<?php

namespace Booktics\Order\Services;

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

/**
 * Signed key that lets a guest open their own order without an account.
 *
 * Derived from the order id and number with a site salt, so it cannot be
 * guessed from either value and needs nothing stored alongside the order.
 *
 * @package Booktics/Order
 */
class Order_Key {

    /**
     * Build the view key for an order.
     *
     * @param int    $order_id Order id.
     * @param string $order_no Order number.
     *
     * @return string
     */
    public static function make( $order_id, $order_no ): string {
        return hash_hmac( 'sha256', (string) $order_id . '|' . $order_no, wp_salt( 'booktics_order_view' ) );
    }

    /**
     * Check a key against an order.
     *
     * @param int    $order_id     Order id.
     * @param string $order_no     Order number.
     * @param string $provided_key Key supplied by the caller.
     *
     * @return bool
     */
    public static function verify( $order_id, $order_no, $provided_key ): bool {
        if ( '' === $provided_key || strlen( $provided_key ) > 128 ) {
            return false;
        }

        return hash_equals( self::make( $order_id, $order_no ), $provided_key );
    }
}