<?php

namespace DaftPlug\Rankify\Features;

use DaftPlug\Rankify\Helpers\Utils;

if (!defined('ABSPATH')) {
  exit();
}

require_once __DIR__ . '/classes/AiCrawlers.php';

/**
 * The virtual robots.txt: custom rules plus AI crawler directives.
 *
 * Nothing is ever written to disk. A physical robots.txt is a file the plugin
 * would have to own forever — including after deactivation, when it would keep
 * enforcing rules nobody can find the source of.
 */
class Robots
{
  public function __construct()
  {
    // Priority 20 so this runs after the sitemap reference is added at 10 and
    // the two compose into one file in a predictable order.
    add_filter('robots_txt', [$this, 'filterRobotsTxt'], 20, 2);
  }

  public function filterRobotsTxt($output, $public)
  {
    if (!$public) {
      // Search engine visibility is discouraged. Since WP 5.3 that is expressed
      // as a `noindex` robots meta tag rather than a blanket Disallow, so
      // robots.txt stays permissive — but writing "Allow: GPTBot" onto a site
      // that is asking not to be indexed contradicts the user's own setting.
      return $output;
    }

    if ('on' === Utils::getSetting('robotsTxt')) {
      $custom = Utils::getSetting('robotsTxtContent');
      if (is_string($custom) && '' !== trim($custom)) {
        $output = rtrim($output, "\n") . "\n\n" . trim($this->sanitizeRules($custom)) . "\n";
      }
    }

    $aiRules = Robots\AiCrawlers::robotsRules();
    if ('' !== $aiRules) {
      $output = rtrim($output, "\n") . "\n" . $aiRules;
    }

    return $output;
  }

  /**
   * Strip anything that is not a plausible robots.txt directive.
   *
   * The field is admin-only, so this is not a security boundary — it is there
   * to stop a stray paste of HTML or a sitemap URL list turning the served file
   * into something no crawler will parse.
   */
  protected function sanitizeRules($rules)
  {
    $allowed = ['user-agent', 'disallow', 'allow', 'crawl-delay', 'sitemap', 'host', 'clean-param', 'noindex', 'request-rate', 'visit-time'];

    $clean = [];
    foreach (preg_split('/\R/', (string) $rules) as $line) {
      $line = trim(wp_strip_all_tags($line));

      if ('' === $line) {
        $clean[] = '';
        continue;
      }

      if (0 === strpos($line, '#')) {
        $clean[] = $line;
        continue;
      }

      $directive = strtolower(trim(strtok($line, ':')));
      if (in_array($directive, $allowed, true)) {
        $clean[] = $line;
      }
    }

    // Collapse the runs of blank lines that dropping invalid lines leaves.
    return preg_replace("/\n{3,}/", "\n\n", implode("\n", $clean));
  }

  /**
   * Whether a real robots.txt exists on disk.
   *
   * WordPress only serves the virtual file when no physical one is present, so
   * a site with one silently ignores everything configured here. The settings
   * UI has to say so rather than letting the user edit a file nobody serves.
   */
  public static function physicalFileExists()
  {
    $path = trailingslashit(ABSPATH) . 'robots.txt';

    return file_exists($path) && is_file($path);
  }

  /**
   * The robots.txt as it will actually be served, for the settings preview.
   */
  public static function preview()
  {
    // Deliberately not `do_robots()`. That function sends a text/plain
    // Content-Type header, and headers are not captured by output buffering —
    // calling it from the settings page, where HTML has already been sent,
    // logs a "headers already sent" warning on every page load.
    //
    // What is reproduced instead is exactly the rest of its body, so the
    // preview still runs through `robots_txt` and shows what will really be
    // served, including any other plugin's additions.
    do_action('do_robotstxt');

    $public = (bool) get_option('blog_public');
    $sitePath = (string) wp_parse_url(site_url(), PHP_URL_PATH);

    $output = "User-agent: *\n";
    $output .= "Disallow: {$sitePath}/wp-admin/\n";
    $output .= "Allow: {$sitePath}/wp-admin/admin-ajax.php\n";

    return trim((string) apply_filters('robots_txt', $output, $public));
  }
}