<?php
/** Narrow runtime checks; cannot establish that a host is free of compromise. */
if ( ! defined( 'ABSPATH' ) ) { exit; }
function dashe_seo_host_report() {
	global $wp_version;
	$session = extension_loaded( 'session' ) && function_exists( 'ini_get_all' ) ? ini_get_all( 'session', true ) : false;
	$upload = extension_loaded( 'session' ) ? null : false;
	if ( is_array( $session ) && isset( $session['session.upload_progress.enabled']['global_value'], $session['session.upload_progress.enabled']['local_value'] ) ) {
		$global_upload = filter_var( $session['session.upload_progress.enabled']['global_value'], FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE );
		$local_upload = filter_var( $session['session.upload_progress.enabled']['local_value'], FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE );
		// Runtime ini_set(false) must not hide a server-level enabled setting.
		$upload = null === $global_upload || null === $local_upload ? null : ( $global_upload || $local_upload );
	}
	$curl = function_exists( 'curl_version' ) ? curl_version() : false;
	$brotli = ! extension_loaded( 'curl' ) ? false : ( is_array( $curl ) && isset( $curl['features'] ) && defined( 'CURL_VERSION_BROTLI' ) ? (bool) ( $curl['features'] & CURL_VERSION_BROTLI ) : null );
	return array( 'schema' => 1, 'phpVersion' => PHP_VERSION, 'wordpressVersion' => $wp_version, 'osFamily' => PHP_OS_FAMILY, 'uploadProgressEnabled' => $upload, 'curlBrotliSupported' => $brotli, 'brotliVersion' => is_array( $curl ) ? ( $curl['brotli_version'] ?? '' ) : '' );
}
function dashe_seo_host_security( $report = null, $now = null ) {
	$report = null === $report ? dashe_seo_host_report() : $report;
	$now = null === $now ? time() : $now;
	$policy = json_decode( file_get_contents( __DIR__ . '/host-security-policy.json' ), true );
	$code = 'unverified';
	if ( is_array( $report ) && isset( $report['schema'] ) && 1 === $report['schema'] ) {
		$version = $report['phpVersion'] ?? '';
		$match = array();
		if ( ! is_string( $version ) || strlen( $version ) > 80 || ! preg_match( '/^(\d+)\.(\d+)\.(\d+)(?:[-+][A-Za-z0-9.+~-]+)?$/D', $version, $match ) || preg_match( '/dev|alpha|beta|rc/i', $version ) ) { $code = 'unverified'; }
		else {
			$branch = $policy['branches'][$match[1] . '.' . $match[2]] ?? null;
			if ( ! $branch || (int) $match[3] < $branch['minimum'] || $now >= strtotime( $branch['expires'] . ' UTC' ) ) { $code = 'php_update'; }
			elseif ( ! isset( $report['uploadProgressEnabled'] ) || ! is_bool( $report['uploadProgressEnabled'] ) || ! in_array( $report['osFamily'] ?? '', array( 'Linux', 'Windows', 'Darwin', 'BSD', 'Solaris', 'Unknown' ), true ) ) { $code = 'unverified'; }
			elseif ( $report['uploadProgressEnabled'] ) { $code = 'session_update'; }
			elseif ( 'Windows' === $report['osFamily'] && false !== ( $report['curlBrotliSupported'] ?? null ) ) {
				$b = $report['brotliVersion'] ?? '';
				$code = true === ( $report['curlBrotliSupported'] ?? null ) && is_string( $b ) && preg_match( '/^\d+\.\d+\.\d+$/D', $b ) && version_compare( $b, '1.2.1', '>=' ) ? 'passed' : 'brotli_update';
			} else { $code = 'passed'; }
		}
	}
	return array( 'status' => 'passed' === $code ? 'passed' : ( 'unverified' === $code ? 'unverified' : 'blocked' ), 'code' => $code, 'message' => $policy['messages'][$code], 'policy' => $policy['id'], 'advisory' => $policy['advisory'] );
}