<?php
declare(strict_types=1);
namespace Naz;

/** Raw bytes, including whitespace, are part of the HMAC. No token or payload logging. */
final class Signature {
 public static function sign(string $raw,string $key,?int $at=null):string {
  $at??=time();return 't='.$at.',v1='.hash_hmac('sha256',$at.'.'.$raw,$key);
 }
 public static function verify(string $raw,string $header,string $key,?int $now=null):bool {
  if(!preg_match('/^t=(\d{10}),v1=([a-f0-9]{64})$/D',$header,$m)||abs(($now??time())-(int)$m[1])>300)return false;
  return hash_equals(hash_hmac('sha256',$m[1].'.'.$raw,$key),$m[2]);
 }
}
final class Client {
 public function __construct(private string $connectionId,private string $key,private string $origin='https://sso.naz.sa') {
  if(parse_url($origin,PHP_URL_SCHEME)!=='https')throw new \InvalidArgumentException('HTTPS required');
 }
 public function publish(array $event):array {
  $raw=json_encode($event,JSON_THROW_ON_ERROR|JSON_UNESCAPED_UNICODE|JSON_UNESCAPED_SLASHES);
  $c=curl_init($this->origin.'/api/v1/partner/events');
  curl_setopt_array($c,[CURLOPT_POST=>true,CURLOPT_POSTFIELDS=>$raw,CURLOPT_RETURNTRANSFER=>true,CURLOPT_FOLLOWLOCATION=>false,CURLOPT_CONNECTTIMEOUT=>5,CURLOPT_TIMEOUT=>15,CURLOPT_HTTPHEADER=>['Content-Type: application/json','X-Naz-Connection: '.$this->connectionId,'X-Naz-Signature: '.Signature::sign($raw,$this->key)]]);
  $result=curl_exec($c);$status=(int)curl_getinfo($c,CURLINFO_RESPONSE_CODE);curl_close($c);
  if($result===false||$status<200||$status>=300)throw new \RuntimeException('NAZ transport unavailable');
  return json_decode($result,true,512,JSON_THROW_ON_ERROR);
 }
}