<?php

namespace io\billdesk\client\hmacsha256;

use InvalidArgumentException;

/**
 * Class Config
 *
 * Holds configuration values required by the BillDesk symmetric JOSE client.
 */
class Config
{
    private string $pgBaseUrl;
    private string $clientId;
    private ?string $merchantId = null;
    private string $encryptionKeyBase64;
    private string $signingKeyBase64;
    private string $joseEncryptionKeyId;
    private string $joseSigningKeyId;

    public function setPgBaseUrl(string $url): void
    {
        $this->pgBaseUrl = $url;
    }

    public function getPgBaseUrl(): string
    {
        return $this->pgBaseUrl;
    }

    public function setClientId(string $clientId): void
    {
        $this->clientId = $clientId;
    }

    public function getClientId(): string
    {
        return $this->clientId;
    }

    public function setMerchantId(string $merchantId): void
    {
        $this->merchantId = $merchantId;
    }

    public function getMerchantId(): ?string
    {
        return $this->merchantId;
    }

    public function setEncryptionKeyBase64(string $key): void
    {
        $this->encryptionKeyBase64 = $key;
    }

    public function getEncryptionKeyBase64(): string
    {
        return $this->encryptionKeyBase64;
    }

    public function setSigningKeyBase64(string $key): void
    {
        $this->signingKeyBase64 = $key;
    }

    public function getSigningKeyBase64(): string
    {
        return $this->signingKeyBase64;
    }
    public function getEncryptionKeyId(): string
    {
        return $this->joseEncryptionKeyId;
    }

    public function getSigningKeyId(): string
    {
        return $this->joseSigningKeyId;
    }
    public function setEncryptionKeyId(string $keyId): void
    {
        $this->joseEncryptionKeyId = $keyId;
    }

    public function setSigningKeyId(string $keyId): void
    {
        $this->joseSigningKeyId = $keyId;
    }

    /**
     * Decode the base64-encoded encryption key and validate its length.
     *
     * @return string Raw AES-256 key (32 bytes)
     * @throws InvalidArgumentException
     */
    public function getDecodedEncryptionKey(): string
    {
        $decoded = base64_decode($this->encryptionKeyBase64, true);

        if ($decoded === false || strlen($decoded) !== 32) {
            throw new InvalidArgumentException("Encryption key must be a valid base64-encoded 32-byte (256-bit) value.");
        }

        return $decoded;
    }

    /**
     * Decode the base64-encoded signing key.
     * No strict size requirement enforced, but minimum length is recommended.
     *
     * @return string Raw HMAC key
     * @throws InvalidArgumentException
     */
    public function getDecodedSigningKey(): string
    {
        $decoded = base64_decode($this->signingKeyBase64, true);

        if ($decoded === false || strlen($decoded) < 32) {
            throw new InvalidArgumentException("Signing key must be a valid base64-encoded string with at least 32 bytes.");
        }

        return $decoded;
    }
}
