<?php

namespace Autogedal\TbiBank\Model;

use Magento\Framework\App\Config\ScopeConfigInterface;
use Magento\Framework\UrlInterface;
use Magento\Store\Model\ScopeInterface;

class FailureRedirect
{
    private const CONFIG_PATH = 'tbi_settings/approval_settings/failure_redirect_path';
    private const DEFAULT_PATH = 'tbi/failure';

    public function __construct(
        private ScopeConfigInterface $scopeConfig,
        private UrlInterface $urlBuilder
    ) {
    }

    public function getUrl(?int $storeId = null, ?string $incrementId = null, ?string $signingKey = null): string
    {
        $path = trim((string) $this->scopeConfig->getValue(
            self::CONFIG_PATH,
            ScopeInterface::SCOPE_STORE,
            $storeId
        ));
        if (!preg_match('/^[a-z0-9][a-z0-9_\/-]*$/i', $path)) {
            $path = self::DEFAULT_PATH;
        }

        $params = ['_secure' => true];
        if ($incrementId !== null && $incrementId !== '' && $signingKey !== null && $signingKey !== '') {
            $params['_query'] = [
                'order_id' => $incrementId,
                'signature' => $this->getSignature($incrementId, $signingKey),
            ];
        }

        return $this->urlBuilder->getUrl($path, $params);
    }

    public function isValidSignature(string $incrementId, string $signature, string $signingKey): bool
    {
        return $incrementId !== '' && $signature !== '' && $signingKey !== ''
            && hash_equals($this->getSignature($incrementId, $signingKey), $signature);
    }

    private function getSignature(string $incrementId, string $signingKey): string
    {
        return hash_hmac('sha256', $incrementId, $signingKey);
    }
}