<?php
namespace App\Core;

use finfo; 

class Security
{
    public static function csrfToken(): string
    {
        if (session_status() === PHP_SESSION_NONE) session_start();

        if (empty($_SESSION['_csrf'])) {
            $_SESSION['_csrf'] = bin2hex(random_bytes(32));
        }

        return $_SESSION['_csrf'];
    }

    public static function log(string $action, string $details = ''): void
    {
    $logFile = __DIR__ . '/../logs/access_log.txt'; 
    $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
    $logEntry = "[" . date('Y-m-d H:i:s') . "] IP: $ip | Action: $action | Détails: $details" . PHP_EOL;
    file_put_contents($logFile, $logEntry, FILE_APPEND);
    }

    public static function csrfField(): string
    {
        $token = self::csrfToken();
        return '<input type="hidden" name="_csrf" value="' . $token . '">';
    }

    public static function verifyCsrf(): void
    {
        if (session_status() === PHP_SESSION_NONE) session_start();

        $token = $_POST['_csrf'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';

        if (!hash_equals($_SESSION['_csrf'] ?? '', $token)) {
            http_response_code(403);
            die('CSRF token mismatch.');
        }
    }

    public static function e(mixed $value): string
    {
        return htmlspecialchars((string)$value, ENT_QUOTES | ENT_HTML5, 'UTF-8');
    }

    public static function secureUpload(array $file, string $destinationFolder): ?string
    {
        if ($file['error'] !== UPLOAD_ERR_OK) return null;
        $finfo = new finfo(FILEINFO_MIME_TYPE);
        $mimeType = $finfo->file($file['tmp_name']);
        
        $allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
        if (!in_array($mimeType, $allowedMimeTypes)) {
            return null;
        }

        $extension = pathinfo($file['name'], PATHINFO_EXTENSION);
        $newName = bin2hex(random_bytes(8)) . '.' . $extension;
        $targetPath = $destinationFolder . '/' . $newName;

        if (move_uploaded_file($file['tmp_name'], $targetPath)) {
            return $newName;
        }

        return null;
    }

    public static function slug(string $str): string
    {
        $str = mb_strtolower(trim($str));
        $str = iconv('UTF-8', 'ASCII//TRANSLIT', $str);
        $str = preg_replace('/[^a-z0-9-]/', '-', $str);
        $str = preg_replace('/-+/', '-', $str);
        return trim($str, '-');
    }

    public static function rateLimit(string $key, int $max, int $windowSeconds): bool
    {
        if (session_status() === PHP_SESSION_NONE) session_start();

        $now = time();
        $sessionKey = "_rl_{$key}";

        if (!isset($_SESSION[$sessionKey])) {
            $_SESSION[$sessionKey] = ['count' => 0, 'start' => $now];
        }

        $data = &$_SESSION[$sessionKey];

        if ($now - $data['start'] > $windowSeconds) {
            $data = ['count' => 0, 'start' => $now];
        }

        if ($data['count'] >= $max) {
            return false;
        }

        $data['count']++;
        return true;
    }

    public static function sanitizeEmail(string $email): string
    {
        return filter_var(trim($email), FILTER_SANITIZE_EMAIL);
    }

    public static function hashPassword(string $password): string
    {
        return password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
    }

    public static function verifyPassword(string $password, string $hash): bool
    {
        return password_verify($password, $hash);
    }
}