<?php

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Rabbitproof_Scanners {

	const MEMORY     = 'rabbitproof_scan_memory';
	const MEMORY_MAX = 500;

	const REMEMBER = HOUR_IN_SECONDS;
	const RETRY    = 5 * MINUTE_IN_SECONDS;

	const PATTERNS = array(

		'/\.(env|key|pem|crt|sql|sqlite|sqlite3|db|bak|old|orig|save|swp|swo|tmp|log|ini|conf|cfg|sh|map)$/i',
		'/~$/',
		'#/\.env(\.[\w.\-]+)?$#i',
		'/\.php\.(txt|bak|old|orig|save|swp|backup|1)$/i',
		'#/\.(git|svn|hg|bzr|vscode|idea)(/|$)#i',
		'#/\.(aws|ssh|docker|kube)(/|$)#i',
		'#/\.(htpasswd|htaccess|npmrc|pgpass|bash_history|DS_Store|user\.ini|ftpconfig)$#i',
		'#/\.(bashrc|bash_profile|bash_login|bash_logout|profile|zshrc|zprofile|zsh_history|cshrc|tcshrc|kshrc|mysql_history|psql_history|python_history|viminfo|lesshst|wget-hsts)$#i',
		'#^/root/\.#',
		'#/(web\.config|composer\.(json|lock)|docker-compose\.ya?ml|\.travis\.yml|\.gitlab-ci\.yml|phpunit\.xml|sftp-config\.json)$#i',
		'#/id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$#',
		'#/vendor/phpunit/.*eval-stdin\.php$#i',
		'#/(containers/json|actuator/(env|heapdump))$#',
	);

	public static function register() {
		add_action( 'plugins_loaded', array( __CLASS__, 'run' ), 0 );
	}

	public static function run() {
		if ( 'block' === self::look( $_SERVER ) ) {
			self::refuse();
		}
	}

	public static function is_scan( $uri ) {
		$raw  = wp_parse_url( (string) $uri, PHP_URL_PATH );
		$raw  = is_string( $raw ) ? $raw : '/';
		$path = rawurldecode( $raw );
		if ( 0 === strpos( $path, '/.well-known/' ) ) {
			return false;
		}

		if ( 1 === preg_match( '#(^|/)\.\.(/|\\\\|$)#', $path ) || 1 === preg_match( '/%2e%2e/i', $raw ) ) {
			return true;
		}
		foreach ( self::PATTERNS as $pattern ) {
			if ( 1 === preg_match( $pattern, $path ) ) {
				return true;
			}
		}
		return false;
	}

	public static function look( array $server ) {
		if ( ! Rabbitproof_Options::get( 'scanners' ) || ! Rabbitproof_Options::connected() ) {
			return '';
		}
		if ( Rabbitproof_Guard::own_server( $server ) ) {
			return '';
		}
		$uri = isset( $server['REQUEST_URI'] ) ? (string) $server['REQUEST_URI'] : '/';
		if ( ! self::is_scan( $uri ) ) {
			return '';
		}

		$site = Rabbitproof_Options::all()['site'];
		if ( is_array( $site ) && isset( $site['tier'] ) && 'none' === $site['tier'] ) {
			return isset( $site['mode'] ) && 'enforce' === $site['mode'] ? 'block' : '';
		}
		$ip   = Rabbitproof_Ip::visitor( $server, (bool) Rabbitproof_Options::get( 'proxy' ) );
		$key  = md5( $ip );
		$seen = self::recall( $key );
		if ( 'block' === $seen || 'watch' === $seen ) {
			return $seen;
		}
		$answer = Rabbitproof_Api::call(
			'POST',
			'/v1/check',
			array(
				'pass' => '',
				'ip'   => $ip,
				'path' => Rabbitproof_Guard::path( $uri ),
			),
			Rabbitproof_Api::CHECK_TIMEOUT
		);
		if ( is_wp_error( $answer ) || 200 !== $answer['_status'] ) {
			Rabbitproof_Guard::unreachable();
			self::remember( $key, 'watch', self::RETRY );
			return '';
		}
		$what = ! empty( $answer['block'] ) ? 'block' : 'watch';
		self::remember( $key, $what, self::REMEMBER );
		return $what;
	}

	private static function recall( $key ) {
		$m = get_option( self::MEMORY, array() );
		return is_array( $m ) && isset( $m[ $key ][0], $m[ $key ][1] ) && (int) $m[ $key ][1] > time() ? (string) $m[ $key ][0] : '';
	}

	private static function remember( $key, $what, $for ) {
		$now = time();
		$m   = get_option( self::MEMORY, array() );
		$m   = is_array( $m ) ? array_filter( $m, function ( $e ) use ( $now ) { return is_array( $e ) && isset( $e[1] ) && (int) $e[1] > $now; } ) : array();
		$m[ $key ] = array( $what, $now + (int) $for );
		if ( count( $m ) > self::MEMORY_MAX ) {
			uasort( $m, function ( $a, $b ) { return (int) $a[1] - (int) $b[1]; } );
			$m = array_slice( $m, -self::MEMORY_MAX, null, true );
		}
		update_option( self::MEMORY, $m, false );
	}

	private static function refuse() {
		status_header( 403 );
		nocache_headers();
		header( 'Content-Type: text/plain; charset=utf-8' );
		header( 'X-Robots-Tag: noindex' );
		echo 'Forbidden';
		exit;
	}
}