<?php
// JSON endpoint for the four WebAuthn steps. Kept apart from the pages so
// passkeys.php and login.php stay plain HTML and there is one place where
// the ceremony rules live.
require_once __DIR__ . '/inc/webauthn.php';

header('Content-Type: application/json; charset=UTF-8');
header('Cache-Control: no-store');

// No `never` return type: the README promises PHP 8.0 support and that is 8.1.
function say(array $data, int $code = 200)
{
    http_response_code($code);
    echo json_encode($data);
    exit;
}

// require_login() redirects, which is useless to fetch() — a 302 to the login
// page would arrive as an opaque success. Answer with JSON instead.
function require_login_json(): void
{
    if (!is_logged_in()) {
        say(['error' => 'Log in first.'], 403);
    }
}

// The browser sends JSON, so the CSRF token rides in a header rather than a
// form field. Same-origin is enforced by the token, not by the header alone.
function check_json_csrf(): void
{
    $sent = (string)($_SERVER['HTTP_X_CSRF_TOKEN'] ?? '');
    if (!hash_equals(csrf_token(), $sent)) {
        say(['error' => 'Bad or missing CSRF token.'], 400);
    }
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    say(['error' => 'POST only.'], 405);
}
check_json_csrf();

if (!webauthn_available()) {
    say(['error' => 'Passkeys need HTTPS (or localhost). This page is not on a secure origin.'], 400);
}

$body   = json_decode((string)file_get_contents('php://input'), true) ?: [];
$action = (string)($_GET['action'] ?? '');

switch ($action) {
    // ---- Registration: only someone already logged in may add a passkey.
    case 'register-options':
        require_login_json();
        $challenge = random_bytes(32);
        $_SESSION['wa_challenge'] = $challenge;

        // Existing credentials are excluded so the authenticator refuses to
        // enrol the same device twice instead of silently making a duplicate.
        $exclude = [];
        $st = db()->prepare('SELECT credential_id FROM passkeys WHERE rp_id = ?');
        $st->execute([webauthn_rp_id()]);
        foreach ($st->fetchAll(PDO::FETCH_COLUMN) as $cid) {
            $exclude[] = ['type' => 'public-key', 'id' => $cid];
        }

        say([
            'challenge' => b64url_encode($challenge),
            'rp'        => ['id' => webauthn_rp_id(), 'name' => config()['site_name']],
            // A WebAuthn user handle is required but this app has exactly one
            // account, so it is a fixed opaque value rather than a real id.
            'user' => [
                'id'          => b64url_encode('autofeed-owner'),
                'name'        => 'owner',
                'displayName' => config()['site_name'] . ' owner',
            ],
            'pubKeyCredParams' => [
                ['type' => 'public-key', 'alg' => -7],    // ES256
                ['type' => 'public-key', 'alg' => -257],  // RS256
            ],
            'authenticatorSelection' => [
                'residentKey'      => 'preferred', // discoverable: lets login work without typing anything
                'userVerification'  => 'preferred',
            ],
            'excludeCredentials' => $exclude,
            'timeout'            => 60000,
            'attestation'        => 'none',
        ]);
        // no break — say() exits

    case 'register-verify':
        require_login_json();
        $challenge = (string)($_SESSION['wa_challenge'] ?? '');
        unset($_SESSION['wa_challenge']); // one challenge, one use
        if ($challenge === '') {
            say(['error' => 'That registration expired. Try again.'], 400);
        }
        try {
            $cred = webauthn_verify_registration(
                b64url_decode((string)($body['clientDataJSON'] ?? '')),
                b64url_decode((string)($body['attestationObject'] ?? '')),
                $challenge
            );
        } catch (Throwable $e) {
            say(['error' => 'Could not register that passkey: ' . $e->getMessage()], 400);
        }
        $label = trim((string)($body['label'] ?? ''));
        $label = $label === '' ? 'Passkey' : mb_substr($label, 0, 60);

        backup_db();
        db()->prepare(
            'INSERT OR REPLACE INTO passkeys (credential_id, public_key, sign_count, rp_id, label) VALUES (?,?,?,?,?)'
        )->execute([$cred['credential_id'], $cred['public_key'], $cred['sign_count'], webauthn_rp_id(), $label]);
        say(['ok' => true]);

    // ---- Login: reachable logged out, by definition.
    case 'login-options':
        $challenge = random_bytes(32);
        $_SESSION['wa_challenge'] = $challenge;

        $allow = [];
        $st = db()->prepare('SELECT credential_id FROM passkeys WHERE rp_id = ?');
        $st->execute([webauthn_rp_id()]);
        foreach ($st->fetchAll(PDO::FETCH_COLUMN) as $cid) {
            $allow[] = ['type' => 'public-key', 'id' => $cid];
        }
        say([
            'challenge'        => b64url_encode($challenge),
            'rpId'             => webauthn_rp_id(),
            'allowCredentials' => $allow,
            'userVerification' => 'preferred',
            'timeout'          => 60000,
        ]);

    case 'login-verify':
        $challenge = (string)($_SESSION['wa_challenge'] ?? '');
        unset($_SESSION['wa_challenge']);
        if ($challenge === '') {
            say(['error' => 'That sign-in expired. Try again.'], 400);
        }
        $credId = (string)($body['id'] ?? '');
        $st = db()->prepare('SELECT * FROM passkeys WHERE credential_id = ? AND rp_id = ?');
        $st->execute([$credId, webauthn_rp_id()]);
        $row = $st->fetch();
        if (!$row) {
            say(['error' => 'That passkey is not registered here.'], 400);
        }
        try {
            $count = webauthn_verify_assertion(
                b64url_decode((string)($body['clientDataJSON'] ?? '')),
                b64url_decode((string)($body['authenticatorData'] ?? '')),
                b64url_decode((string)($body['signature'] ?? '')),
                $challenge,
                (string)$row['public_key'],
                (int)$row['sign_count']
            );
        } catch (Throwable $e) {
            say(['error' => 'Sign-in failed: ' . $e->getMessage()], 400);
        }
        db()->prepare("UPDATE passkeys SET sign_count = ?, last_used_at = datetime('now') WHERE id = ?")
            ->execute([$count, $row['id']]);

        log_in();
        remember_login();
        say(['ok' => true, 'redirect' => 'index.php']);
}

say(['error' => 'Unknown action.'], 400);