<?php
/**
 * Exact WordPress core file trust evaluation.
 *
 * @package LocalGuardScanner
 */

namespace LocalGuardScanner\Detection\Integrity;

/**
 * Grants trust only when a canonical path matches its signed SHA-256 value.
 */
final class FileTrustEvaluator {
	const TRUSTED_CORE    = 'trusted_core';
	const MODIFIED_CORE   = 'modified_core';
	const UNEXPECTED_CORE = 'unexpected_core';
	const UNTRUSTED       = 'untrusted';

	/** @var array<string,string> */
	private $manifest;

	/** @param array<string,string> $manifest Exact core hashes. */
	public function __construct( array $manifest = array() ) {
		$this->manifest = $manifest;
	}

	/**
	 * @param string      $locator Relative file path.
	 * @param string|null $sha256  Observed hash.
	 * @return string
	 */
	public function evaluate( $locator, $sha256 ) {
		$locator = ltrim( str_replace( '\\', '/', (string) $locator ), '/' );
		if ( isset( $this->manifest[ $locator ] ) ) {
			if ( is_string( $sha256 ) && preg_match( '/^[a-f0-9]{64}$/', $sha256 ) && hash_equals( $this->manifest[ $locator ], $sha256 ) ) {
				return self::TRUSTED_CORE;
			}
			return self::MODIFIED_CORE;
		}
		if ( 0 === strpos( $locator, 'wp-admin/' ) || 0 === strpos( $locator, 'wp-includes/' ) ) {
			return self::UNEXPECTED_CORE;
		}
		return self::UNTRUSTED;
	}
}
