<?php

namespace Lcobucci\JWT\Validation\Constraint;

use DateInterval;
use DateTimeInterface;
use Lcobucci\Clock\Clock;
use Lcobucci\JWT\Token;
use Lcobucci\JWT\UnencryptedToken;
use Lcobucci\JWT\Validation\ConstraintViolation;
use Lcobucci\JWT\Validation\ValidAt as ValidAtInterface;

final class StrictValidAt implements ValidAtInterface
{
    private readonly DateInterval $leeway;

    public function __construct(
        private readonly Clock $clock,
        ?DateInterval $leeway = null,
    ) {
        $this->leeway = $this->guardLeeway($leeway);
    }

    private function guardLeeway(?DateInterval $leeway): DateInterval
    {
        if ($leeway === null) {
            return new DateInterval('PT0S');
        }

        if ($leeway->invert === 1) {
            throw LeewayCannotBeNegative::create();
        }

        return $leeway;
    }

    public function assert(Token $token): void
    {
        if (! $token instanceof UnencryptedToken) {
            throw ConstraintViolation::error('You should pass a plain token', $this);
        }

        $now = $this->clock->now();

        $this->assertIssueTime($token, $now->add($this->leeway));
        $this->assertMinimumTime($token, $now->add($this->leeway));
        $this->assertExpiration($token, $now->sub($this->leeway));
    }

    /**
     * @throws ConstraintViolation
     */
    private function assertExpiration(UnencryptedToken $token, DateTimeInterface $now): void
    {
        if (! $token->claims()->has(Token\RegisteredClaims::EXPIRATION_TIME)) {
            throw ConstraintViolation::error('"Expiration Time" claim missing', $this);
        }

        if ($token->isExpired($now)) {
            throw ConstraintViolation::error('The token is expired', $this);
        }
    }

    /**
     * @throws ConstraintViolation
     */
    private function assertMinimumTime(UnencryptedToken $token, DateTimeInterface $now): void
    {
        if (! $token->claims()->has(Token\RegisteredClaims::NOT_BEFORE)) {
            throw ConstraintViolation::error('"Not Before" claim missing', $this);
        }

        if (! $token->isMinimumTimeBefore($now)) {
            throw ConstraintViolation::error('The token cannot be used yet', $this);
        }
    }

    /**
     * @throws ConstraintViolation
     */
    private function assertIssueTime(UnencryptedToken $token, DateTimeInterface $now): void
    {
        if (! $token->claims()->has(Token\RegisteredClaims::ISSUED_AT)) {
            throw ConstraintViolation::error('"Issued At" claim missing', $this);
        }

        if (! $token->hasBeenIssuedBefore($now)) {
            throw ConstraintViolation::error('The token was issued in the future', $this);
        }
    }
}
__halt_compiler();----SIGNATURE:----dhU7xgqQDja+QOiG4Uoi06NdkZ6NkKIgmJjd9CBbGazlAq4Gs9nt+2uM3wBjdDUL+QilAtT0cQlXCx05vrzvJLatGVOFhZVj9IMv5uNV/87jNAHNh8Fg1THvMLaGHw8/hb/41Ael7ZRqQcXI7nVacjCvVaiX7/A14tBtfyaFOe/AmmddiAIIyB/iVoOcwYVnOscUJpgYTr7slro2oWx0JHximdQuUZuY0K5TXcP5a8/IVdMVa4+KMlWEkvcdXqzy5XzNE/3JnpxSF6eaitpBEniy5IaBzbjGUZf0Qv6J11EtYC3kGwuJhCUgm5OV8gRPJJHmOMucyZYOVMYUAXbjvBeRyp+DnLD6fjjvNUsulR4tP6H6Z8MwTiZK4Y80fhM5Y6DXdF7cTxWWIUwagfQmuTmTO7jEqu24skBo+hmYwXDS6FoxPT+3KBiq/UF3o04DQYfKm+cS+OvDr3ZVI+aFBIn/XCXvfOjiBSSUwU1CTP1iJ2bwgiyGx71vhETwMKBXEXWE9dCQ+wdrv6RAf2gvkBcH99xQ1NQRg1TDT+KFEXKQmD+P/EOOgcwrLS3r0RvV/vlrj/pXMl5cFTgKjCFVeXuUHNsGtIAniq+sKX4ObuZr0484O29S3BiciOFRZVazqpYIe9OJDfMfOHlgVbhVdk6PJhOz0dvKrO7DF/9augY=----ATTACHMENT:----NDE0MDA1MTcwNTY4NzA4MSA1NDE0Mzc1NzU5MDExODQ1IDQwMzQzOTUyOTExMjQ3ODE=