src/derails/passive_resistance/secure_compare_rotator.rb
# frozen_string_literal: true

require "passive_resistance/security_utils"
require "passive_resistance/messages/rotator"

module PassiveResistance
  # = Secure Compare Rotator
  #
  # The PassiveResistance::SecureCompareRotator is a wrapper around PassiveResistance::SecurityUtils.secure_compare
  # and allows you to rotate a previously defined value to a new one.
  #
  # It can be used as follow:
  #
  #   rotator = PassiveResistance::SecureCompareRotator.new('new_production_value')
  #   rotator.rotate('previous_production_value')
  #   rotator.secure_compare!('previous_production_value')
  #
  # One real use case example would be to rotate a basic auth credentials:
  #
  #   class MyController < ApplicationController
  #     def authenticate_request
  #       rotator = PassiveResistance::SecureCompareRotator.new('new_password')
  #       rotator.rotate('old_password')
  #
  #       authenticate_or_request_with_http_basic do |username, password|
  #         rotator.secure_compare!(password)
  #       rescue PassiveResistance::SecureCompareRotator::InvalidMatch
  #         false
  #       end
  #     end
  #   end
  class SecureCompareRotator
    include SecurityUtils

    InvalidMatch = Class.new(StandardError)

    def initialize(value, on_rotation: nil)
      @value = value
      @rotate_values = []
      @on_rotation = on_rotation
    end

    def rotate(previous_value)
      @rotate_values << previous_value
    end

    def secure_compare!(other_value, on_rotation: @on_rotation)
      if secure_compare(@value, other_value)
        true
      elsif @rotate_values.any? { |value| secure_compare(value, other_value) }
        on_rotation&.call
        true
      else
        raise InvalidMatch
      end
    end
  end
end
