId User ID
     * @return bool True if enabled
     */
    public function isEnabled($userId) {
        try {
            $stmt = $this->db->prepare('SELECT enabled FROM user_2fa WHERE user_id = ?');
            $stmt->execute([$userId]);
            $result = $stmt->fetch(PDO::FETCH_ASSOC);
            return $result && $result['enabled'];

        } catch (Exception $e) {
            error_log('2FA status check error: ' . $e->getMessage());
            return false;
        }
    }
}