<?php
require_once __DIR__ . '/secret.php'; // panggil secret

// Helper base64 url safe
function base64url_encode($data) {
    return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}
function base64url_decode($data) {
    return base64_decode(strtr($data, '-_', '+/'));
}

// Buat token dari order_id
function jwt_encrypt($order_id) {
    $header = ['typ' => 'JWT', 'alg' => 'HS256'];
    $payload = ['order_id' => $order_id];

    $header_encoded  = base64url_encode(json_encode($header));
    $payload_encoded = base64url_encode(json_encode($payload));

    $signature = hash_hmac('sha256', "$header_encoded.$payload_encoded", JWT_SECRET, true);
    $signature_encoded = base64url_encode($signature);

    return "$header_encoded.$payload_encoded.$signature_encoded";
}

// Baca token → dapat order_id
function jwt_decrypt($jwt) {
    $parts = explode('.', $jwt);
    if (count($parts) !== 3) {
        return false;
    }

    list($header_encoded, $payload_encoded, $signature_provided) = $parts;

    $signature = hash_hmac('sha256', "$header_encoded.$payload_encoded", JWT_SECRET, true);
    $signature_verified = base64url_encode($signature);

    if (!hash_equals($signature_verified, $signature_provided)) {
        return false; // Signature tidak cocok
    }

    $payload = json_decode(base64url_decode($payload_encoded), true);
    return $payload['order_id'] ?? false;
}