<?php
/**
 * Live Traffic: a feed of the requests that reach WordPress, not only the ones a rule matched.
 *
 * WHY THIS EXISTS
 * ---------------
 * The firewall log answers "what did a rule catch". It cannot answer "what is hitting this site
 * right now", which is the first question during an incident: is that spike one crawler, a
 * scanner walking /wp-content/plugins/, or real readers? Recent Matches is silent about every
 * request no rule matched, which is nearly all of them.
 *
 * COST IS THE DESIGN PROBLEM
 * --------------------------
 * This writes on every uncached request, paid for by the visitor. So:
 *   - it is OFF by default (csdt_live_traffic_enabled = '0');
 *   - one INSERT per request on `shutdown`, after the response has been produced, with no read
 *     before it (CSDT_Storage::record_traffic());
 *   - a one-day retention and a 20,000 row ceiling, the ceiling enforced from the write path by a
 *     primary-key range delete on one write in a hundred, so it holds even when cron has stopped;
 *   - the obvious noise is never written at all: WP-CLI, cron, the admin heartbeat, this panel's
 *     own poll, the site's REST calls to itself, and static files that happened to reach PHP.
 *
 * PRIVACY
 * -------
 * The same line the firewall log draws, for the same reason: the path is stored with its query
 * string cut off, and the query string, the body, cookies and the referrer are never stored. A
 * query string routinely carries a reset token, a session id or an email address, and a security
 * feature that collects them is a liability that outlives whatever it was watching. The table has
 * no column any of them could go in. Signed-in requests store the user id, never the login.
 *
 * FAILS OPEN, AND SILENT
 * ----------------------
 * record() runs on `shutdown`, after the page has been sent. Anything it printed would be appended
 * to someone's response (a JSON body, a feed, a file download). Nothing in it echoes, and the one
 * thing that could, $wpdb printing a database error while WP_DEBUG shows errors, is switched off
 * for its statements and restored afterwards. Not an output buffer: shipped code opens none
 * (tests/output-buffer-ratchet-test.php), and silencing the only source is the better fix anyway.
 * Every Throwable is caught. A traffic log that breaks the response it is logging is worse than
 * no log.
 *
 * @package CSDT_DevTools
 */

defined( 'ABSPATH' ) || exit;

class CSDT_Live_Traffic {

	/** On/off. Autoloaded: it is read on every request, and a non-autoloaded read is a query. */
	const OPTION_ENABLED = 'csdt_live_traffic_enabled';

	/** The panel's poll. Never recorded, or the feed would fill with the admin watching it. */
	const POLL_ACTION = 'csdt_live_traffic_poll';

	/** The panel's save. */
	const SAVE_ACTION = 'csdt_live_traffic_save';

	/** Rows per poll. */
	const POLL_LIMIT = 100;

	/**
	 * User agents that identify a program rather than a person.
	 *
	 * Deliberately broad. A false "crawler" on a human costs a mislabelled row; a missed one makes
	 * the Humans filter lie about how many readers the site has. Generic words first (bot, crawl,
	 * spider), then HTTP libraries and headless browsers that announce themselves, then the named
	 * crawlers and uptime monitors whose UAs contain none of the generic words.
	 */
	const CRAWLER_PATTERN = '/bot|crawl|spider|slurp|scrap|curl\/|wget\/|python|go-http-client|okhttp|java\/|libwww|httpclient|headless|phantomjs|axios\/|node-fetch|guzzle|facebookexternalhit|mediapartners|lighthouse|pingdom|uptime|statuscake|monitor|whatsapp|semrush|ahrefs|yandex|baiduspider|bytespider|petalsearch|feedfetcher|wordpress\//i';

	/**
	 * Extensions of files the web server normally serves without PHP.
	 *
	 * When one reaches PHP it is a 404 routed through WordPress, or a rewrite, and either way a row
	 * per stylesheet and image would bury the page views the feed is for.
	 */
	const ASSET_PATTERN = '/\.(?:css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|bmp|woff2?|ttf|otf|eot|mp4|webm|mp3|ogg|wav)$/i';

	// ── Recording ────────────────────────────────────────────────────────

	/**
	 * Whether recording is switched on.
	 *
	 * @return bool
	 */
	public static function is_enabled(): bool {
		return '1' === (string) CSDT_Options::get( self::OPTION_ENABLED );
	}

	/**
	 * Records the current request. Hooked on `shutdown`.
	 *
	 * @return void
	 */
	public static function record(): void {
		// The option first and alone: while the feature is off, which is the default, this is the
		// entire cost, one read of an autoloaded option already in memory.
		try {
			if ( ! self::is_enabled() ) {
				return;
			}
		} catch ( \Throwable $e ) {
			return;
		}

		$wpdb_errors = null;
		try {
			global $wpdb;
			if ( is_object( $wpdb ) && method_exists( $wpdb, 'hide_errors' ) ) {
				$wpdb_errors = $wpdb->hide_errors();
			}
			$ctx = self::context();
			if ( '' === self::skip_reason( $ctx ) ) {
				CSDT_Storage::record_traffic( self::build_row( $ctx ) );
			}
		} catch ( \Throwable $e ) {
			if ( class_exists( 'CSDT_Monitor' ) ) {
				CSDT_Monitor::log_exception( $e, __METHOD__ );
			}
		} finally {
			global $wpdb;
			if ( null !== $wpdb_errors && is_object( $wpdb ) && method_exists( $wpdb, 'show_errors' ) ) {
				$wpdb->show_errors( (bool) $wpdb_errors );
			}
		}
	}

	/**
	 * Everything the skip rules and the row need, read from the environment once.
	 *
	 * Separate from skip_reason() so the rules can be tested without redefining constants, which
	 * PHP cannot do within one process.
	 *
	 * @return array<string,mixed>
	 */
	public static function context(): array {
		$ajax_action = null;
		if ( function_exists( 'wp_doing_ajax' ) && wp_doing_ajax() ) {
			$ajax_action = (string) CSDT_Request::routing_key( 'action', 'request' );
		}
		$ip      = class_exists( 'CSDT_DevTools' ) ? (string) CSDT_DevTools::get_client_ip() : '';
		$is_rest = defined( 'REST_REQUEST' ) && REST_REQUEST;
		$status  = http_response_code();

		// The user id only when a login cookie is present at all. Validating a cookie can cost a
		// query, and anonymous traffic, nearly all of it, has no cookie to validate.
		$user_id = 0;
		if ( CSDT_Request::has_login_cookie() && function_exists( 'get_current_user_id' ) ) {
			$user_id = (int) get_current_user_id();
		}

		// Every read below is on `shutdown`, after wp_magic_quotes(), so the values are unslashed.
		return array(
			'cli'         => defined( 'WP_CLI' ) && WP_CLI,
			'cron'        => ( defined( 'DOING_CRON' ) && DOING_CRON ) || ( function_exists( 'wp_doing_cron' ) && wp_doing_cron() ),
			'ajax_action' => $ajax_action,
			'rest'        => $is_rest,
			'own'         => $is_rest ? self::is_own_address( $ip ) : false,
			// The site's own signed loopback (cron spawn, Upgrade Verification). Header first, so
			// a visitor without it costs one isset.
			'self'        => class_exists( 'CSDT_Auto_Block' ) && CSDT_Auto_Block::is_signed_self_request(),
			'ip'          => $ip,
			'method'      => CSDT_Request::server( 'REQUEST_METHOD', 16 ),
			'path'        => CSDT_Storage::truncate_path( CSDT_Request::server( 'REQUEST_URI', 8192 ) ),
			'status'      => false === $status ? 200 : (int) $status,
			'user_agent'  => CSDT_Request::server( 'HTTP_USER_AGENT', 1024 ),
			'country'     => CSDT_Storage::country_from_header(),
			'user_id'     => $user_id,
		);
	}

	/**
	 * Why this request is not recorded, or '' when it is.
	 *
	 * Returns a reason rather than a bool so a test can tell WHICH rule fired: a skip that
	 * happens for the wrong reason is a rule that will stop working the moment the right one
	 * changes.
	 *
	 * @param array<string,mixed> $ctx From context().
	 * @return string
	 */
	public static function skip_reason( array $ctx ): string {
		if ( ! empty( $ctx['cli'] ) ) {
			return 'cli';
		}
		if ( ! empty( $ctx['cron'] ) ) {
			return 'cron';
		}
		$action = isset( $ctx['ajax_action'] ) ? (string) $ctx['ajax_action'] : '';
		if ( 'heartbeat' === $action ) {
			return 'heartbeat';
		}
		if ( self::POLL_ACTION === $action ) {
			return 'own-poll';
		}
		if ( ! empty( $ctx['rest'] ) && ! empty( $ctx['own'] ) ) {
			return 'self-rest';
		}
		if ( ! empty( $ctx['self'] ) ) {
			return 'self-signed';
		}
		if ( 1 === preg_match( self::ASSET_PATTERN, (string) ( $ctx['path'] ?? '' ) ) ) {
			return 'asset';
		}
		if ( '' === (string) ( $ctx['ip'] ?? '' ) ) {
			return 'no-address';
		}
		return '';
	}

	/**
	 * The row to store, from a context.
	 *
	 * @param array<string,mixed> $ctx From context().
	 * @return array<string,mixed>
	 */
	public static function build_row( array $ctx ): array {
		$ua = (string) ( $ctx['user_agent'] ?? '' );
		return array(
			'ip'         => (string) ( $ctx['ip'] ?? '' ),
			'country'    => (string) ( $ctx['country'] ?? '' ),
			'method'     => (string) ( $ctx['method'] ?? '' ),
			'path'       => CSDT_Storage::truncate_path( (string) ( $ctx['path'] ?? '' ) ),
			'status'     => (int) ( $ctx['status'] ?? 0 ),
			'user_agent' => (string) substr( $ua, 0, CSDT_Storage::TRAFFIC_UA_MAX ),
			'user_id'    => (int) ( $ctx['user_id'] ?? 0 ),
			'kind'       => self::classify( (int) ( $ctx['status'] ?? 0 ), $ua ),
		);
	}

	/**
	 * human, crawler or blocked.
	 *
	 * Blocked first: a refused request is the most important thing in the feed whoever sent it,
	 * and 403 and 429 are the two statuses this plugin's blockers answer with (the blocklist,
	 * country rules and firewall refuse with 403, the rate limiter with 429). An empty user agent
	 * is a crawler, because every browser sends one.
	 *
	 * @param int    $status HTTP status.
	 * @param string $ua     User agent.
	 * @return string
	 */
	public static function classify( int $status, string $ua ): string {
		if ( 403 === $status || 429 === $status ) {
			return 'blocked';
		}
		if ( '' === trim( $ua ) || 1 === preg_match( self::CRAWLER_PATTERN, $ua ) ) {
			return 'crawler';
		}
		return 'human';
	}

	/**
	 * Whether an address is this server's own: unresolvable, private, loopback, or one of the
	 * site's known public egress addresses.
	 *
	 * @param string $ip Client address.
	 * @return bool
	 */
	private static function is_own_address( string $ip ): bool {
		if ( '' === $ip ) {
			return true;
		}
		if ( false === filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) ) {
			return true;
		}
		return class_exists( 'CSDT_Login' ) && is_callable( array( 'CSDT_Login', 'own_public_ips' ) )
			&& in_array( $ip, (array) CSDT_Login::own_public_ips(), true );
	}

	// ── AJAX ─────────────────────────────────────────────────────────────

	/**
	 * Rows newer than the last one the panel has, newest first.
	 *
	 * Read-only, but it hands over addresses and user agents, so it carries the same nonce and
	 * capability as the panel's save.
	 *
	 * @return void
	 */
	public static function ajax_poll(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		try {
			$after  = isset( $_POST['after'] ) ? absint( wp_unslash( $_POST['after'] ) ) : 0;
			$filter = isset( $_POST['filter'] ) ? sanitize_key( wp_unslash( $_POST['filter'] ) ) : 'all';
			$rows   = CSDT_Storage::recent_traffic( $after, $filter, self::POLL_LIMIT );
		} catch ( \Throwable $e ) {
			CSDT_Ajax::fail( $e, __METHOD__ );
			return;
		}
		if ( null === $rows ) {
			// Not an empty list: "the table cannot be read" and "nobody visited" must not look alike.
			wp_send_json_error( __( 'The live traffic table cannot be read.', 'cloudscale-cyber-devtools' ) );
			return;
		}
		$out = array();
		foreach ( $rows as $r ) {
			$out[] = array(
				'id'     => (int) $r['id'],
				'when'   => gmdate( 'Y-m-d H:i:s', (int) $r['ts'] ),
				'ip'     => (string) $r['ip'],
				'cc'     => (string) $r['country'],
				'method' => (string) $r['method'],
				'path'   => (string) $r['path'],
				'status' => (int) $r['status'],
				'kind'   => (string) $r['kind'],
				'user'   => (int) $r['user_id'] > 0,
				'ua'     => (string) $r['user_agent'],
			);
		}
		wp_send_json_success(
			array(
				'rows'    => $out,
				'enabled' => self::is_enabled(),
			)
		);
	}

	/**
	 * Switches recording on or off.
	 *
	 * @return void
	 */
	public static function ajax_save(): void {
		check_ajax_referer( CSDT_DevTools::SECURITY_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		$on = isset( $_POST['enabled'] ) && '1' === sanitize_text_field( wp_unslash( $_POST['enabled'] ) );
		update_option( self::OPTION_ENABLED, $on ? '1' : '0', true );
		wp_send_json_success(
			array(
				'msg'     => $on
					? __( 'Saved. Recording every request that reaches WordPress.', 'cloudscale-cyber-devtools' )
					: __( 'Saved. Recording is off; existing rows expire within a day.', 'cloudscale-cyber-devtools' ),
				'enabled' => $on,
			)
		);
	}

	// ── Panel ────────────────────────────────────────────────────────────

	/**
	 * Renders the Live Traffic panel, on the Firewall tab below Recent Matches.
	 *
	 * The table body starts empty and is filled by cs-login.js, which polls only while this panel
	 * is expanded and the browser tab is visible. A collapsed panel or a backgrounded tab costs the
	 * server nothing.
	 *
	 * @return void
	 */
	public static function render_panel(): void {
		$on = self::is_enabled();
		?>
		<div class="cs-panel is-collapsible is-collapsed" id="cs-panel-live-traffic" data-enabled="<?php echo esc_attr( $on ? '1' : '0' ); ?>">
			<div class="cs-section-header" style="background:linear-gradient(90deg,#7f1d1d 0%,#b91c1c 100%);border-left:3px solid #f87171;">
				<span>&#128225; <?php esc_html_e( 'Live Traffic', 'cloudscale-cyber-devtools' ); ?></span>
				<span class="cs-header-hint"><?php esc_html_e( 'Every request that reaches WordPress, as it arrives', 'cloudscale-cyber-devtools' ); ?></span>
				<?php
				CSDT_DevTools::render_explain_btn(
					'live-traffic',
					'Live Traffic',
					array(
						array(
							'name' => 'What it shows, and what it cannot show',
							'rec'  => 'Read this first',
							'html' => 'One row for each request that reached PHP: page views, logins, admin screens, REST and AJAX calls, and every request a blocker refused.<br><br>A page served from a <strong>cache never reaches PHP</strong>, so it never appears here. On a site behind Cloudflare, an nginx page cache or a caching plugin, most anonymous page views are answered from the cache, and this feed shows the misses: logged-in users, first visits to a page, POSTs, and anything a scanner asks for that was never cached. A quiet feed on a busy site usually means the cache is doing its job, not that nobody is visiting.',
						),
						array(
							'name' => 'What is recorded, and what is never recorded',
							'rec'  => 'Privacy',
							'html' => 'Each row holds the time, the address, the country if Cloudflare supplied it, the method, the <strong>path</strong>, the HTTP status, the first 200 characters of the user agent, and, for a signed-in visitor, the user id.<br><br>The query string, the request body, cookies and the referrer are <strong>never</strong> stored, and the table has no column any of them could go in. A query string routinely carries a password reset token, a session id or an email address, and a log that keeps them outlives whatever it was watching.<br><br>Not recorded at all: WP-CLI, scheduled tasks, the admin heartbeat, this panel\'s own refresh, the site calling its own REST API, and static files such as images and stylesheets that happened to reach PHP.',
						),
						array(
							'name' => 'Humans, crawlers and blocked',
							'rec'  => 'How it works',
							'html' => '<strong>Blocked</strong> is any request answered with 403 or 429, which is how the IP blocklist, country rules, the firewall and the rate limiter refuse. <strong>Crawler</strong> is a user agent that names a program: search engines, HTTP libraries such as curl or python, headless browsers, uptime monitors, or no user agent at all. Everything else is <strong>Human</strong>.<br><br>The user agent is whatever the client chose to send, so a scanner pretending to be Chrome is counted as human. Treat the split as a guide, not proof.',
						),
						array(
							'name' => 'What it costs',
							'rec'  => 'Performance',
							'html' => 'Off by default, because while it is on it writes <strong>one database row for every uncached request</strong>. The write happens after the page has been sent, it is a single INSERT with nothing read first, and on one request in a hundred it also trims rows past the ceiling.<br><br>That is small, but it is not free, and on a site taking thousands of uncached requests a minute it is worth switching off once you have the answer you were looking for. While it is off the cost is one already-loaded setting read per request.<br><br>The panel only refreshes while it is expanded and the browser tab is in front, every 5 seconds, and Pause stops it.',
						),
						array(
							'name' => 'How long rows are kept',
							'rec'  => 'Retention',
							'html' => 'Rows older than <strong>24 hours</strong> are deleted by the hourly maintenance task, and the table never holds more than <strong>20,000</strong> rows: the oldest go first. The ceiling is enforced as rows are written, so it holds even if scheduled tasks stop running.<br><br>For anything worth keeping longer, the firewall log keeps rule matches for 30 days and the auto-block log keeps every block. Switching recording off keeps the existing rows until they expire.',
						),
					)
				);
				?>
			</div>
			<div class="cs-panel-body">
				<div id="csdt-lt-state" style="background:<?php echo esc_attr( $on ? '#ecfdf5' : '#f1f5f9' ); ?>;border-left:4px solid <?php echo esc_attr( $on ? '#059669' : '#64748b' ); ?>;padding:10px 14px;border-radius:0 6px 6px 0;margin:0 0 14px;font-size:13px;color:<?php echo esc_attr( $on ? '#064e3b' : '#334155' ); ?>;">
					<?php if ( $on ) : ?>
						<strong><?php esc_html_e( 'Recording.', 'cloudscale-cyber-devtools' ); ?></strong>
						<?php esc_html_e( 'One row is written for each request that reaches WordPress. Cached page views never reach it and are not shown.', 'cloudscale-cyber-devtools' ); ?>
					<?php else : ?>
						<strong><?php esc_html_e( 'Off. Nothing is being recorded.', 'cloudscale-cyber-devtools' ); ?></strong>
						<?php esc_html_e( 'Switch it on to watch requests arrive. It writes one row per uncached request, so it is off by default.', 'cloudscale-cyber-devtools' ); ?>
					<?php endif; ?>
				</div>

				<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap;margin:0 0 14px;">
					<label style="font-size:13px;">
						<input type="checkbox" id="csdt-lt-enabled" value="1" <?php checked( $on ); ?>>
						<?php esc_html_e( 'Record live traffic', 'cloudscale-cyber-devtools' ); ?>
					</label>
					<button type="button" class="cs-btn-primary" id="csdt-lt-save">&#128190; <?php esc_html_e( 'Save', 'cloudscale-cyber-devtools' ); ?></button>
					<span id="csdt-lt-msg" style="font-size:12px;"></span>
				</div>

				<div style="display:flex;align-items:center;gap:6px;flex-wrap:wrap;margin:0 0 10px;" role="group" aria-label="<?php esc_attr_e( 'Filter traffic', 'cloudscale-cyber-devtools' ); ?>">
					<?php
					$chips = array(
						'all'     => __( 'All', 'cloudscale-cyber-devtools' ),
						'human'   => __( 'Humans', 'cloudscale-cyber-devtools' ),
						'crawler' => __( 'Crawlers', 'cloudscale-cyber-devtools' ),
						'blocked' => __( 'Blocked', 'cloudscale-cyber-devtools' ),
						'user'    => __( 'Signed in', 'cloudscale-cyber-devtools' ),
					);
					foreach ( $chips as $value => $label ) :
						?>
						<button type="button" class="cs-btn-secondary csdt-lt-filter" data-filter="<?php echo esc_attr( $value ); ?>" aria-pressed="<?php echo esc_attr( 'all' === $value ? 'true' : 'false' ); ?>"><?php echo esc_html( $label ); ?></button>
					<?php endforeach; ?>
					<button type="button" class="cs-btn-secondary" id="csdt-lt-pause" aria-pressed="false" style="margin-left:auto;"><?php esc_html_e( 'Pause', 'cloudscale-cyber-devtools' ); ?></button>
					<span id="csdt-lt-status" style="font-size:12px;color:#475569;"></span>
				</div>

				<p class="csdt-table-hint"><?php esc_html_e( 'Scroll the table sideways to see the status, type and user agent.', 'cloudscale-cyber-devtools' ); ?></p>
				<div class="csdt-table-scroll csdt-table-scroll--wide">
				<table class="widefat striped" style="font-size:12px;">
					<thead>
						<tr>
							<th style="width:130px;"><?php esc_html_e( 'When (UTC)', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="width:120px;"><?php esc_html_e( 'Address', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="width:44px;"><?php esc_html_e( 'CC', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="width:54px;"><?php esc_html_e( 'Method', 'cloudscale-cyber-devtools' ); ?></th>
							<th><?php esc_html_e( 'Path', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="width:54px;"><?php esc_html_e( 'Status', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="width:110px;"><?php esc_html_e( 'Type', 'cloudscale-cyber-devtools' ); ?></th>
							<th style="width:220px;"><?php esc_html_e( 'User agent', 'cloudscale-cyber-devtools' ); ?></th>
						</tr>
					</thead>
					<tbody id="csdt-lt-rows">
						<tr class="csdt-lt-empty"><td colspan="8" style="color:#64748b;"><?php esc_html_e( 'Expand this panel to load the most recent requests.', 'cloudscale-cyber-devtools' ); ?></td></tr>
					</tbody>
				</table>
				</div>
			</div>
		</div>
		<?php
	}
}