Remove hashids/hashids dependency (BC Math/GMP)

composer.json

@@ -48,7 +48,6 @@
         "mexitek/phpcolors": "^1.0.4",
         "phpdocumentor/reflection-docblock": "^5.3.0",
         "stripe/stripe-php": "^17.4.0",
-        "hashids/hashids": "^4.1.0",
         "rakit/validation": "dev-master#ff003a35cdf5030a5f2482299f4c93f344a35b29",
         "ifsnop/mysqldump-php": "^2.12",
         "mpdf/mpdf": "^8.2.0",

inc/helpers/class-hash.php

@@ -2,15 +2,15 @@
 /**
  * Handles hashing to encode ids and prevent spoofing due to auto-increments.
  *
+ * Uses a pure PHP implementation with no external dependencies.
+ *
  * @package WP_Ultimo
  * @subpackage Helper
  * @since 2.0.0
  */
 
 namespace WP_Ultimo\Helpers;
 
-use Hashids\Hashids;
-
 // Exit if accessed directly
 defined('ABSPATH') || exit;
 
@@ -26,6 +26,11 @@ class Hash {
 	 */
 	const LENGTH = 10;
 
+	/**
+	 * The character set used for encoding.
+	 */
+	const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890';
+
 	/**
 	 * Static-only class.
 	 */
@@ -42,9 +47,26 @@ private function __construct() {}
 	 */
 	public static function encode($number, $group = 'wp-ultimo') {
 
-		$hasher = new Hashids($group, self::LENGTH, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890');
+		$alphabet = self::shuffle_alphabet($group);
+		$base     = strlen($alphabet);
+		$seed     = self::derive_seed($group);
+
+		$obfuscated = (int) $number ^ $seed;
+
+		// Ensure positive value for base conversion.
+		if ($obfuscated < 0) {
+			$obfuscated = ~$obfuscated;
+		}
+
+		$result = '';
+
+		do {
+			$result = $alphabet[ $obfuscated % $base ] . $result;
 
-		return $hasher->encode($number);
+			$obfuscated = intdiv($obfuscated, $base);
+		} while ($obfuscated > 0);
+
+		return str_pad($result, self::LENGTH, $alphabet[0], STR_PAD_LEFT);
 	}
 
 	/**
@@ -58,8 +80,64 @@ public static function encode($number, $group = 'wp-ultimo') {
 	 */
 	public static function decode($hash, $group = 'wp-ultimo') {
 
-		$hasher = new Hashids($group, 10, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890');
+		if (empty($hash) || ! is_string($hash)) {
+			return false;
+		}
+
+		$alphabet = self::shuffle_alphabet($group);
+		$base     = strlen($alphabet);
+		$seed     = self::derive_seed($group);
+
+		$number      = 0;
+		$hash_length = strlen($hash);
+
+		for ($i = 0; $i < $hash_length; $i++) {
+			$pos = strpos($alphabet, $hash[ $i ]);
+
+			if (false === $pos) {
+				return false;
+			}
+
+			$number = $number * $base + $pos;
+		}
+
+		return $number ^ $seed;
+	}
+
+	/**
+	 * Creates a deterministic shuffled alphabet based on the group string.
+	 *
+	 * Uses md5 as a portable source of deterministic pseudo-random bytes.
+	 *
+	 * @since 2.5.0
+	 *
+	 * @param string $group The group/salt string.
+	 * @return string The shuffled alphabet.
+	 */
+	private static function shuffle_alphabet(string $group): string {
+
+		$chars = str_split(self::ALPHABET);
+		$key   = md5($group);
+
+		for ($i = count($chars) - 1; $i > 0; $i--) {
+			$j = ord($key[ $i % strlen($key) ]) % ($i + 1);
+
+			[$chars[ $i ], $chars[ $j ]] = [$chars[ $j ], $chars[ $i ]];
+		}
+
+		return implode('', $chars);
+	}
+
+	/**
+	 * Derives a positive numeric seed from the group string.
+	 *
+	 * @since 2.5.0
+	 *
+	 * @param string $group The group/salt string.
+	 * @return int A positive integer seed.
+	 */
+	private static function derive_seed(string $group): int {
 
-		return current($hasher->decode($hash));
+		return abs(crc32($group . ':wu-hash-seed'));
 	}
 }