<?php
namespace Careback;

defined( 'ABSPATH' ) || exit;

/**
 * Bot-protection helpers for the public return form: a signed render-time token
 * (too fast / too old submits are rejected), the seams of an add-on's bot check,
 * and a temporary auto-block for a source that keeps failing the order lookup.
 *
 * All checks fail open when not configured or when an external service is
 * unreachable, so a real customer is never locked out by a misconfiguration.
 */
class Security {

	/**
	 * Filter: markup of an add-on's bot check in the returns form and the
	 * tracking form ( string $html, string $form, Settings $settings ), $form
	 * 'portal' or 'track'. The callback enqueues what the markup needs while it
	 * answers (the shortcode is rendering, so a footer script still prints). The
	 * markup goes through wp_kses_post() into a `.careback-bot-check` box; the
	 * scripts send the values of the named fields inside it as `bot_check`
	 * (name => value) and fire `careback:bot-check-reset` on the box after every
	 * answer. '' (no add-on): no box.
	 */
	const MARKUP_FILTER = 'careback_bot_check_markup';

	/**
	 * Filter: an add-on's verdict on a lookup of either form ( true|\WP_Error
	 * $verdict, array $fields, string $form, string $remote_ip, Settings
	 * $settings ), $fields the `bot_check` values the browser sent. A \WP_Error
	 * refuses the lookup: logged as `bot_check_failed`, counted as a failure,
	 * and on the returns form its message is the answer. True (no add-on) lets
	 * it through.
	 */
	const VERIFY_FILTER = 'careback_bot_check_verify';

	private $settings;

	public function __construct( Settings $settings ) {
		$this->settings = $settings;
	}

	/* --------------------------------------------------------------- *
	 * Signed time token
	 * --------------------------------------------------------------- */

	/** A signed "form rendered at" token handed to the browser. */
	public function time_token() {
		$ts  = time();
		$sig = Hash::hmac( 'careback-time:' . $ts );
		return $ts . ':' . $sig;
	}

	/** Verdicts of the timing check. */
	const TIME_OK    = 'ok';
	const TIME_BAD   = 'bad';
	const TIME_FAST  = 'fast';
	const TIME_STALE = 'stale';

	/**
	 * What the render-time token says about a submission.
	 *
	 * Three failures, and they do not mean the same thing. A forged or
	 * unreadable token, and a submit that arrives faster than a person can
	 * read the form, are both automated software. A token that is merely old
	 * is not: the commonest cause is a page cache handing the same rendered
	 * HTML — token and all — to every visitor for hours. Treating that as a
	 * bot was the plugin's worst failure mode, because the customer was
	 * refused with the same wording as a wrong order number, and the refusal
	 * counted towards the auto-block, so trying again made it worse.
	 *
	 * Since 0.66.0 the script asks for a fresh token when the portal loads,
	 * which takes the cache out of the picture entirely; this verdict is the
	 * safety net for the browser that could not.
	 *
	 * @param string $token Token as submitted.
	 * @return string One of the TIME_* constants.
	 */
	public function time_token_verdict( $token ) {
		if ( empty( $this->settings->get( 'enable_time_token' ) ) ) {
			return self::TIME_OK;
		}

		$parts = explode( ':', (string) $token, 2 );
		if ( 2 !== count( $parts ) ) {
			return self::TIME_BAD;
		}

		$ts       = (int) $parts[0];
		$expected = Hash::hmac( 'careback-time:' . $ts );
		if ( ! Hash::equals( $expected, $parts[1] ) ) {
			return self::TIME_BAD;
		}

		$age = time() - $ts;
		$min = (int) $this->settings->get( 'min_submit_seconds', 2 );
		$max = (int) $this->settings->get( 'max_submit_seconds', 86400 );

		// A token from the future is a clock that moved, not a customer. Read
		// as fast rather than as stale, which is the cautious side.
		if ( $age < $min ) {
			return self::TIME_FAST;
		}

		// Zero switches the ceiling off, for a shop that would rather never
		// refuse an old form than catch a replayed one.
		if ( $max > 0 && $age > $max ) {
			return self::TIME_STALE;
		}

		return self::TIME_OK;
	}

	/**
	 * True when the token is authentic and the submit is neither implausibly
	 * fast nor stale. When the check is disabled, everything passes.
	 *
	 * Kept as the plain yes/no reading of the verdict above.
	 */
	public function time_token_ok( $token ) {
		return self::TIME_OK === $this->time_token_verdict( $token );
	}

	/* --------------------------------------------------------------- *
	 * An add-on's bot check (optional)
	 * --------------------------------------------------------------- */

	/**
	 * The markup an add-on's bot check puts into a form (MARKUP_FILTER), boxed
	 * and through wp_kses_post(); '' when none does.
	 *
	 * @param string $form 'portal' or 'track'.
	 * @return string HTML.
	 */
	public function bot_check_markup( $form ) {
		$html = apply_filters( self::MARKUP_FILTER, '', (string) $form, $this->settings ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_bot_check_markup, the final prefix.
		$html = is_string( $html ) ? trim( $html ) : '';

		return '' === $html ? '' : '<div class="careback-bot-check">' . wp_kses_post( $html ) . '</div>';
	}

	/**
	 * An add-on's verdict on a lookup (VERIFY_FILTER): true, or the \WP_Error
	 * that refuses it.
	 *
	 * @param mixed  $fields    The `bot_check` values the browser sent.
	 * @param string $form      'portal' or 'track'.
	 * @param string $remote_ip The visitor's IP address.
	 * @return true|\WP_Error
	 */
	public function bot_check( $fields, $form, $remote_ip = '' ) {
		$clean = array();

		foreach ( array_slice( is_array( $fields ) ? $fields : array(), 0, 10, true ) as $name => $value ) {
			if ( is_string( $name ) && is_scalar( $value ) ) {
				$clean[ sanitize_key( $name ) ] = substr( sanitize_text_field( (string) $value ), 0, 4096 );
			}
		}

		$verdict = apply_filters( self::VERIFY_FILTER, true, $clean, (string) $form, (string) $remote_ip, $this->settings ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_bot_check_verify, the final prefix.

		return is_wp_error( $verdict ) ? $verdict : true;
	}

	/* --------------------------------------------------------------- *
	 * Coarse country of origin (optional)
	 * --------------------------------------------------------------- */

	/**
	 * Filter: the two-letter country the current request comes from, logged
	 * with the security events ( string $country, Settings $settings ).
	 */
	const COUNTRY_FILTER = 'careback_request_country';

	/**
	 * Two-letter country code for the current request, or '' when nothing
	 * supplies one. The free part looks up no country itself: an add-on answers
	 * through `careback_request_country`, and whatever it answers is kept only
	 * when it is a two-letter code.
	 */
	public function country() {
		/**
		 * Filters the country of the current request. See api/data.md.
		 *
		 * @param string   $country  Two-letter code; '' for none.
		 * @param Settings $settings Plugin settings.
		 */
		$country = apply_filters( self::COUNTRY_FILTER, '', $this->settings ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- careback_request_country, the final prefix.

		return is_string( $country ) && 1 === preg_match( '/^[A-Z]{2}$/', $country ) ? $country : '';
	}

	/* --------------------------------------------------------------- *
	 * Temporary auto-block for a repeatedly-failing source
	 * --------------------------------------------------------------- */

	private function ban_key( $ip_hash ) {
		return Rate_Limiter::BAN_PREFIX . substr( sanitize_key( $ip_hash ), 0, 40 );
	}

	public function is_banned( $ip_hash ) {
		if ( '' === (string) $ip_hash ) {
			return false;
		}
		return (bool) get_transient( $this->ban_key( $ip_hash ) );
	}

	/**
	 * Called after a failed lookup. When a source crosses the configured
	 * threshold of failures within the throttling window, block it for the
	 * configured duration. Returns true if a new block was placed.
	 */
	public function register_failure( $ip_hash ) {
		$threshold = (int) $this->settings->get( 'ban_threshold', 10 );
		if ( $threshold <= 0 || '' === (string) $ip_hash ) {
			return false;
		}

		$window = (int) $this->settings->get( 'lookup_window_minutes', 15 ) * MINUTE_IN_SECONDS;
		$key    = 'careback_fail_' . substr( sanitize_key( $ip_hash ), 0, 40 );
		$count  = (int) get_transient( $key ) + 1;
		set_transient( $key, $count, $window );
		Rate_Limiter::remember( $key );

		if ( $count >= $threshold ) {
			$minutes = max( 1, (int) $this->settings->get( 'ban_minutes', 60 ) );
			set_transient( $this->ban_key( $ip_hash ), 1, $minutes * MINUTE_IN_SECONDS );
			Rate_Limiter::remember( $this->ban_key( $ip_hash ) );
			delete_transient( $key );
			return true;
		}

		return false;
	}
}