<?php
/**
 * Resolve the real client IP.
 *
 * Lyuhon's original blindly trusted X-Forwarded-For, which is trivially
 * spoofable: any attacker can send `X-Forwarded-For: 127.0.0.1` and burn
 * through brute-force attempts attributed to localhost.
 *
 * This class only honours forwarded headers when the immediate REMOTE_ADDR
 * is on the operator-configured trusted-proxy allowlist (CIDR-aware), with
 * an opt-in convenience to auto-trust Cloudflare's published ranges.
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

class GUARDFORGE_Ip {

    /**
 * Where the refreshed list lives.
 *
 * Written by the add-on (GUARDFORGE_Cloudflare_Sync::refresh_ip_ranges),
 * read here. The constant below is the fallback and stays in the free
 * package: a site that has never had Pro, or whose last fetch failed,
 * still needs an answer to "is this REMOTE_ADDR a Cloudflare edge?" — and
 * the safe answer is not "no", because a "no" makes every visitor look
 * like the edge in the log and in the lockout counter.
 */
    const RANGES_OPTION = 'guardforge_cf_ip_ranges';

    /**
 * Cloudflare published IPv4 ranges. Snapshot from cloudflare.com/ips-v4,
 * kept as the floor; the add-on refreshes the live list daily into
 * RANGES_OPTION, which covers the v6 edges this snapshot never had.
 */
    const CF_V4 = [
        '173.245.48.0/20',
        '103.21.244.0/22',
        '103.22.200.0/22',
        '103.31.4.0/22',
        '141.101.64.0/18',
        '108.162.192.0/18',
        '190.93.240.0/20',
        '188.114.96.0/20',
        '197.234.240.0/22',
        '198.41.128.0/17',
        '162.158.0.0/15',
        '104.16.0.0/13',
        '104.24.0.0/14',
        '172.64.0.0/13',
        '131.0.72.0/22',
    ];

    /**
 * Resolve the client IP using REMOTE_ADDR as the trust anchor.
 *
 * @param array|null $server Override $_SERVER for tests.
 * @return string IP or '0.0.0.0' if nothing usable was found.
 */
    public static function client_ip( $server = null ) {
        $server = $server ?? $_SERVER;
        $remote = $server['REMOTE_ADDR'] ?? '';

        if ( ! filter_var( $remote, FILTER_VALIDATE_IP ) ) {
            $remote = '0.0.0.0';
        }

        if ( ! self::is_trusted_proxy( $remote ) ) {
            return $remote;
        }

        // Trusted proxy in front. Use the first valid (non-private) IP in the
        // forwarded chain. CF-Connecting-IP wins when present because CF
        // controls it; otherwise walk X-Forwarded-For left-to-right.
        $cf = $server['HTTP_CF_CONNECTING_IP'] ?? '';
        if ( filter_var( $cf, FILTER_VALIDATE_IP ) ) {
            return $cf;
        }

        $xff = $server['HTTP_X_FORWARDED_FOR'] ?? '';
        if ( $xff ) {
            foreach ( explode( ',', $xff ) as $part ) {
                $ip = trim( $part );
                if ( filter_var( $ip, FILTER_VALIDATE_IP ) ) {
                    return $ip;
                }
            }
        }

        return $remote;
    }

    /**
 * Whether REMOTE_ADDR matches a configured trusted proxy.
 *
 * @param string $ip
 * @return bool
 */
    public static function is_trusted_proxy( $ip ) {
        if ( ! filter_var( $ip, FILTER_VALIDATE_IP ) ) {
            return false;
        }

        $cidrs = self::trusted_cidrs();
        foreach ( $cidrs as $cidr ) {
            if ( self::ip_in_cidr( $ip, $cidr ) ) {
                return true;
            }
        }
        return false;
    }

    /**
 * Aggregated trusted-proxy CIDR list. Operator-supplied + (optional)
 * Cloudflare ranges. Filterable so site authors can extend without
 * editing options.
 */
    public static function trusted_cidrs() {
        $configured = self::parse_cidr_lines( GUARDFORGE_Options::get( 'bf_trusted_proxies', '' ) );
        if ( GUARDFORGE_Options::get( 'bf_trust_cloudflare' ) ) {
            $configured = array_merge( $configured, self::cloudflare_ranges() );
        }
        /**
 * Filter the trusted proxy CIDR list.
 *
 * @param string $cidrs
 */
        return apply_filters( 'guardforge/trusted_proxies', $configured );
    }

    /**
 * The Cloudflare edges to trust: the refreshed list when there is one, the
 * bundled snapshot otherwise.
 *
 * Deliberately a REPLACEMENT rather than a union. A range Cloudflare has
 * retired can be reassigned to somebody else, and a plugin that goes on
 * trusting a snapshot forever would honour CF-Connecting-IP from whoever
 * holds it next.
 *
 * @return string
 */
    public static function cloudflare_ranges() {
        $stored = get_option( self::RANGES_OPTION, [] );
        if ( ! is_array( $stored ) ) {
            $stored = [];
        }
        $live = [];
        foreach ( [ 'v4', 'v6' ] as $family ) {
            foreach ( (array) ( $stored[ $family ] ?? [] ) as $cidr ) {
                $cidr = trim( (string) $cidr );
                if ( $cidr !== '' ) {
                    $live[] = $cidr;
                }
            }
        }
        return $live ? $live : self::CF_V4;
    }

    /**
 * What the Cloudflare screen prints about the list.
 *
 * refreshed_at is when the list last CHANGED and checked_at is when we
 * last asked; a screen that showed one number for both would say a list
 * from March was refreshed this morning, on the strength of a fetch that
 * failed.
 *
 * @return array{refreshed_at:int,checked_at:int,error:string,count:int,source:string}
 */
    public static function cloudflare_ranges_state() {
        $stored = get_option( self::RANGES_OPTION, [] );
        if ( ! is_array( $stored ) ) {
            $stored = [];
        }
        $live = 0;
        foreach ( [ 'v4', 'v6' ] as $family ) {
            $live += count( array_filter( (array) ( $stored[ $family ] ?? [] ) ) );
        }
        return [
            'refreshed_at' => (int) ( $stored['refreshed_at'] ?? 0 ),
            'checked_at'   => (int) ( $stored['checked_at'] ?? 0 ),
            'error'        => (string) ( $stored['error'] ?? '' ),
            'count'        => $live > 0 ? $live : count( self::CF_V4 ),
            'source'       => $live > 0 ? 'live' : 'bundled',
        ];
    }

    private static function parse_cidr_lines( $text ) {
        if ( ! is_string( $text ) || $text === '' ) {
            return [];
        }
        $out = [];
        foreach ( preg_split( '/[\r\n,]+/', $text ) as $line ) {
            $line = trim( $line );
            if ( $line === '' || $line[0] === '#' ) {
                continue;
            }
            $out[] = $line;
        }
        return $out;
    }

    /**
 * Match an IP against a CIDR. Supports v4 and v6.
 */
    public static function ip_in_cidr( $ip, $cidr ) {
        if ( strpos( $cidr, '/' ) === false ) {
            return $ip === $cidr;
        }
        list( $subnet, $bits ) = explode( '/', $cidr, 2 );
        $bits = (int) $bits;

        $ip_packed     = @inet_pton( $ip );
        $subnet_packed = @inet_pton( $subnet );
        if ( $ip_packed === false || $subnet_packed === false ) {
            return false;
        }
        if ( strlen( $ip_packed ) !== strlen( $subnet_packed ) ) {
            return false; // v4 vs v6 mismatch
        }

        $bytes_full = intdiv( $bits, 8 );
        $bits_part  = $bits % 8;

        if ( $bytes_full > 0 && substr( $ip_packed, 0, $bytes_full ) !== substr( $subnet_packed, 0, $bytes_full ) ) {
            return false;
        }
        if ( $bits_part === 0 ) {
            return true;
        }
        $mask = chr( 0xff << ( 8 - $bits_part ) & 0xff );
        return ( $ip_packed[ $bytes_full ] & $mask ) === ( $subnet_packed[ $bytes_full ] & $mask );
    }
}