<?php
/**
 * Attempt limits for visitors who are not logged in.
 *
 * @package SpaceBay
 */

namespace SpaceBay\Auth;

use WP_Error;

defined( 'ABSPATH' ) || exit;

/**
 * Counts login, signup and password reset attempts per network address (and
 * per account) to slow down password guessing and spam signups.
 */
final class Throttle {

	/**
	 * Returns the visitor's network address.
	 *
	 * Only REMOTE_ADDR is trusted by default, because forwarded headers can be
	 * faked. Sites behind a proxy can use the filter.
	 *
	 * @return string
	 */
	public static function ip() {
		$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';

		/**
		 * Filters the network address used to limit login and signup attempts.
		 *
		 * @since 1.0.0
		 *
		 * @param string $ip Address from REMOTE_ADDR.
		 */
		return (string) apply_filters( 'spacebay_client_ip', $ip );
	}

	/**
	 * Builds the transient name of a counter.
	 *
	 * @param string $action  Action name, for example "login".
	 * @param string $subject What is counted: an address, a login name or both.
	 * @return string
	 */
	private static function key( $action, $subject ) {
		return 'spacebay_at_' . sanitize_key( $action ) . '_' . substr( hash_hmac( 'sha256', strtolower( $subject ), wp_salt( 'nonce' ) ), 0, 32 );
	}

	/**
	 * Returns the limit of an action after the filter.
	 *
	 * @param string $action Action name.
	 * @param int    $limit  Default limit.
	 * @return int
	 */
	private static function limit( $action, $limit ) {
		/**
		 * Filters how many attempts a visitor gets before they must wait.
		 *
		 * @since 1.0.0
		 *
		 * @param int    $limit  Allowed attempts in the window.
		 * @param string $action Action name: login, signup, forgot, reset, code.
		 */
		return max( 1, (int) apply_filters( 'spacebay_auth_attempts', $limit, $action ) );
	}

	/**
	 * Tells whether the limit is already reached, without counting an attempt.
	 *
	 * @param string $action  Action name.
	 * @param string $subject What is counted.
	 * @param int    $limit   Allowed attempts in the window.
	 * @return true|WP_Error
	 */
	public static function check( $action, $subject, $limit ) {
		$state = get_transient( self::key( $action, $subject ) );

		if ( is_array( $state ) && (int) $state['count'] >= self::limit( $action, $limit ) && (int) $state['until'] > time() ) {
			return self::error( (int) $state['until'] - time() );
		}

		return true;
	}

	/**
	 * Counts one attempt and returns an error when the limit is passed.
	 *
	 * @param string $action  Action name.
	 * @param string $subject What is counted.
	 * @param int    $limit   Allowed attempts in the window.
	 * @param int    $window  Window in seconds.
	 * @return true|WP_Error
	 */
	public static function hit( $action, $subject, $limit, $window ) {
		$key   = self::key( $action, $subject );
		$state = get_transient( $key );

		if ( ! is_array( $state ) || (int) $state['until'] <= time() ) {
			$state = array(
				'count' => 0,
				'until' => time() + $window,
			);
		}

		if ( (int) $state['count'] >= self::limit( $action, $limit ) ) {
			return self::error( (int) $state['until'] - time() );
		}

		++$state['count'];
		set_transient( $key, $state, max( 1, (int) $state['until'] - time() ) );

		return true;
	}

	/**
	 * Forgets the attempts of a subject, for example after a correct password.
	 *
	 * @param string $action  Action name.
	 * @param string $subject What is counted.
	 * @return void
	 */
	public static function clear( $action, $subject ) {
		delete_transient( self::key( $action, $subject ) );
	}

	/**
	 * Builds the "please wait" error.
	 *
	 * @param int $seconds Seconds until the visitor may try again.
	 * @return WP_Error
	 */
	private static function error( $seconds ) {
		$minutes = max( 1, (int) ceil( $seconds / MINUTE_IN_SECONDS ) );

		return new WP_Error(
			'spacebay_too_many_attempts',
			sprintf(
				/* translators: %d: Number of minutes. */
				_n( 'Too many attempts. Please wait %d minute and try again.', 'Too many attempts. Please wait %d minutes and try again.', $minutes, 'spacebay' ),
				$minutes
			),
			array(
				'status'      => 429,
				'retry_after' => $seconds,
			)
		);
	}
}