<?php
namespace QWSpeedCache\Cache;

defined( 'ABSPATH' ) || exit;

/**
 * Detect reverse proxy / edge (Cloudflare, X-Forwarded-*) for correct host/HTTPS.
 */
class EdgeDetect {

	public function __construct() {
		add_filter( 'qwsc_site_host', array( $this, 'host' ) );
		add_action( 'init', array( $this, 'maybe_fix_https' ), 0 );
	}

	/**
	 * @param string $host Current host.
	 * @return string
	 */
	/**
	 * Validate an incoming host before it can influence cache routing.
	 * Only the configured site's host is accepted; untrusted proxy headers
	 * must never select an arbitrary cache namespace.
	 *
	 * @param mixed $candidate Candidate host header.
	 * @return string Empty when invalid or not this site's host.
	 */
	private static function validated_host( $candidate ) {
		if ( ! is_string( $candidate ) || strlen( $candidate ) > 255 ) {
			return '';
		}
		// Reject ambiguous multi-hop host headers rather than trusting the first value.
		if ( false !== strpos( $candidate, ',' ) || preg_match( '/[\r\n]/', $candidate ) ) {
			return '';
		}
		$candidate = strtolower( trim( $candidate ) );
		if ( ! preg_match( '/\A[a-z0-9.-]+(?::[0-9]{1,5})?\z/D', $candidate ) ) {
			return '';
		}
		$expected = wp_parse_url( home_url(), PHP_URL_HOST );
		$actual   = wp_parse_url( 'http://' . $candidate, PHP_URL_HOST );
		if ( ! is_string( $expected ) || ! is_string( $actual ) || strtolower( $expected ) !== strtolower( $actual ) ) {
			return '';
		}
		$port = wp_parse_url( 'http://' . $candidate, PHP_URL_PORT );
		return ( null === $port || ( is_int( $port ) && $port > 0 && $port <= 65535 ) ) ? $candidate : '';
	}

	public function host( $host ) {
		$s = \QWSpeedCache\Plugin::instance()->get_all_settings();
		if ( empty( $s['edge_detect_enabled'] ) ) {
			return $host;
		}
		if ( isset( $_SERVER['HTTP_X_FORWARDED_HOST'] ) && is_string( $_SERVER['HTTP_X_FORWARDED_HOST'] ) ) {
			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- validated_host() rejects untrusted and mismatched hostnames.
			$validated = self::validated_host( wp_unslash( $_SERVER['HTTP_X_FORWARDED_HOST'] ) );
			if ( '' !== $validated ) {
				return $validated;
			}
		}
		if ( isset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['HTTP_HOST'] ) && is_string( $_SERVER['HTTP_CF_CONNECTING_IP'] ) && is_string( $_SERVER['HTTP_HOST'] ) ) {
			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- validated_host() validates against the configured site host.
			$validated = self::validated_host( wp_unslash( $_SERVER['HTTP_HOST'] ) );
			if ( '' !== $validated ) {
				return $validated;
			}
		}
		return $host;
	}

	public function maybe_fix_https() {
		$s = \QWSpeedCache\Plugin::instance()->get_all_settings();
		if ( empty( $s['edge_detect_enabled'] ) ) {
			return;
		}
		if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && is_string( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === strtolower( trim( sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) ) ) ) ) {
			$_SERVER['HTTPS'] = 'on';
		}
		$cf_visitor = '';
		if ( isset( $_SERVER['HTTP_CF_VISITOR'] ) && is_string( $_SERVER['HTTP_CF_VISITOR'] ) ) {
			$cf_visitor = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_VISITOR'] ) );
		}
		if ( '' !== $cf_visitor && strlen( $cf_visitor ) <= 512 ) {
			$j = json_decode( $cf_visitor, true );
			if ( is_array( $j ) && isset( $j['scheme'] ) && 'https' === $j['scheme'] ) {
				$_SERVER['HTTPS'] = 'on';
			}
		}
	}
}