<h2>File Contents: /home/planet5/public_html/wp-content/plugins/wordpress-seo/src/myyoast-client/domain/token-set.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/public_html/wp-content/plugins/wordpress-seo/src/myyoast-client/domain/token-set.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php

namespace Yoast\WP\SEO\MyYoast_Client\Domain;

use InvalidArgumentException;
use SensitiveParameter;

/**
 * Immutable value object representing a set of OAuth tokens.
 *
 * Can represent both user-level tokens (from authorization code flow, with
 * refresh_token and id_token) and site-level tokens (from client_credentials,
 * access_token only).
 */
class Token_Set {

	/**
	 * Seconds before actual expiry to consider the token expired.
	 * Accounts for request latency and minor clock differences.
	 */
	private const EXPIRY_BUFFER_SECONDS = 60;

	/**
	 * The access token (opaque string — do not parse).
	 *
	 * @var string
	 */
	private $access_token;

	/**
	 * The Unix timestamp at which the access token expires.
	 *
	 * @var int
	 */
	private $expires_at;

	/**
	 * The refresh token, if available (user-level tokens only).
	 *
	 * @var string|null
	 */
	private $refresh_token;

	/**
	 * The OIDC ID token, if available (user-level tokens only).
	 *
	 * @var string|null
	 */
	private $id_token;

	/**
	 * The granted scope string.
	 *
	 * @var string|null
	 */
	private $scope;

	/**
	 * The token type (an Auth_Token_Type constant).
	 *
	 * @var string
	 */
	private $token_type;

	/**
	 * The number of consecutive refresh errors.
	 *
	 * @var int
	 */
	private $error_count;

	/**
	 * The RFC 8707 resource indicator this token was minted for.
	 *
	 * @var Resource_Indicator
	 */
	private $resource_indicator;

	/**
	 * Token_Set constructor.
	 *
	 * @param string                  $access_token       The access token.
	 * @param int                     $expires_at         Unix timestamp of token expiry.
	 * @param string                  $token_type         An Auth_Token_Type constant.
	 * @param string|null             $refresh_token      The refresh token.
	 * @param string|null             $id_token           The OIDC ID token.
	 * @param string|null             $scope              The granted scope.
	 * @param int                     $error_count        The number of consecutive refresh errors.
	 * @param Resource_Indicator|null $resource_indicator The resource indicator (RFC 8707) the token was minted for. Null is treated as Resource_Indicator::default().
	 *
	 * @throws InvalidArgumentException If required fields are empty or invalid.
	 */
	public function __construct(
		// phpcs:ignore PHPCompatibility.Attributes.NewAttributes.PHPNativeAttributeFound -- No-op on PHP &lt; 8.2; redacts parameter from stack traces on PHP 8.2+.
		#[SensitiveParameter]
		string $access_token,
		int $expires_at,
		string $token_type = Auth_Token_Type::DPOP,
		// phpcs:ignore PHPCompatibility.Attributes.NewAttributes.PHPNativeAttributeFound -- No-op on PHP &lt; 8.2; redacts parameter from stack traces on PHP 8.2+.
		#[SensitiveParameter]
		?string $refresh_token = null,
		?string $id_token = null,
		?string $scope = null,
		int $error_count = 0,
		?Resource_Indicator $resource_indicator = null
	) {
		if ( $access_token === &#039;&#039; ) {
			throw new InvalidArgumentException( &#039;Token_Set requires a non-empty access_token.&#039; );
		}
		if ( $expires_at &lt;= 0 ) {
			throw new InvalidArgumentException( &#039;Token_Set requires a positive expires_at timestamp.&#039; );
		}
		if ( $token_type === &#039;&#039; ) {
			throw new InvalidArgumentException( &#039;Token_Set requires a non-empty token_type.&#039; );
		}

		$this-&gt;access_token       = $access_token;
		$this-&gt;expires_at         = $expires_at;
		$this-&gt;token_type         = $token_type;
		$this-&gt;refresh_token      = $refresh_token;
		$this-&gt;id_token           = $id_token;
		$this-&gt;scope              = $scope;
		$this-&gt;error_count        = $error_count;
		$this-&gt;resource_indicator = ( $resource_indicator ?? new Resource_Indicator( null ) );
	}

	/**
	 * Returns the access token.
	 *
	 * @return string
	 */
	public function get_access_token(): string {
		return $this-&gt;access_token;
	}

	/**
	 * Returns the Unix timestamp at which the access token expires.
	 *
	 * @return int
	 */
	public function get_expires_at(): int {
		return $this-&gt;expires_at;
	}

	/**
	 * Returns the token type.
	 *
	 * @return string
	 */
	public function get_token_type(): string {
		return $this-&gt;token_type;
	}

	/**
	 * Returns the refresh token, or null if not available.
	 *
	 * @return string|null
	 */
	public function get_refresh_token(): ?string {
		return $this-&gt;refresh_token;
	}

	/**
	 * Returns the OIDC ID token, or null if not available.
	 *
	 * @return string|null
	 */
	public function get_id_token(): ?string {
		return $this-&gt;id_token;
	}

	/**
	 * Returns the granted scope string, or null if not available.
	 *
	 * @return string|null
	 */
	public function get_scope(): ?string {
		return $this-&gt;scope;
	}

	/**
	 * Checks if the token set has the required scope(s).
	 * Returns true if AT LEAST all required scopes are granted, false otherwise.
	 *
	 * @param string[] $required_scopes The required scopes as an array of strings.
	 *
	 * @return bool True if all required scopes are granted, false otherwise.
	 */
	public function has_scopes( array $required_scopes ): bool {
		if ( $this-&gt;scope === null ) {
			return \count( $required_scopes ) === 0;
		}
		$granted_scopes = \explode( &#039; &#039;, $this-&gt;scope );
		return \count( \array_diff( $required_scopes, $granted_scopes ) ) === 0;
	}

	/**
	 * Returns the number of consecutive refresh errors.
	 *
	 * @return int
	 */
	public function get_error_count(): int {
		return $this-&gt;error_count;
	}

	/**
	 * Returns the RFC 8707 resource indicator this token was minted for.
	 *
	 * @return Resource_Indicator
	 */
	public function get_resource_indicator(): Resource_Indicator {
		return $this-&gt;resource_indicator;
	}

	/**
	 * Returns a new Token_Set bound to the given resource indicator.
	 *
	 * @param Resource_Indicator $resource_indicator The resource indicator.
	 *
	 * @return self
	 */
	public function with_resource_indicator( Resource_Indicator $resource_indicator ): self {
		return new self(
			$this-&gt;access_token,
			$this-&gt;expires_at,
			$this-&gt;token_type,
			$this-&gt;refresh_token,
			$this-&gt;id_token,
			$this-&gt;scope,
			$this-&gt;error_count,
			$resource_indicator,
		);
	}

	/**
	 * Returns a new Token_Set with an incremented error count.
	 *
	 * @return self
	 */
	public function with_incremented_error_count(): self {
		return new self(
			$this-&gt;access_token,
			$this-&gt;expires_at,
			$this-&gt;token_type,
			$this-&gt;refresh_token,
			$this-&gt;id_token,
			$this-&gt;scope,
			$this-&gt;error_count + 1,
			$this-&gt;resource_indicator,
		);
	}

	/**
	 * Whether the access token has expired.
	 *
	 * Uses a 60-second buffer to allow for request latency.
	 *
	 * @return bool
	 */
	public function is_expired(): bool {
		return \time() &gt;= ( $this-&gt;expires_at - self::EXPIRY_BUFFER_SECONDS );
	}

	/**
	 * Converts the token set to an associative array for storage.
	 *
	 * @return array&lt;string, string|int|null&gt; The token set as an array.
	 */
	public function to_array(): array {
		return [
			&#039;access_token&#039;       =&gt; $this-&gt;access_token,
			&#039;expires_at&#039;         =&gt; $this-&gt;expires_at,
			&#039;token_type&#039;         =&gt; $this-&gt;token_type,
			&#039;refresh_token&#039;      =&gt; $this-&gt;refresh_token,
			&#039;id_token&#039;           =&gt; $this-&gt;id_token,
			&#039;scope&#039;              =&gt; $this-&gt;scope,
			&#039;error_count&#039;        =&gt; $this-&gt;error_count,
			&#039;resource_indicator&#039; =&gt; $this-&gt;resource_indicator-&gt;value(),
		];
	}

	/**
	 * Creates a Token_Set from a stored array.
	 *
	 * @param array&lt;string, string|int|null&gt; $data The stored array data.
	 *
	 * @return self
	 */
	public static function from_array( array $data ): self {
		$stored_indicator = ( $data[&#039;resource_indicator&#039;] ?? null );

		return new self(
			(string) ( $data[&#039;access_token&#039;] ?? &#039;&#039; ),
			(int) ( $data[&#039;expires_at&#039;] ?? 0 ),
			( $data[&#039;token_type&#039;] ?? Auth_Token_Type::DPOP ),
			( $data[&#039;refresh_token&#039;] ?? null ),
			( $data[&#039;id_token&#039;] ?? null ),
			( $data[&#039;scope&#039;] ?? null ),
			(int) ( $data[&#039;error_count&#039;] ?? 0 ),
			new Resource_Indicator( ( \is_string( $stored_indicator ) &amp;&amp; $stored_indicator !== &#039;&#039; ) ? $stored_indicator : null ),
		);
	}

	/**
	 * Creates a Token_Set from a token endpoint response.
	 *
	 * Per RFC 8707 §3 the AS may echo a `resource` field to confirm the audience
	 * it minted the token for. The spec does not require the client to honour
	 * the echo, and trusting an unverified echo into storage could later violate
	 * §2 on refresh. We deliberately ignore the echoed field; the caller is
	 * expected to stamp the requested indicator via with_resource_indicator().
	 *
	 * @param array&lt;string, string|int|null&gt; $response The parsed JSON response from the token endpoint.
	 *
	 * @return self
	 *
	 * @throws InvalidArgumentException If the response is missing a valid access_token.
	 */
	public static function from_response( array $response ): self {
		if ( empty( $response[&#039;access_token&#039;] ) || ! \is_string( $response[&#039;access_token&#039;] ) ) {
			throw new InvalidArgumentException( &#039;Token response is missing a valid access_token.&#039; );
		}

		$expires_in = (int) ( $response[&#039;expires_in&#039;] ?? 900 );

		return new self(
			$response[&#039;access_token&#039;],
			( \time() + $expires_in ),
			( $response[&#039;token_type&#039;] ?? Auth_Token_Type::DPOP ),
			( $response[&#039;refresh_token&#039;] ?? null ),
			( $response[&#039;id_token&#039;] ?? null ),
			( $response[&#039;scope&#039;] ?? null ),
		);
	}
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fpublic_html%2Fwp-content%2Fplugins%2Fwordpress-seo%2Fsrc%2Fmyyoast-client%2Fdomain'>⬅ Back to Directory</a>