<?php

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Rabbitproof_Xmlrpc {

	const MEMORY   = 'rabbitproof_xmlrpc_fails';
	const MAX      = 500;
	const LIMIT    = 5;
	const WINDOW   = HOUR_IN_SECONDS;

	private static $logged = array();

	public static function register() {
		add_filter( 'authenticate', array( __CLASS__, 'gate' ), 100, 1 );
		add_action( 'wp_login_failed', array( __CLASS__, 'failed' ), 10, 1 );
		if ( Rabbitproof_Options::get( 'xmlrpc_off' ) ) {
			add_filter( 'xmlrpc_enabled', '__return_false' );
			add_filter( 'xmlrpc_methods', array( __CLASS__, 'none' ), 999 );
			add_filter( 'wp_headers', array( __CLASS__, 'no_pingback' ) );
		}
	}

	private static function xmlrpc() {
		return defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST;
	}

	private static function ip() {
		return Rabbitproof_Ip::visitor( $_SERVER, (bool) Rabbitproof_Options::get( 'proxy' ) );
	}

	private static function enforcing() {
		$site = Rabbitproof_Options::all()['site'];
		return is_array( $site ) && isset( $site['mode'] ) && 'enforce' === $site['mode'];
	}

	public static function gate( $user ) {
		if ( ! self::xmlrpc() || ! self::enforcing() ) {
			return $user;
		}
		$ip = self::ip();
		$m  = self::memory();
		$k  = md5( $ip );
		if ( isset( $m[ $k ] ) && (int) $m[ $k ][0] >= self::LIMIT && (int) $m[ $k ][1] > time() ) {
			self::note( 'xmlrpc_login', $ip );
			return new WP_Error( 'rabbitproof_refused', __( 'Too many failed sign-ins. Try again later.', 'rabbitproof' ) );
		}
		return $user;
	}

	public static function failed( $username = '' ) {
		unset( $username );
		if ( ! self::xmlrpc() ) {
			return;
		}
		$ip  = self::ip();
		$now = time();
		$m   = self::memory();
		$k   = md5( $ip );
		$m[ $k ] = isset( $m[ $k ] ) && (int) $m[ $k ][1] > $now ? array( (int) $m[ $k ][0] + 1, (int) $m[ $k ][1] ) : array( 1, $now + self::WINDOW );
		if ( count( $m ) > self::MAX ) {
			uasort( $m, function ( $a, $b ) { return (int) $a[1] - (int) $b[1]; } );
			$m = array_slice( $m, -self::MAX, null, true );
		}
		update_option( self::MEMORY, $m, false );
		if ( $m[ $k ][0] >= self::LIMIT && self::enforcing() ) {
			self::note( 'xmlrpc_login', $ip );
		}
	}

	private static function memory() {
		$now = time();
		$m   = get_option( self::MEMORY, array() );
		return is_array( $m ) ? array_filter( $m, function ( $e ) use ( $now ) { return is_array( $e ) && isset( $e[0], $e[1] ) && (int) $e[1] > $now; } ) : array();
	}

	public static function none( $methods ) {
		unset( $methods );
		if ( self::xmlrpc() ) {
			self::note( 'xmlrpc_off', self::ip() );
		}
		return array();
	}

	public static function no_pingback( $headers ) {
		unset( $headers['X-Pingback'] );
		return $headers;
	}

	private static function note( $kind, $ip ) {
		if ( isset( self::$logged[ $kind ] ) ) {
			return;
		}
		self::$logged[ $kind ] = true;
		Rabbitproof_Probes::add( $kind, $ip, '/xmlrpc.php' );
	}
}