<?php
/**
 * Rule signature verification.
 *
 * @package LocalGuardScanner
 */

namespace LocalGuardScanner\Detection\Rules;

/**
 * Verifies detached Ed25519 signatures over exact manifest bytes.
 */
final class RuleVerifier {
	/**
	 * @param string $manifest        Exact manifest bytes.
	 * @param string $signature_base64 Base64 signature.
	 * @param string $public_base64    Base64 public key.
	 * @return bool
	 */
	public function verify( $manifest, $signature_base64, $public_base64 ) {
		$signature  = base64_decode( trim( $signature_base64 ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
		$public_key = base64_decode( trim( $public_base64 ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
		if ( false === $signature || false === $public_key ) {
			return false;
		}
		if ( SODIUM_CRYPTO_SIGN_BYTES !== strlen( $signature ) || SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES !== strlen( $public_key ) ) {
			return false;
		}
		return sodium_crypto_sign_verify_detached( $signature, $manifest, $public_key );
	}
}
