13-full-workflow.php

<?php

/**
 * PPS-PHP Example 13: Full Workflow
 *
 * Demonstrates a complete PPS workflow:
 * 1. Device registration
 * 2. Single-device login
 * 3. Transaction signing
 * 4. Duress authentication
 * 5. Threshold approval
 *
 * Usage:
 *   php examples/13-full-workflow.php
 */

declare(strict_types=1);

require_once __DIR__ . '/../vendor/autoload.php';

use Pps\Client\AuthenticatorClient;
use Pps\Client\RegistrationBuilder;
use Pps\Crypto\Base64Url;
use Pps\Key\KeyManager;
use Pps\Payload\ContextObject;
use Pps\Payload\PolicyObject;
use Pps\Payload\TransactionObject;
use Pps\Server\AuthenticationHandler;
use Pps\Server\ChallengeGenerator;
use Pps\Server\RegistrationHandler;
use Pps\Storage\InMemoryStorage;
use Pps\Util\SystemTimeProvider;

echo "=== PPS-PHP Example 13: Full Workflow ===\n\n";

$storage = new InMemoryStorage();
$timeProvider = new SystemTimeProvider();
$rpId = 'example.com';

// ---------------------------------------------------------------
// 1. Registration
// ---------------------------------------------------------------

echo "1. Device Registration\n";

$regHandler = new RegistrationHandler($storage, $timeProvider);
$regChallenge = $regHandler->createChallenge($rpId);

$regBuilder = new RegistrationBuilder();
$registration = $regBuilder
    ->rpId($rpId)
    ->nonce($regChallenge->nonceB64u)
    ->userHandle('user-123')
    ->deviceName('My Phone')
    ->withDuress(true)
    ->build();

$regResult = $regHandler->verify(
    $registration['token'],
    $rpId,
    $regChallenge->nonceB64u
);

echo "   Registration: " . ($regResult->ok ? 'SUCCESS' : 'FAILED') . "\n\n";

$clientState = $registration['client_state'];

// ---------------------------------------------------------------
// 2. Single-Device Login
// ---------------------------------------------------------------

echo "2. Single-Device Login\n";

$challengeGen = new ChallengeGenerator($timeProvider);
$loginChallenge = $challengeGen->create($rpId);

$storage->storeNonce(
    $loginChallenge->nonceB64u,
    $loginChallenge->sessionId,
    time() + 60
);

$authClient = new AuthenticatorClient($clientState, $timeProvider);
$loginPulse = $authClient
    ->rpId($rpId)
    ->nonce($loginChallenge->nonceB64u)
    ->createPulse();

$authHandler = new AuthenticationHandler($storage, $timeProvider);
$loginResult = $authHandler->verify(
    pulseToken: $loginPulse['token'],
    rpId: $rpId,
    nonceB64u: $loginChallenge->nonceB64u,
    trustCode: $loginPulse['trust_code']
);

echo "   Login: " . ($loginResult->ok ? 'SUCCESS' : 'FAILED') . "\n";
echo "   Trust Code: " . $loginPulse['trust_code'] . "\n\n";

// Update client state after successful login
$clientState = $loginPulse['new_client_state'];

// ---------------------------------------------------------------
// 3. Transaction Signing
// ---------------------------------------------------------------

echo "3. Transaction Signing\n";

$txChallenge = $challengeGen->create($rpId);
$storage->storeNonce(
    $txChallenge->nonceB64u,
    $txChallenge->sessionId,
    time() + 60
);

$transaction = new TransactionObject(
    action: 'withdraw',
    amountMinor: 2500067,
    currency: 'IRR',
    recipient: 'IR820540102680020817909002'
);

$context = new ContextObject();
$context->sessionId = Base64Url::decode($txChallenge->sessionId);
$context->txHash = $transaction->hash();

$policy = new PolicyObject();
$policy->requireAmountMark = true;
$policy->maxAmountMinor = 10000000;

$txClient = new AuthenticatorClient($clientState, $timeProvider);
$txPulse = $txClient
    ->rpId($rpId)
    ->nonce($txChallenge->nonceB64u)
    ->context($context)
    ->policy($policy)
    ->amountMinor($transaction->amountMinor)
    ->createPulse();

$txResult = $authHandler->verify(
    pulseToken: $txPulse['token'],
    rpId: $rpId,
    nonceB64u: $txChallenge->nonceB64u,
    amountMinor: $transaction->amountMinor,
    context: $context,
    policy: $policy,
    trustCode: $txPulse['trust_code']
);

echo "   Transaction: " . ($txResult->ok ? 'SUCCESS' : 'FAILED') . "\n";
echo "   Trust Code: " . $txPulse['trust_code'] . "\n";
echo "   AmountMark: " . substr($txPulse['trust_code'], -2) . "\n\n";

$clientState = $txPulse['new_client_state'];

// ---------------------------------------------------------------
// 4. Duress Authentication
// ---------------------------------------------------------------

echo "4. Duress Authentication\n";

$duressChallenge = $challengeGen->create($rpId);
$storage->storeNonce(
    $duressChallenge->nonceB64u,
    $duressChallenge->sessionId,
    time() + 60
);

$duressClient = new AuthenticatorClient($clientState, $timeProvider);
$duressPulse = $duressClient
    ->rpId($rpId)
    ->nonce($duressChallenge->nonceB64u)
    ->duress(true)
    ->createPulse();

$duressResult = $authHandler->verify(
    pulseToken: $duressPulse['token'],
    rpId: $rpId,
    nonceB64u: $duressChallenge->nonceB64u
);

echo "   Outward response: ok\n";
echo "   Internal duress detected: " . ($duressResult->honey ? 'YES' : 'NO') . "\n\n";

// ---------------------------------------------------------------
// 5. Threshold Approval
// ---------------------------------------------------------------

echo "5. Threshold Approval\n";

// Register threshold group
$gid = KeyManager::generateGid();
$gidB64u = Base64Url::encode($gid);

$phoneKey = KeyManager::generateKeyPair();
$watchKey = KeyManager::generateKeyPair();

$phoneKid = Base64Url::encode(KeyManager::generateKid());
$watchKid = Base64Url::encode(KeyManager::generateKid());

$storage->saveGroupState($gidB64u, [
    'gid' => $gidB64u,
    'threshold' => 2,
    'signers' => [
        $phoneKid => $phoneKey->publicKeyB64u(),
        $watchKid => $watchKey->publicKeyB64u(),
    ],
    'last_counter' => 0,
    'revoked' => false,
]);

$thresholdChallenge = $challengeGen->create($rpId);
$storage->storeNonce(
    $thresholdChallenge->nonceB64u,
    $thresholdChallenge->sessionId,
    time() + 60
);

// Phone creates partial Pulse
$phoneState = [
    'kid' => $phoneKid,
    'current_seed' => Base64Url::encode($phoneKey->seed),
    'counter' => 0,
];

$phoneClient = new AuthenticatorClient($phoneState, $timeProvider);
$partial = $phoneClient
    ->rpId($rpId)
    ->nonce($thresholdChallenge->nonceB64u)
    ->amountMinor(5000000)
    ->thresholdGroup($gidB64u, 2)
    ->createPartialPulse();

// Watch co-signs
$watchState = [
    'kid' => $watchKid,
    'current_seed' => Base64Url::encode($watchKey->seed),
    'counter' => 0,
];

$watchClient = new AuthenticatorClient($watchState, $timeProvider);
$coSign = $watchClient->coSign($partial);

// Assemble threshold token
$thresholdToken = AuthenticatorClient::assembleThresholdToken($partial, [
    $phoneKid => Base64Url::encode(
        \Pps\Crypto\Ed25519::sign($partial['message'], $phoneKey->secretKey)
    ),
    $watchKid => $coSign['signature'],
]);

$thresholdResult = $authHandler->verify(
    pulseToken: $thresholdToken,
    rpId: $rpId,
    nonceB64u: $thresholdChallenge->nonceB64u,
    amountMinor: 5000000
);

echo "   Threshold approval: " . ($thresholdResult->ok ? 'SUCCESS' : 'FAILED') . "\n";
echo "   Threshold met: " . ($thresholdResult->thresholdMet ? 'YES' : 'NO') . "\n\n";

echo "=== Example 13 Complete ===\n";