<?php
/**
 * Template for the generated must-use loader. LoaderInstaller::install() stamps the
 * plugin directory below as a string literal, prepends a Plugin Name header and writes
 * the result into the must-use plugins directory (WPMU_PLUGIN_DIR). An unstamped copy
 * of this file does nothing.
 *
 * @package Bloatwright
 */

defined( 'ABSPATH' ) || exit;

if ( ! function_exists( 'bloatwright_loader_verify' ) ) {
	/**
	 * Verify a profiling token against the stored signing key: HMAC, expiry and nonce.
	 * Self-contained on purpose: nothing from the plugin directory runs before this passes.
	 *
	 * @param string $token Token from the request header or cookie.
	 * @return array|null Payload or null.
	 */
	function bloatwright_loader_verify( string $token ): ?array {
		$key = get_option( 'bloatwright_signing_key' );
		if ( ! is_string( $key ) || strlen( $key ) < 32 || '' === $token || strlen( $token ) > 4096 || false === strpos( $token, '.' ) ) {
			return null;
		}
		list( $b64, $mac ) = explode( '.', $token, 2 );
		if ( ! hash_equals( hash_hmac( 'sha256', $b64, $key ), $mac ) ) {
			return null;
		}
		$json    = base64_decode( strtr( $b64, '-_', '+/' ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- URL-safe token transport, not obfuscation.
		$payload = is_string( $json ) ? json_decode( $json, true ) : null;
		if ( ! is_array( $payload ) || empty( $payload['exp'] ) || (int) $payload['exp'] < time() || empty( $payload['jti'] ) || ! is_string( $payload['jti'] ) ) {
			return null;
		}
		return $payload;
	}
}

if ( ! function_exists( 'bloatwright_loader_boot' ) ) {
	/**
	 * Only signed requests pay for anything beyond this header/cookie check.
	 */
	function bloatwright_loader_boot(): void {
		$plugin_dir = '{{BLOATWRIGHT_PLUGIN_DIR}}';
		if ( '{{' === substr( $plugin_dir, 0, 2 ) ) {
			return; // Unstamped template: never guess where the plugin lives.
		}
		$mode  = '';
		$token = '';
		if ( isset( $_SERVER['HTTP_X_BLOATWRIGHT_PROFILE'] ) ) {
			$mode  = 'auto';
			$token = sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_BLOATWRIGHT_PROFILE'] ) ); // Then verified by HMAC in bloatwright_loader_verify().
		} elseif ( isset( $_COOKIE['bloatwright_profile'] ) ) {
			$mode  = 'browse';
			$token = sanitize_text_field( wp_unslash( $_COOKIE['bloatwright_profile'] ) ); // Then verified by HMAC in bloatwright_loader_verify().
		}
		if ( '' === $token ) {
			return;
		}
		$payload = bloatwright_loader_verify( $token );
		if ( null === $payload || (string) ( $payload['mode'] ?? 'auto' ) !== $mode ) {
			return; // Header tokens must be auto-mode, cookie tokens browse-mode.
		}
		if ( 'browse' === $mode ) {
			// Browse mode: the URL is whatever the admin is visiting. Skip background requests and the profiler's own screen.
			$uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
			if ( preg_match( '#(/wp-json/|[?&]rest_route=|/admin-ajax\.php|/wp-cron\.php|/async-upload\.php|/media-upload\.php|/xmlrpc\.php|/wp-login\.php|[?&]page=bloatwright(&|$)|/heartbeat)#', $uri ) ) {
				return;
			}
			$host            = isset( $_SERVER['HTTP_HOST'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '';
			$payload['url']  = esc_url_raw( ( is_ssl() ? 'https://' : 'http://' ) . $host . $uri );
			$payload['pass'] = 1;
		}
		if ( ! is_readable( $plugin_dir . '/src/Autoloader.php' ) || ! is_readable( $plugin_dir . '/src/Profiler/Bootstrap.php' ) ) {
			return;
		}
		if ( ! defined( 'BLOATWRIGHT_DIR' ) ) {
			define( 'BLOATWRIGHT_DIR', $plugin_dir . '/' );
		}
		require_once $plugin_dir . '/src/Autoloader.php';
		\Bloatwright\Autoloader::register();
		if ( ! defined( 'BLOATWRIGHT_PROFILING' ) ) {
			define( 'BLOATWRIGHT_PROFILING', true );
		}
		\Bloatwright\Profiler\Bootstrap::start( $payload );
	}
}
bloatwright_loader_boot();