<?php
/**
 * Fetches the official copy of a WordPress core file.
 *
 * Source: the WordPress.org Subversion repository. The caller compares the
 * result with the official checksum before trusting it.
 *
 * @package CoreSeal
 */

defined( 'ABSPATH' ) || exit;

class Coreseal_Official_Source {

	/** Cache lifetime of a fetched file. */
	const CACHE_TTL = DAY_IN_SECONDS;

	/**
	 * @param string $version WordPress version (e.g. "7.1.3").
	 * @param string $file    Path relative to the WordPress root.
	 * @return string|WP_Error File content.
	 */
	public static function get( string $version, string $file ) {
		if ( ! self::is_valid_path( $file ) || ! preg_match( '/^[0-9][0-9a-z.\-]*$/i', $version ) ) {
			return new WP_Error( 'coreseal_bad_path', __( 'Invalid file path.', 'coreseal' ) );
		}

		$key    = 'coreseal_src_' . md5( $version . '|' . $file );
		$cached = get_transient( $key );
		if ( is_string( $cached ) ) {
			return $cached;
		}

		$path = implode( '/', array_map( 'rawurlencode', explode( '/', $file ) ) );
		$urls = array(
			'https://core.svn.wordpress.org/tags/' . rawurlencode( $version ) . '/' . $path,
		);

		$error = null;
		foreach ( $urls as $url ) {
			$response = wp_remote_get( $url, array( 'timeout' => 15 ) );

			if ( is_wp_error( $response ) ) {
				$error = $response;
				continue;
			}
			if ( 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
				continue;
			}

			$body = wp_remote_retrieve_body( $response );

			// Keep the cache small: big files are fetched again when needed.
			if ( strlen( $body ) < 1024 * 1024 ) {
				set_transient( $key, $body, self::CACHE_TTL );
			}
			return $body;
		}

		return new WP_Error(
			'coreseal_source_unavailable',
			sprintf(
				/* translators: %s: WordPress version. */
				__( 'The official copy of this file could not be downloaded for WordPress %s. Check that your server can reach core.svn.wordpress.org.', 'coreseal' ),
				$version
			) . ( $error ? ' (' . $error->get_error_message() . ')' : '' )
		);
	}

	/**
	 * A relative path without "..", absolute parts or odd characters.
	 */
	private static function is_valid_path( string $file ): bool {
		return '' !== $file
			&& false === strpos( $file, '..' )
			&& '/' !== $file[0]
			&& (bool) preg_match( '#^[A-Za-z0-9_./\-]+$#', $file );
	}
}