<?php
/**
 * Basic spam protection (F-FORMS-02).
 *
 * @package ForensixDigital
 */

declare(strict_types=1);

namespace ForensixDigital\Apps\Forms;

defined( 'ABSPATH' ) || exit;

/**
 * A hidden field that people leave empty and bots fill, and a signed timestamp that shows how
 * long the form was open. No cookies, no external service, and no nonce, so pages stay cacheable.
 * The signature uses a secret the caller passes in. Pure.
 */
final class SpamGuard {

	public const FIELD_HONEYPOT = 'forensix_website';
	public const FIELD_TOKEN    = 'forensix_token';

	public const MIN_SECONDS = 3;
	public const MAX_SECONDS = 86400;

	public const OK       = 'ok';
	public const TOO_FAST = 'too_fast';
	public const EXPIRED  = 'expired';
	public const INVALID  = 'invalid';
	public const BOT      = 'bot';

	/**
	 * Creates the token for a form shown now.
	 *
	 * @param int    $form_id Form id.
	 * @param int    $now     Unix time.
	 * @param string $secret  Site secret.
	 */
	public static function issue( int $form_id, int $now, string $secret ): string {
		return $now . '.' . self::sign( $form_id, $now, $secret );
	}

	/**
	 * Judges a submission.
	 *
	 * @param int    $form_id  Form id.
	 * @param string $honeypot Value of the hidden field.
	 * @param string $token    Value of the token field.
	 * @param int    $now      Unix time.
	 * @param string $secret   Site secret.
	 * @return string One of the class constants.
	 */
	public static function judge( int $form_id, string $honeypot, string $token, int $now, string $secret ): string {
		if ( '' !== trim( $honeypot ) ) {
			return self::BOT;
		}
		if ( 1 !== preg_match( '/^(\d{1,12})\.([a-f0-9]{64})$/', $token, $m ) ) {
			return self::INVALID;
		}
		if ( ! hash_equals( self::sign( $form_id, (int) $m[1], $secret ), $m[2] ) ) {
			return self::INVALID;
		}
		$age = $now - (int) $m[1];
		if ( $age < self::MIN_SECONDS ) {
			return self::TOO_FAST;
		}
		return $age > self::MAX_SECONDS ? self::EXPIRED : self::OK;
	}

	/**
	 * Signature of form id and time.
	 *
	 * @param int    $form_id Form id.
	 * @param int    $time    Unix time.
	 * @param string $secret  Secret.
	 */
	private static function sign( int $form_id, int $time, string $secret ): string {
		return hash_hmac( 'sha256', $form_id . '|' . $time, $secret );
	}
}