wordpress-seo / src / myyoast-client / infrastructure / crypto / key-pair.php

key-pair.php in Yoast SEO – Advanced SEO with real-time guidance and built-in AI 28.2, at src/myyoast-client/infrastructure/crypto/key-pair.php

96 lines 2.4 KB

Raw Download Zip

1	<?php
2	// phpcs:disable Yoast.NamingConventions.NamespaceName.TooLong -- Needed in the folder structure.
3
4	namespace Yoast\WP\SEO\MyYoast_Client\Infrastructure\Crypto;
5
6	use InvalidArgumentException;
7	use SensitiveParameter;
8
9	/**
10	* Immutable value object representing an Ed25519 key pair with its key ID.
11	*/
12	class Key_Pair {
13
14	/**
15	* The 32-byte Ed25519 public key.
16	*
17	* @var string
18	*/
19	private $public_key;
20
21	/**
22	* The 64-byte Ed25519 secret key (keypair format).
23	*
24	* @var string
25	*/
26	private $private_key;
27
28	/**
29	* The key ID (derived from the public key thumbprint).
30	*
31	* @var string
32	*/
33	private $kid;
34
35	/**
36	* Key_Pair constructor.
37	*
38	* @param string $public_key The 32-byte Ed25519 public key.
39	* @param string $private_key The 64-byte Ed25519 secret key.
40	* @param string $kid The key ID.
41	*
42	* @throws InvalidArgumentException If key lengths are invalid.
43	*/
44	public function __construct(
45	string $public_key,
46	// phpcs:ignore PHPCompatibility.Attributes.NewAttributes.PHPNativeAttributeFound -- No-op on PHP < 8.2; redacts parameter from stack traces on PHP 8.2+.
47	#[SensitiveParameter]
48	string $private_key,
49	string $kid
50	) {
51	if ( \strlen( $public_key ) !== \SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES ) {
52	throw new InvalidArgumentException(
53	// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Internal exception message.
54	\sprintf( 'Public key must be %d bytes, got %d.', \SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES, \strlen( $public_key ) ),
55	);
56	}
57	if ( \strlen( $private_key ) !== \SODIUM_CRYPTO_SIGN_SECRETKEYBYTES ) {
58	throw new InvalidArgumentException(
59	// phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Internal exception message.
60	\sprintf( 'Private key must be %d bytes, got %d.', \SODIUM_CRYPTO_SIGN_SECRETKEYBYTES, \strlen( $private_key ) ),
61	);
62	}
63
64	$this->public_key = $public_key;
65	$this->private_key = $private_key;
66	$this->kid = $kid;
67	}
68
69	/**
70	* Returns the public key.
71	*
72	* @return string The 32-byte Ed25519 public key.
73	*/
74	public function get_public_key(): string {
75	return $this->public_key;
76	}
77
78	/**
79	* Returns the private key.
80	*
81	* @return string The 64-byte Ed25519 secret key.
82	*/
83	public function get_private_key(): string {
84	return $this->private_key;
85	}
86
87	/**
88	* Returns the key ID.
89	*
90	* @return string The key ID.
91	*/
92	public function get_kid(): string {
93	return $this->kid;
94	}
95	}
96