<?php

declare (strict_types=1);
namespace OCA\Notifications\Vendor\Jose\Component\KeyManagement\Analyzer;

use OCA\Notifications\Vendor\Jose\Component\Core\JWK;
use OCA\Notifications\Vendor\Jose\Component\Core\Util\Base64UrlSafe;
use Override;
use SensitiveParameter;
use function count;
use function is_string;
use function strlen;
final readonly class ZxcvbnKeyAnalyzer implements KeyAnalyzer
{
    public const STRENGTH_VERY_WEAK = 0;
    public const STRENGTH_WEAK = 1;
    public const STRENGTH_MEDIUM = 2;
    public const STRENGTH_STRONG = 3;
    public const STRENGTH_VERY_STRONG = 4;
    #[Override]
    public function analyze(JWK $jwk, MessageBag $bag): void
    {
        if ($jwk->get('kty') !== 'oct') {
            return;
        }
        $k = $jwk->get('k');
        if (!is_string($k)) {
            $bag->add(Message::high('The key is not valid'));
            return;
        }
        $k = Base64UrlSafe::decodeNoPadding($k);
        $strength = self::estimateStrength($k);
        switch (true) {
            case $strength < 3:
                $bag->add(Message::high('The octet string is weak and easily guessable. Please change your key as soon as possible.'));
                break;
            case $strength === 3:
                $bag->add(Message::medium('The octet string is safe, but a longer key is preferable.'));
                break;
            default:
                break;
        }
    }
    /**
     * Returns the estimated strength of a password.
     *
     * The higher the value, the stronger the password.
     *
     * @return self::STRENGTH_*
     */
    private static function estimateStrength(
        #[SensitiveParameter]
        string $password
    ): int
    {
        if (!$length = strlen($password)) {
            return self::STRENGTH_VERY_WEAK;
        }
        $password = count_chars($password, 1);
        $chars = count($password);
        $control = $digit = $upper = $lower = $symbol = $other = 0;
        foreach ($password as $chr => $count) {
            match (true) {
                $chr < 32 || $chr === 127 => $control = 33,
                $chr >= 48 && $chr <= 57 => $digit = 10,
                $chr >= 65 && $chr <= 90 => $upper = 26,
                $chr >= 97 && $chr <= 122 => $lower = 26,
                $chr >= 128 => $other = 128,
                default => $symbol = 33,
            };
        }
        $pool = $lower + $upper + $digit + $symbol + $control + $other;
        $entropy = $chars * log($pool, 2) + ($length - $chars) * log($chars, 2);
        return match (true) {
            $entropy >= 120 => self::STRENGTH_VERY_STRONG,
            $entropy >= 100 => self::STRENGTH_STRONG,
            $entropy >= 80 => self::STRENGTH_MEDIUM,
            $entropy >= 60 => self::STRENGTH_WEAK,
            default => self::STRENGTH_VERY_WEAK,
        };
    }
}