jwt-handler.php

<?php
/**
 * JWT Handler - Simple JWT implementation for WordPress
 * 
 * This class provides basic JWT encoding and decoding functionality
 * for API authentication without external dependencies.
 */

if ( ! defined( 'WPINC' ) ) {
	die;
}

class Carz_JWT_Handler {

	/**
	 * Supported algorithms
	 */
	private static $supported_algs = array(
		'HS256' => 'sha256',
		'HS384' => 'sha384',
		'HS512' => 'sha512',
	);

	/**
	 * Encode a JWT token
	 *
	 * @param array  $payload The payload data
	 * @param string $key     The secret key
	 * @param string $alg     The algorithm (default: HS256)
	 * @return string The JWT token
	 */
	public static function encode( $payload, $key, $alg = 'HS256' ) {
		if ( ! isset( self::$supported_algs[ $alg ] ) ) {
			throw new Exception( 'Algorithm not supported' );
		}

		$header = array(
			'typ' => 'JWT',
			'alg' => $alg,
		);

		$segments = array();
		$segments[] = self::url_safe_base64_encode( wp_json_encode( $header ) );
		$segments[] = self::url_safe_base64_encode( wp_json_encode( $payload ) );
		
		$signing_input = implode( '.', $segments );
		$signature = self::sign( $signing_input, $key, $alg );
		$segments[] = self::url_safe_base64_encode( $signature );

		return implode( '.', $segments );
	}

	/**
	 * Decode a JWT token
	 *
	 * @param string $jwt The JWT token
	 * @param string $key The secret key
	 * @return object|false The decoded payload or false on failure
	 */
	public static function decode( $jwt, $key ) {
		$segments = explode( '.', $jwt );
		
		if ( count( $segments ) !== 3 ) {
			return false;
		}

		list( $header_b64, $payload_b64, $signature_b64 ) = $segments;

		// Decode header
		$header = json_decode( self::url_safe_base64_decode( $header_b64 ) );
		if ( ! $header ) {
			return false;
		}

		// Verify algorithm
		if ( ! isset( $header->alg ) || ! isset( self::$supported_algs[ $header->alg ] ) ) {
			return false;
		}

		// Verify signature
		$signature = self::url_safe_base64_decode( $signature_b64 );
		$signing_input = $header_b64 . '.' . $payload_b64;
		
		if ( ! self::verify( $signing_input, $signature, $key, $header->alg ) ) {
			return false;
		}

		// Decode payload
		$payload = json_decode( self::url_safe_base64_decode( $payload_b64 ) );
		if ( ! $payload ) {
			return false;
		}

		// Verify expiration
		if ( isset( $payload->exp ) && $payload->exp < time() ) {
			return false;
		}

		// Verify not before
		if ( isset( $payload->nbf ) && $payload->nbf > time() ) {
			return false;
		}

		return $payload;
	}

	/**
	 * Sign a string with the given key and algorithm
	 *
	 * @param string $msg The message to sign
	 * @param string $key The secret key
	 * @param string $alg The algorithm
	 * @return string The signature
	 */
	private static function sign( $msg, $key, $alg ) {
		$hash_alg = self::$supported_algs[ $alg ];
		return hash_hmac( $hash_alg, $msg, $key, true );
	}

	/**
	 * Verify a signature
	 *
	 * @param string $msg       The message that was signed
	 * @param string $signature The signature to verify
	 * @param string $key       The secret key
	 * @param string $alg       The algorithm
	 * @return bool True if valid, false otherwise
	 */
	private static function verify( $msg, $signature, $key, $alg ) {
		$hash = self::sign( $msg, $key, $alg );
		return hash_equals( $hash, $signature );
	}

	/**
	 * URL-safe base64 encode
	 *
	 * @param string $input The input to encode
	 * @return string The encoded string
	 */
	private static function url_safe_base64_encode( $input ) {
		return str_replace( '=', '', strtr( base64_encode( $input ), '+/', '-_' ) );
	}

	/**
	 * URL-safe base64 decode
	 *
	 * @param string $input The input to decode
	 * @return string The decoded string
	 */
	private static function url_safe_base64_decode( $input ) {
		$remainder = strlen( $input ) % 4;
		if ( $remainder ) {
			$padlen = 4 - $remainder;
			$input .= str_repeat( '=', $padlen );
		}
		return base64_decode( strtr( $input, '-_', '+/' ) );
	}

	/**
	 * Generate a JWT token for API access
	 *
	 * @param array  $data Additional data to include in the payload
	 * @param string $key  The secret key
	 * @param int    $exp  Expiration time in seconds (default: 3600 = 1 hour)
	 * @return string The JWT token
	 */
	public static function generate_token( $data = array(), $key = '', $exp = 3600 ) {
		if ( empty( $key ) ) {
			// Try to get JWT_SECRET from wp-config.php or environment
			if ( defined( 'JWT_SECRET' ) ) {
				$key = JWT_SECRET;
			} else {
				throw new Exception( 'JWT secret key not defined' );
			}
		}

		$payload = array_merge(
			array(
				'iat' => time(),
				'exp' => time() + $exp,
				'iss' => get_bloginfo( 'url' ),
			),
			$data
		);

		return self::encode( $payload, $key );
	}

	/**
	 * Validate a JWT token
	 *
	 * @param string $token The JWT token to validate
	 * @param string $key   The secret key
	 * @return object|false The decoded payload or false on failure
	 */
	public static function validate_token( $token, $key = '' ) {
		if ( empty( $key ) ) {
			// Try to get JWT_SECRET from wp-config.php or environment
			if ( defined( 'JWT_SECRET' ) ) {
				$key = JWT_SECRET;
			} else {
				return false;
			}
		}

		return self::decode( $token, $key );
	}
}