<?php
/**
 * Country-based access control.
 *
 * CSDT_Geo has resolved a visitor's country for a long time, free of charge, from
 * Cloudflare's CF-IPCountry header with a DB-IP Lite fallback. Until now that was
 * used only to colour the attack map. This turns it into a decision.
 *
 * The whole risk of this feature is locking the owner out of their own site, and it
 * is a real risk rather than a theoretical one: unlike an IP block, a country block
 * can be tripped by travelling, by a VPN exit, or by a mobile network routing
 * through another country. Every guard below exists for that reason, and the
 * defaults are chosen so that a careless click cannot cause an outage:
 *
 *   - Off by default.
 *   - An unresolved country is never blocked. Fail open, always.
 *   - Administrators are never refused, same capability bypass as the IP blocklist.
 *   - The country the administrator is browsing from cannot be added to a blocklist,
 *     and cannot be left out of an allowlist. The save is refused, not warned about.
 *   - Allowlist mode additionally refuses to save an empty list, which would block
 *     the entire internet.
 *   - WP-CLI and cron are exempt, as is the site's own egress.
 *
 * @package CSDT_DevTools
 * @since   1.10.458
 */

defined( 'ABSPATH' ) || exit;

class CSDT_Geo_Block {

	/** Master switch. Off by default: this is consequential and site-specific. */
	const OPTION_ENABLED = 'csdt_geoblock_enabled';

	/**
	 * 'block' refuses the listed countries, 'allow' refuses everything except them.
	 * Allowlist is the more dangerous of the two and is guarded harder.
	 */
	const OPTION_MODE = 'csdt_geoblock_mode';

	/** Comma-separated ISO 3166-1 alpha-2 codes. */
	const OPTION_COUNTRIES = 'csdt_geoblock_countries';

	/** Rolling count of refusals per country, for the panel. */
	const OPTION_STATS = 'csdt_geoblock_stats';

	/** Only the login and admin surfaces, rather than the whole site. */
	const OPTION_SCOPE = 'csdt_geoblock_scope';

	/** Cap on the stats option so it cannot grow without bound. */
	const MAX_STATS = 250;

	/**
	 * Whether this request should be refused on country grounds.
	 *
	 * Returns false on every uncertainty. That is not defensive habit, it is the
	 * requirement: a geo lookup that fails must never take a site off the air.
	 *
	 * @param string $ip Client address, already resolved.
	 * @return string Empty string to allow, otherwise the country code that matched.
	 */
	public static function refuse_reason( string $ip ): string {
		if ( CSDT_Options::get( self::OPTION_ENABLED ) !== '1' ) {
			return '';
		}
		if ( '' === $ip || ! filter_var( $ip, FILTER_VALIDATE_IP ) ) {
			return '';
		}
		// A private or reserved address is an unresolved proxy hop, exactly as in
		// CSDT_Auto_Block::is_exempt(). Refusing it would blackhole every visitor.
		if ( false === filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) ) {
			return '';
		}
		if ( class_exists( 'CSDT_Login' ) && in_array( $ip, CSDT_Login::own_public_ips(), true ) ) {
			return '';
		}

		$country = class_exists( 'CSDT_Geo' ) ? strtoupper( CSDT_Geo::get_country( $ip ) ) : '';
		if ( 2 !== strlen( $country ) ) {
			// Could not tell where this is from, so it is not refused. An
			// unidentifiable visitor is a visitor, not a threat.
			return '';
		}

		$list = self::countries();
		$mode = self::mode();

		if ( 'allow' === $mode ) {
			// An empty allowlist would refuse everyone. ajax_save() will not store
			// one, but a hand-edited option must not become an outage either.
			if ( empty( $list ) ) {
				return '';
			}
			return in_array( $country, $list, true ) ? '' : $country;
		}

		return in_array( $country, $list, true ) ? $country : '';
	}

	/** Normalised country list from the stored option. */
	public static function countries(): array {
		return self::parse_codes( (string) get_option( self::OPTION_COUNTRIES, '' ) );
	}

	/**
	 * Parses a user-entered list into ISO 3166-1 alpha-2 codes.
	 *
	 * Splits on real separators only. Splitting on "not a letter" would treat the
	 * digit in "xx1" as a delimiter and quietly accept "XX", turning a typo into a
	 * stored rule instead of discarding it.
	 */
	public static function parse_codes( string $raw ): array {
		$out = array();
		foreach ( preg_split( '/[\s,;|]+/', $raw, -1, PREG_SPLIT_NO_EMPTY ) as $token ) {
			if ( 1 === preg_match( '/^[A-Za-z]{2}$/', $token ) ) {
				$out[] = strtoupper( $token );
			}
		}
		return array_values( array_unique( $out ) );
	}

	/**
	 * Why this configuration must not be saved, or '' when it is safe.
	 *
	 * Pure and side-effect free, so the lockout guards can be tested directly rather
	 * than through an AJAX handler whose own try/catch would swallow the result.
	 * These are refusals, not warnings: a warning beside a Save button reads as
	 * decoration, and the only reliable guard against a self-inflicted outage is to
	 * decline the save and say why.
	 *
	 * @param bool   $enabled Whether the feature is being switched on.
	 * @param string $mode    'block' or 'allow'.
	 * @param array  $codes   Parsed country codes.
	 * @param string $mine    The administrator's own country, '' if unknown.
	 */
	public static function validate( bool $enabled, string $mode, array $codes, string $mine ): string {
		// A disabled configuration is always safe to store, and must be: refusing it
		// would make the settings uneditable once they were in a risky state.
		if ( ! $enabled ) {
			return '';
		}
		if ( 'allow' === $mode && empty( $codes ) ) {
			return 'An allow list with no countries in it would refuse every visitor, including you. Add at least your own country first.';
		}
		if ( '' === $mine ) {
			return 'Your own country cannot be determined right now, so this cannot be enabled safely: there would be no way to check that you are not locking yourself out. Fix the Visitor IP Source panel, or download the GeoIP database, first.';
		}
		if ( 'block' === $mode && in_array( $mine, $codes, true ) ) {
			return sprintf( 'You are browsing from %1$s, so blocking %1$s would lock you out the moment your session ends. Remove it from the list.', $mine );
		}
		if ( 'allow' === $mode && ! in_array( $mine, $codes, true ) ) {
			return sprintf( 'You are browsing from %1$s. An allow list that leaves %1$s out would lock you out the moment your session ends. Add it.', $mine );
		}
		return '';
	}

	/** 'block' or 'allow'. */
	public static function mode(): string {
		return 'allow' === get_option( self::OPTION_MODE, 'block' ) ? 'allow' : 'block';
	}

	/** Whether enforcement covers the whole site or only login and admin. */
	public static function scope(): string {
		return 'site' === get_option( self::OPTION_SCOPE, 'login' ) ? 'site' : 'login';
	}

	/**
	 * Records a refusal, so the panel can show the feature working rather than the
	 * owner having to take it on trust.
	 */
	public static function record_refusal( string $country ): void {
		$stats = get_option( self::OPTION_STATS, array() );
		if ( ! is_array( $stats ) ) {
			$stats = array();
		}
		$today = gmdate( 'Y-m-d' );
		if ( ! isset( $stats[ $today ] ) || ! is_array( $stats[ $today ] ) ) {
			$stats[ $today ] = array();
		}
		$stats[ $today ][ $country ] = (int) ( $stats[ $today ][ $country ] ?? 0 ) + 1;
		// Keep the last 14 days only.
		krsort( $stats );
		$stats = array_slice( $stats, 0, 14, true );
		update_option( self::OPTION_STATS, $stats, false );
	}

	/** Refusals in the last 7 days, by country, highest first. */
	public static function recent_stats(): array {
		$stats = get_option( self::OPTION_STATS, array() );
		if ( ! is_array( $stats ) ) {
			return array();
		}
		$cutoff = gmdate( 'Y-m-d', time() - 7 * DAY_IN_SECONDS );
		$totals = array();
		foreach ( $stats as $day => $rows ) {
			if ( (string) $day < $cutoff || ! is_array( $rows ) ) {
				continue;
			}
			foreach ( $rows as $cc => $n ) {
				$totals[ $cc ] = (int) ( $totals[ $cc ] ?? 0 ) + (int) $n;
			}
		}
		arsort( $totals );
		return $totals;
	}

	/**
	 * Saves the settings, refusing any combination that would lock the owner out.
	 *
	 * The refusals are deliberate and are NOT warnings. A warning beside a Save
	 * button is read as decoration; the only reliable guard against a self-inflicted
	 * outage is to decline the save and say why.
	 */
	public static function ajax_save(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		try {
			$raw_enabled = isset( $_POST['enabled'] ) ? sanitize_text_field( wp_unslash( $_POST['enabled'] ) ) : '';
			$enabled     = ( '' !== $raw_enabled && '0' !== $raw_enabled );
			$mode    = 'allow' === sanitize_text_field( wp_unslash( $_POST['mode'] ?? 'block' ) ) ? 'allow' : 'block';
			$scope   = 'site' === sanitize_text_field( wp_unslash( $_POST['scope'] ?? 'login' ) ) ? 'site' : 'login';
			$codes   = self::parse_codes( sanitize_text_field( wp_unslash( $_POST['countries'] ?? '' ) ) );
			$mine    = self::admin_country();
		} catch ( \Throwable $e ) {
			CSDT_Ajax::fail( $e, __METHOD__ );
			return;
		}

		// Outside the try on purpose. A refusal here is the guard working as designed,
		// and wrapping it would let the catch-all rewrite a precise explanation into
		// "Internal error", which is exactly what happened the first time this ran.
		$refusal = self::validate( $enabled, $mode, $codes, $mine );
		if ( '' !== $refusal ) {
			wp_send_json_error( $refusal );
			return;
		}

		update_option( self::OPTION_ENABLED, $enabled ? '1' : '0' );
		update_option( self::OPTION_MODE, $mode );
		update_option( self::OPTION_SCOPE, $scope );
		update_option( self::OPTION_COUNTRIES, implode( ', ', $codes ) );

			wp_send_json_success(
				array(
					'msg'       => $enabled ? 'Saved and active.' : 'Saved. Country rules are off.',
					'countries' => implode( ', ', $codes ),
				)
			);
	}

	/**
	 * Refuses the request when country rules say so. Hooked to `plugins_loaded`
	 * priority 1, alongside the IP blocklist, so a refusal never reaches another
	 * plugin's startup code.
	 *
	 * Reuses CSDT_Login::request_is_site_admin() rather than reimplementing it: two
	 * copies of a lockout guard is two places for it to drift apart, and this one
	 * carries the same consequence.
	 */
	public static function enforce(): void {
		try {
			// Neither carries a meaningful client address, and refusing cron would
			// break every scheduled task.
			if ( ( defined( 'WP_CLI' ) && WP_CLI ) || ( defined( 'DOING_CRON' ) && DOING_CRON ) ) {
				return;
			}
			// One autoloaded read on the common path, so a site not using this pays
			// almost nothing for it.
			if ( CSDT_Options::get( self::OPTION_ENABLED ) !== '1' ) {
				return;
			}
			if ( 'site' !== self::scope() && ! self::is_login_or_admin_request() ) {
				return;
			}

			$reason = self::refuse_reason( CSDT_DevTools::get_client_ip() );
			if ( '' === $reason ) {
				return;
			}

			// Never refuse an administrator. Country is far easier to trip
			// accidentally than an IP: travel, a VPN exit, or a mobile network
			// routing through another country all do it.
			if ( class_exists( 'CSDT_Login' ) && CSDT_Login::request_is_site_admin() ) {
				return;
			}

			self::record_refusal( $reason );
			// Set here as well: core's XML-RPC die handler never sets a status, so xmlrpc.php would answer 200.
			status_header( 403 );
			wp_die( esc_html__( 'Access denied.', 'cloudscale-cyber-devtools' ), '', array( 'response' => 403 ) );
		} catch ( \Throwable $e ) {
			// A geo lookup problem must never be fatal.
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
		}
	}

	/**
	 * Whether this request targets the login form or the admin.
	 *
	 * is_admin() covers wp-admin, admin-ajax.php and admin-post.php. wp-login.php
	 * reaches none of those, so it is matched on the script name, and the hidden
	 * login slug is matched by the constant CSDT_Login sets when it serves it.
	 */
	public static function is_login_or_admin_request(): bool {
		if ( is_admin() ) {
			return true;
		}
		if ( defined( 'CSDT_LOGIN_CUSTOM_SLUG' ) && CSDT_LOGIN_CUSTOM_SLUG ) {
			return true;
		}
		if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) {
			return true;
		}
		$script = isset( $_SERVER['SCRIPT_NAME'] ) ? basename( sanitize_text_field( wp_unslash( $_SERVER['SCRIPT_NAME'] ) ) ) : '';
		return in_array( $script, array( 'wp-login.php', 'xmlrpc.php' ), true );
	}

	/**
	 * Renders the Country Rules panel on the Login Security tab.
	 *
	 * States the lockout risk in the panel rather than burying it in help text,
	 * because the panel is where the decision is made.
	 */
	public static function render_panel(): void {
		$enabled = CSDT_Options::get( self::OPTION_ENABLED ) === '1';
		$mode    = self::mode();
		$scope   = self::scope();
		$codes   = self::countries();
		$mine    = self::admin_country();
		$stats   = self::recent_stats();
		?>
		<div class="cs-panel" id="cs-panel-geoblock">
			<div class="cs-section-header" style="background:linear-gradient(90deg,#134e4a 0%,#0f766e 100%);border-left:3px solid #2dd4bf;">
				<span>🌍 <?php esc_html_e( 'Country Rules', 'cloudscale-cyber-devtools' ); ?></span>
				<span class="cs-header-hint"><?php esc_html_e( 'Refuse, or only allow, visitors by country', 'cloudscale-cyber-devtools' ); ?></span>
				<?php
				CSDT_DevTools::render_explain_btn(
					'geoblock',
					'Country Rules',
					array(
						array(
							'name' => 'Where the country comes from',
							'rec'  => 'How it works',
							'html' => 'Cloudflare tells us the country on every request in the <code>CF-IPCountry</code> header, at no cost and with no lookup. When that header is absent the downloaded DB-IP Lite database is used instead.<br><br>If neither can identify a visitor, the visitor is <strong>allowed</strong>. A location that cannot be determined is not treated as suspicious, because refusing on a failed lookup is how a geo rule takes a site offline.',
						),
						array(
							'name' => 'The lockout risk, honestly',
							'rec'  => 'Read this first',
							'html' => 'A country rule is much easier to trip by accident than an IP block. Travelling, a VPN exit in another country, or a mobile network routing through a neighbouring one will all change your apparent country.<br><br>Three guards are in place. You are never refused while signed in as an administrator. The country you are browsing from now cannot be added to a block list, and cannot be left out of an allow list, and the save is <strong>refused</strong> rather than merely warned about. And an allow list with nothing in it will not save at all, because it would refuse the entire internet.<br><br>What none of that covers: if you are signed out and travelling, and your temporary country is blocked, you will not be able to reach the login page. Keep <strong>Login and admin only</strong> scope and a short list, or use an allow list containing every country you actually travel to.',
						),
						array(
							'name' => 'Block list or allow list',
							'rec'  => 'Choose carefully',
							'html' => '<strong>Block list</strong> refuses the countries you name and allows everyone else. This is the safer choice and the default: a mistake affects one country.<br><br><strong>Allow list</strong> refuses everyone except the countries you name. Much stronger, and appropriate for a site serving one region, but a mistake affects the whole world. Only use it if you know where your genuine visitors are.',
						),
						array(
							'name' => 'Scope',
							'rec'  => 'Recommended',
							'html' => '<strong>Login and admin only</strong> covers <code>wp-login.php</code>, your hidden login page, <code>xmlrpc.php</code>, <code>admin-ajax.php</code>, <code>admin-post.php</code> and everything under <code>/wp-admin/</code>. Your public pages stay reachable from everywhere, so search engines and readers are unaffected. This blocks the attacks without touching your audience, and is the recommended setting.<br><br><strong>Whole site</strong> refuses every request, including public pages. Use it only when you are certain no genuine reader or crawler comes from those countries.',
						),
						array(
							'name' => 'What it does not do',
							'rec'  => 'Honest limits',
							'html' => 'A country rule is a filter, not a wall. A determined attacker uses a VPN or a proxy in a permitted country and the rule sees that country instead. It is worth having because it removes a large amount of automated noise cheaply, not because it stops a targeted attacker.<br><br>It also does not apply to WP-CLI or scheduled tasks, and never refuses your own server\'s address.',
						),
					)
				);
				?>
			</div>
			<div class="cs-panel-body">

				<?php if ( '' === $mine ) : ?>
				<div style="background:#fffbeb;border-left:4px solid #d97706;padding:12px 16px;border-radius:0 6px 6px 0;margin:0 0 16px;font-size:13px;color:#78350f;">
					<strong><?php esc_html_e( 'Your own country cannot be determined.', 'cloudscale-cyber-devtools' ); ?></strong>
					<?php esc_html_e( 'Country rules cannot be switched on until it can, because there would be no way to check that you are not locking yourself out. Fix the Visitor IP Source panel, or download the GeoIP database, first.', 'cloudscale-cyber-devtools' ); ?>
				</div>
				<?php else : ?>
				<p style="font-size:13px;color:#374151;margin:0 0 14px;line-height:1.6;max-width:760px;">
					<?php
					printf(
						/* translators: %s = two-letter country code the admin is browsing from. */
						esc_html__( 'You are browsing from %s. That country is protected: it cannot be added to a block list, and cannot be left out of an allow list.', 'cloudscale-cyber-devtools' ),
						'<strong>' . esc_html( $mine ) . '</strong>'
					);
					?>
				</p>
				<?php endif; ?>

				<?php if ( $enabled && ! empty( $stats ) ) : ?>
				<div style="background:#f0fdfa;border-left:4px solid #0f766e;padding:10px 14px;border-radius:0 6px 6px 0;margin:0 0 16px;font-size:13px;color:#134e4a;">
					<strong><?php esc_html_e( 'Refused in the last 7 days:', 'cloudscale-cyber-devtools' ); ?></strong>
					<?php
					$parts = array();
					foreach ( array_slice( $stats, 0, 10, true ) as $cc => $n ) {
						$parts[] = esc_html( $cc ) . ' (' . (int) $n . ')';
					}
					echo esc_html( implode( ', ', $parts ) );
					?>
				</div>
				<?php elseif ( $enabled ) : ?>
				<div style="background:#f0fdfa;border-left:4px solid #0f766e;padding:10px 14px;border-radius:0 6px 6px 0;margin:0 0 16px;font-size:13px;color:#134e4a;">
					<?php esc_html_e( 'Active. Nothing has been refused yet, which simply means no visitor from those countries has arrived.', 'cloudscale-cyber-devtools' ); ?>
				</div>
				<?php endif; ?>

				<div class="cs-field-row">
					<div class="cs-field" style="flex:1 1 100%;">
						<label style="display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:#1e293b;cursor:pointer;">
							<input type="checkbox" id="csdt-gb-enabled" <?php checked( $enabled ); ?>>
							<?php esc_html_e( 'Apply country rules', 'cloudscale-cyber-devtools' ); ?>
						</label>
					</div>
				</div>

				<div class="cs-field-row">
					<div class="cs-field">
						<label for="csdt-gb-mode"><?php esc_html_e( 'Rule type', 'cloudscale-cyber-devtools' ); ?></label>
						<select id="csdt-gb-mode">
							<option value="block" <?php selected( 'block', $mode ); ?>><?php esc_html_e( 'Block list, refuse these countries', 'cloudscale-cyber-devtools' ); ?></option>
							<option value="allow" <?php selected( 'allow', $mode ); ?>><?php esc_html_e( 'Allow list, refuse everywhere else', 'cloudscale-cyber-devtools' ); ?></option>
						</select>
					</div>
					<div class="cs-field">
						<label for="csdt-gb-scope"><?php esc_html_e( 'Applies to', 'cloudscale-cyber-devtools' ); ?></label>
						<select id="csdt-gb-scope">
							<option value="login" <?php selected( 'login', $scope ); ?>><?php esc_html_e( 'Login and admin only, recommended', 'cloudscale-cyber-devtools' ); ?></option>
							<option value="site" <?php selected( 'site', $scope ); ?>><?php esc_html_e( 'The whole site, including public pages', 'cloudscale-cyber-devtools' ); ?></option>
						</select>
					</div>
				</div>

				<div class="cs-field-row">
					<div class="cs-field" style="flex:1 1 100%;">
						<?php
						// The label follows the Rule type above, because this one field means
						// opposite things in the two modes: in a block list these are the
						// countries refused, in an allow list they are the only ones admitted.
						// A fixed "Blocked Countries" is simply wrong half the time, and wrong
						// in the direction that gets somebody locked out.
						//
						// Both strings are carried as data attributes so cs-login.js can swap
						// them the moment the dropdown changes, without another request and
						// without the translation living in JavaScript.
						$csdt_gb_label = 'allow' === $mode
							? __( 'Allowed Countries', 'cloudscale-cyber-devtools' )
							: __( 'Blocked Countries', 'cloudscale-cyber-devtools' );
						?>
						<label for="csdt-gb-country-search" id="csdt-gb-country-label"
							data-label-block="<?php echo esc_attr__( 'Blocked Countries', 'cloudscale-cyber-devtools' ); ?>"
							data-label-allow="<?php echo esc_attr__( 'Allowed Countries', 'cloudscale-cyber-devtools' ); ?>"><?php echo esc_html( $csdt_gb_label ); ?></label>
						<?php
						// The real value the Save button reads (assets/cs-login.js) is still this
						// field, untouched, search/chips below only ever write ISO codes into it,
						// so nobody typing from memory has to get a two-letter code right, but the
						// server-side save logic needed no changes at all.
						?>
						<input type="hidden" id="csdt-gb-countries" value="<?php echo esc_attr( implode( ', ', $codes ) ); ?>">
						<div id="csdt-gb-country-chips" style="display:flex;flex-wrap:wrap;gap:6px;margin-bottom:8px;<?php echo esc_attr( empty( $codes ) ? 'display:none;' : '' ); ?>">
							<?php foreach ( $codes as $code ) : ?>
							<span class="csdt-gb-chip" data-code="<?php echo esc_attr( $code ); ?>" style="display:inline-flex;align-items:center;gap:6px;background:#f0fdfa;border:1px solid #99f6e4;border-radius:14px;padding:3px 6px 3px 10px;font-size:12px;color:#134e4a;">
								<?php echo esc_html( CSDT_Geo::country_name( $code ) . ' (' . $code . ')' ); ?>
								<button type="button" class="csdt-gb-chip-remove" data-code="<?php echo esc_attr( $code ); ?>" aria-label="<?php echo esc_attr__( 'Remove', 'cloudscale-cyber-devtools' ); ?>" style="border:none;background:#ccfbf1;color:#134e4a;border-radius:50%;width:16px;height:16px;line-height:14px;cursor:pointer;font-size:11px;padding:0;">✕</button>
							</span>
							<?php endforeach; ?>
						</div>
						<div style="position:relative;">
							<input type="text" id="csdt-gb-country-search" autocomplete="off"
								placeholder="<?php echo esc_attr__( 'Search by country name or code…', 'cloudscale-cyber-devtools' ); ?>" style="width:100%;">
							<div id="csdt-gb-country-suggestions" style="display:none;position:absolute;z-index:10;left:0;right:0;top:100%;background:#fff;border:1px solid #cbd5e1;border-top:none;border-radius:0 0 6px 6px;box-shadow:0 4px 10px rgba(0,0,0,.08);max-height:220px;overflow-y:auto;"></div>
						</div>
						<span style="font-size:12px;color:#64748b;display:block;margin-top:6px;line-height:1.5;">
							<?php esc_html_e( 'Type a country name or its two-letter code, then pick it from the list, no code to remember.', 'cloudscale-cyber-devtools' ); ?>
						</span>
					</div>
				</div>

				<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap;">
					<button type="button" class="cs-btn-primary" id="csdt-gb-save">💾 <?php esc_html_e( 'Save Country Rules', 'cloudscale-cyber-devtools' ); ?></button>
					<span id="csdt-gb-msg" style="font-size:12px;"></span>
				</div>

			</div>
		</div>
		<?php
	}

	/** The country the current administrator appears to be browsing from. */
	public static function admin_country(): string {
		$ip = CSDT_DevTools::get_client_ip();
		if ( '' === $ip || ! class_exists( 'CSDT_Geo' ) ) {
			return '';
		}
		$cc = strtoupper( CSDT_Geo::get_country( $ip ) );
		return 2 === strlen( $cc ) ? $cc : '';
	}
}