<?php
/**
 * Multi-step Form spam protection: honeypot, minimum fill time and a per-IP rate limit.
 *
 * @package ReactWoo\Atomic
 */

namespace ReactWoo\Atomic\Forms;

defined( 'ABSPATH' ) || exit;

final class Spam_Guard {

	const HONEYPOT_FIELD   = 'reactwoo_atomic_hp';
	const TIMER_FIELD      = 'reactwoo_atomic_t';
	const DEFAULT_MIN_SECS = 3;   // Figma contract 450:1766.
	const DEFAULT_LIMIT    = 5;   // Submissions per window, per IP and form.
	const DEFAULT_WINDOW   = 600; // 10 minutes (Figma contract 450:1766).

	/**
	 * Signed render timestamp for the hidden timer field.
	 *
	 * @param string $form_id Form id.
	 * @param int    $now     Optional time (tests).
	 * @return string time|hmac
	 */
	public static function timer_token( $form_id, $now = 0 ) {
		$t = $now ? (int) $now : time();
		return $t . '|' . self::hmac( 'timer|' . $form_id . '|' . $t );
	}

	/**
	 * True when the honeypot was filled.
	 *
	 * @param array $body Request body.
	 */
	public static function is_honeypot_tripped( array $body ) {
		return isset( $body[ self::HONEYPOT_FIELD ] ) && '' !== trim( (string) $body[ self::HONEYPOT_FIELD ] );
	}

	/**
	 * True when the form was sent faster than allowed or the timer is missing / forged.
	 *
	 * @param array  $body        Request body.
	 * @param string $form_id     Form id.
	 * @param int    $min_seconds Minimum seconds.
	 * @param int    $now         Optional time (tests).
	 */
	public static function is_too_fast( array $body, $form_id, $min_seconds, $now = 0 ) {
		$now   = $now ? (int) $now : time();
		$token = isset( $body[ self::TIMER_FIELD ] ) ? (string) $body[ self::TIMER_FIELD ] : '';
		$parts = explode( '|', $token, 2 );
		if ( 2 !== count( $parts ) || ! ctype_digit( $parts[0] ) ) {
			return true;
		}
		if ( ! hash_equals( self::hmac( 'timer|' . $form_id . '|' . $parts[0] ), $parts[1] ) ) {
			return true;
		}
		$age = $now - (int) $parts[0];
		return $age < max( 0, (int) $min_seconds ) || $age > DAY_IN_SECONDS;
	}

	/**
	 * Count one attempt and report whether the caller is over the limit.
	 *
	 * @param string $form_id Form id.
	 * @param string $ip      Client IP.
	 * @param int    $limit   Max attempts per window (0 disables).
	 * @param int    $window  Window in seconds.
	 * @return bool True when over the limit (this attempt is rejected).
	 */
	public static function hit_rate_limit( $form_id, $ip, $limit = self::DEFAULT_LIMIT, $window = self::DEFAULT_WINDOW ) {
		$limit = (int) $limit;
		if ( $limit <= 0 ) {
			return false;
		}
		$suffix = substr( self::hmac( 'rl|' . $form_id . '|' . $ip ), 0, 32 );
		$key    = 'reactwoo_atomic_msf_rl_' . $suffix;
		$bucket = get_transient( $key );
		$now    = time();
		if ( ! is_array( $bucket ) || ! isset( $bucket['start'], $bucket['count'] ) || ( $now - (int) $bucket['start'] ) >= $window ) {
			$bucket = array( 'start' => $now, 'count' => 0 );
		}
		if ( (int) $bucket['count'] >= $limit ) {
			return true;
		}
		$bucket['count'] = (int) $bucket['count'] + 1;
		set_transient( $key, $bucket, max( 1, $window - ( $now - (int) $bucket['start'] ) ) );
		return false;
	}

	/**
	 * Privacy-safe hash of the client IP (never stored raw).
	 *
	 * @param string $ip IP.
	 */
	public static function ip_hash( $ip ) {
		return substr( self::hmac( 'ip|' . $ip ), 0, 40 );
	}

	/**
	 * Client IP from REMOTE_ADDR only (proxy headers are spoofable; filterable for trusted proxies).
	 */
	public static function client_ip() {
		$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
		/** Filter: allow sites behind a trusted proxy to supply the visitor IP. */
		$ip = (string) apply_filters( 'reactwoo/atomic/forms/client_ip', $ip );
		return filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : '0.0.0.0';
	}

	private static function hmac( $data ) {
		return hash_hmac( 'sha256', $data, wp_salt( 'nonce' ) );
	}
}