<?php
/**
 * Frontend Loader for Accelvia – Content Protection for WordPress.
 *
 * Determines whether protection should be active on the current page,
 * and enqueues the protection script with localized configuration.
 *
 * @package Accelvia_Content_Protection
 */

if (!defined('ABSPATH')) {
    exit;
}

/**
 * Check if the current page is excluded from Content Protection.
 * Checks excluded_page_ids and protected_post_types.
 */
function accelvia_is_page_excluded_from_cp($options)
{
    $post = get_post();
    if (!$post) {
        return false;
    }

    if (!empty($options['excluded_page_ids'])) {
        $excluded_ids = array_map('absint', explode(',', $options['excluded_page_ids']));
        if (in_array((int) $post->ID, $excluded_ids, true)) {
            return true;
        }
    }

    if (!empty($options['protected_post_types']) && is_array($options['protected_post_types'])) {
        if (!in_array($post->post_type, $options['protected_post_types'], true)) {
            return true;
        }
    }

    return false;
}

/**
 * Check if the current page is excluded from Watermarking.
 * Checks watermark_excluded_page_ids.
 */
function accelvia_is_page_excluded_from_wm($options)
{
    $post = get_post();
    if (!$post) {
        return false;
    }

    if (!empty($options['watermark_excluded_page_ids'])) {
        $excluded_ids = array_map('absint', explode(',', $options['watermark_excluded_page_ids']));
        if (in_array((int) $post->ID, $excluded_ids, true)) {
            return true;
        }
    }

    return false;
}

/**
 * Enqueue the frontend protection script when appropriate.
 */
function accelvia_enqueue_frontend_protection()
{
    // Never run in admin.
    if (is_admin()) {
        return;
    }

    $options = get_option(ACCELVIA_OPTION_KEY, array());

    // Bail if protection is globally disabled.
    if (empty($options['enable_protection']) || '1' !== $options['enable_protection']) {
        return;
    }

    // Skip for logged-in administrators if that option is enabled.
    if (!empty($options['skip_admins']) && '1' === $options['skip_admins'] && current_user_can('manage_options')) {
        return;
    }

    $is_cp_excluded = accelvia_is_page_excluded_from_cp($options);
    $is_wm_excluded = accelvia_is_page_excluded_from_wm($options);

    if ($is_cp_excluded && $is_wm_excluded) {
        return; // Nothing to do here.
    }

    // --- Content Protection Scripts ---
    if (!$is_cp_excluded) {

    // Enqueue the protection script.
    wp_enqueue_script(
        'accelvia-protection',
        ACCELVIA_PLUGIN_URL . 'assets/js/protection.js',
        array(), // No dependencies – pure Vanilla JS.
        ACCELVIA_VERSION,
        true // Load in footer.
    );

    // Pass configuration to JS.
    $config = array(
        'disableRightClick' => !empty($options['disable_right_click']) && '1' === $options['disable_right_click'],
        'disableShortcuts' => !empty($options['disable_shortcuts']) && '1' === $options['disable_shortcuts'],
        'disableTextSelection' => !empty($options['disable_text_selection']) && '1' === $options['disable_text_selection'],
        'disableImageDrag' => !empty($options['disable_image_drag']) && '1' === $options['disable_image_drag'],
        'disableCopy' => !empty($options['disable_copy']) && '1' === $options['disable_copy'],
        'disableDevTools' => !empty($options['disable_devtools']) && '1' === $options['disable_devtools'],
        'disableScreenshot' => !empty($options['disable_screenshot']) && '1' === $options['disable_screenshot'],
        'encryptContent' => !empty($options['encrypt_content']) && '1' === $options['encrypt_content'],
        'notificationType' => isset($options['notification_type']) ? $options['notification_type'] : 'toast',
        'notificationMessage' => isset($options['notification_message'])
            ? $options['notification_message']
            : __('This content is protected by Accelvia.', 'accelvia-content-protection'),
    );

    wp_localize_script('accelvia-protection', 'accelvia_config', $config);
    } // End CP check

    // --- Watermark Module ---
    if (!$is_wm_excluded && !empty($options['watermark_enabled']) && '1' === $options['watermark_enabled']) {

        wp_enqueue_script(
            'accelvia-watermark',
            ACCELVIA_PLUGIN_URL . 'assets/js/watermark.js',
            array(), // No dependencies – pure Vanilla JS.
            ACCELVIA_VERSION,
            true // Load in footer.
        );

        $wm_config = array(
            'type'        => isset($options['watermark_type']) ? $options['watermark_type'] : 'text',
            'imageUrl'    => isset($options['watermark_image_url']) ? $options['watermark_image_url'] : '',
            'text'        => isset($options['watermark_text']) ? $options['watermark_text'] : __('© Protected by Accelvia', 'accelvia-content-protection'),
            'fontSize'    => isset($options['watermark_font_size']) ? absint($options['watermark_font_size']) : 16,
            'fontColor'   => isset($options['watermark_font_color']) ? $options['watermark_font_color'] : '#ffffff',
            'position'    => isset($options['watermark_position']) ? $options['watermark_position'] : 'bottom-right',
            'opacity'     => isset($options['watermark_opacity']) ? absint($options['watermark_opacity']) : 50,
            'size'        => isset($options['watermark_size']) ? absint($options['watermark_size']) : 30,
            'tileSpacing' => isset($options['watermark_tile_spacing']) ? absint($options['watermark_tile_spacing']) : 80,
            'scope'       => isset($options['watermark_scope']) ? $options['watermark_scope'] : 'all',
            'selector'    => isset($options['watermark_selector']) ? $options['watermark_selector'] : '',
            'excludeSelector' => isset($options['watermark_exclude_selector']) ? $options['watermark_exclude_selector'] : '',
            'device'      => isset($options['watermark_device']) ? $options['watermark_device'] : 'both',
        );

        wp_localize_script('accelvia-watermark', 'accelvia_watermark', $wm_config);
    }
}
add_action('wp_enqueue_scripts', 'accelvia_enqueue_frontend_protection');

/**
 * Inject an inline micro-script in <head> that blocks right-click IMMEDIATELY.
 *
 * This eliminates the race condition where protection.js hasn't loaded yet
 * during hot-reload or slow page loads, leaving right-click unprotected.
 *
 * Also injects a <noscript> block that hides page content when JavaScript
 * is disabled, since all protections depend on JavaScript.
 */
function accelvia_inline_head_protection()
{
    // Never run in admin.
    if (is_admin()) {
        return;
    }

    $options = get_option(ACCELVIA_OPTION_KEY, array());

    // Bail if protection is globally disabled.
    if (empty($options['enable_protection']) || '1' !== $options['enable_protection']) {
        return;
    }

    // Skip for logged-in administrators if that option is enabled.
    if (!empty($options['skip_admins']) && '1' === $options['skip_admins'] && current_user_can('manage_options')) {
        return;
    }

    // Respect Content Protection exclusions for the head guard too.
    if (accelvia_is_page_excluded_from_cp($options)) {
        return;
    }

    // --- Inline micro-script: blocks right-click before body even renders ---
    $inline_js = '';

    if (!empty($options['disable_right_click']) && '1' === $options['disable_right_click']) {
        $inline_js .= 'document.addEventListener("contextmenu",function(e){e.preventDefault();e.stopPropagation();return false;},true);';
    }

    if (!empty($options['disable_shortcuts']) && '1' === $options['disable_shortcuts']) {
        $inline_js .= 'document.addEventListener("keydown",function(e){var k=e.keyCode||e.which;var c=e.ctrlKey||e.metaKey;var s=e.shiftKey;if(k===123||c&&s&&(k===73||k===74||k===67)||c&&k===85||c&&k===83||c&&k===80){e.preventDefault();e.stopPropagation();return false;}},true);';
    }

    if (!empty($options['disable_text_selection']) && '1' === $options['disable_text_selection']) {
        $inline_js .= 'document.addEventListener("selectstart",function(e){e.preventDefault();},true);';
    }

    if (!empty($options['disable_devtools']) && '1' === $options['disable_devtools']) {
        // Immediate DevTools detection before body parses.
        $inline_js .= 'window._accelvia_dt=false;';
        $inline_js .= 'var dt=function(){var a=new Date().getTime();debugger;if(new Date().getTime()-a>100){window._accelvia_dt=true;}};';
        $inline_js .= 'dt();';
        // If detected instantly, start an infinite debugger loop in head.
        $inline_js .= 'if(window._accelvia_dt){setInterval(function(){debugger;},100);}';
    }

    if ($inline_js) {
        echo '<script id="accelvia-head-guard">' . $inline_js . '</script>' . "\n"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Hardcoded inline JS, no user input.
    }

    // --- CSS: disable text selection immediately (before JS loads) ---
    if (!empty($options['disable_text_selection']) && '1' === $options['disable_text_selection']) {
        echo '<style id="accelvia-noselect-guard">';
        echo 'html,body,body *{-webkit-user-select:none!important;-moz-user-select:none!important;-ms-user-select:none!important;user-select:none!important;}';
        echo '</style>' . "\n";
    }

    // --- Noscript guard: hide content if JavaScript is disabled ---
    echo '<noscript>' . "\n";
    echo '<style>';
    echo 'body > *:not(.accelvia-noscript-msg) { display: none !important; }';
    echo '.accelvia-noscript-msg { display: flex !important; }';
    echo '</style>' . "\n";
    echo '</noscript>' . "\n";
}
add_action('wp_head', 'accelvia_inline_head_protection', 1); // Priority 1 = very early.

/**
 * Inject a <noscript> message in the body when JavaScript is disabled.
 */
function accelvia_noscript_body_message()
{
    // Never run in admin.
    if (is_admin()) {
        return;
    }

    $options = get_option(ACCELVIA_OPTION_KEY, array());

    // Bail if protection is globally disabled.
    if (empty($options['enable_protection']) || '1' !== $options['enable_protection']) {
        return;
    }

    // Skip for logged-in administrators.
    if (!empty($options['skip_admins']) && '1' === $options['skip_admins'] && current_user_can('manage_options')) {
        return;
    }

    if (accelvia_is_page_excluded_from_cp($options)) {
        return;
    }

    echo '<noscript>';
    echo '<div class="accelvia-noscript-msg" style="position:fixed;top:0;left:0;width:100%;height:100%;background:#0f172a;color:#f1f5f9;display:flex;align-items:center;justify-content:center;flex-direction:column;z-index:2147483647;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif;text-align:center;padding:40px;">';
    echo '<svg width="64" height="64" viewBox="0 0 24 24" fill="none" stroke="#eab308" stroke-width="1.5"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/><path d="M12 8v4"/><circle cx="12" cy="15" r="0.5" fill="#eab308"/></svg>';
    echo '<h2 style="margin:20px 0 8px;font-size:22px;font-weight:700;">' . esc_html__('JavaScript Required', 'accelvia-content-protection') . '</h2>';
    echo '<p style="color:#94a3b8;font-size:15px;max-width:400px;line-height:1.6;margin:0;">' . esc_html__('This website requires JavaScript to be enabled for content protection. Please enable JavaScript in your browser settings and reload the page.', 'accelvia-content-protection') . '</p>';
    echo '</div>';
    echo '</noscript>' . "\n";
}
add_action('wp_body_open', 'accelvia_noscript_body_message', 1);

/**
 * Server-side HTML minification to deter view-source: inspection.
 *
 * Strips HTML comments, collapses excessive whitespace, and removes
 * blank lines from the output buffer. This makes view-source: show
 * a wall of compressed code that's difficult to read.
 *
 * Cannot prevent view-source: access (browser-level feature) but
 * makes the output significantly less useful to inspect.
 */
function accelvia_start_output_minification()
{
    // Never run in admin, AJAX, REST, or cron.
    if (is_admin() || wp_doing_ajax() || defined('REST_REQUEST') || wp_doing_cron()) {
        return;
    }

    $options = get_option(ACCELVIA_OPTION_KEY, array());

    // Bail if protection is globally disabled.
    if (empty($options['enable_protection']) || '1' !== $options['enable_protection']) {
        return;
    }

    // Skip for logged-in administrators.
    if (!empty($options['skip_admins']) && '1' === $options['skip_admins'] && current_user_can('manage_options')) {
        return;
    }

    if (accelvia_is_page_excluded_from_cp($options)) {
        return;
    }

    ob_start('accelvia_minify_html_output');
}

/**
 * Callback for ob_start — minifies and encodes the HTML output.
 *
 * Two-stage protection:
 * 1. Minify: strip comments, collapse whitespace (makes source harder to read).
 * 2. Encode: base64-encode the body content so view-source: shows gibberish.
 *    JavaScript decodes it at runtime for normal users.
 *
 * Search engine bots are excluded from encoding to preserve SEO.
 *
 * @param string $html Raw HTML output.
 * @return string Protected HTML.
 */
function accelvia_minify_html_output($html)
{
    if (empty($html)) {
        return $html;
    }

    // Don't process non-HTML content (feeds, JSON, etc.).
    if (strpos($html, '<!DOCTYPE') === false && strpos($html, '<html') === false) {
        return $html;
    }

    // --- Stage 1: Minification ---

    // Protect content inside <pre>, <textarea>, <script>, <style> from minification.
    $protected_blocks = array();
    $block_index = 0;
    $html = preg_replace_callback(
        '/<(pre|textarea|script|style)\b[^>]*>.*?<\/\1>/si',
        function ($match) use (&$protected_blocks, &$block_index) {
            $placeholder = '<!--ACCELVIA_BLOCK_' . $block_index . '-->';
            $protected_blocks[ $placeholder ] = $match[0];
            $block_index++;
            return $placeholder;
        },
        $html
    );

    // Remove HTML comments (preserve IE conditional comments and our placeholders).
    $html = preg_replace('/<!--(?!\[if)(?!ACCELVIA_BLOCK_)(?!<!).*?-->/s', '', $html);

    // Collapse whitespace between tags.
    $html = preg_replace('/>\s+</', '> <', $html);

    // Remove blank lines.
    $html = preg_replace('/\n\s*\n/', "\n", $html);

    // Collapse leading whitespace on each line.
    $html = preg_replace('/\n\s+/', "\n", $html);

    // Restore protected blocks.
    $html = str_replace(array_keys($protected_blocks), array_values($protected_blocks), $html);

    // --- Stage 2: Body content encoding (view-source protection) ---

    // Check if encrypted content is enabled.
    $options_check = get_option(ACCELVIA_OPTION_KEY, array());
    $encrypt_enabled = !empty($options_check['encrypt_content']) && '1' === $options_check['encrypt_content'];

    if (! $encrypt_enabled) {
        return $html;
    }

    // Skip encoding for search engine bots to preserve SEO.
    $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? strtolower(sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT']))) : '';
    $bot_patterns = array(
        'googlebot', 'bingbot', 'slurp', 'duckduckbot', 'baiduspider',
        'yandexbot', 'facebot', 'ia_archiver', 'semrushbot', 'ahrefsbot',
        'mj12bot', 'rogerbot', 'dotbot', 'petalbot', 'sogou', 'applebot',
        'twitterbot', 'linkedinbot', 'discordbot', 'whatsapp', 'telegrambot',
    );

    $is_bot = false;
    foreach ($bot_patterns as $bot) {
        if (strpos($user_agent, $bot) !== false) {
            $is_bot = true;
            break;
        }
    }

    // Only encode for real users, not bots.
    if (! $is_bot && preg_match('/(<body[^>]*>)(.*?)(<\/body>)/si', $html, $body_match)) {
        $body_open    = $body_match[1];
        $body_content = $body_match[2];
        $body_close   = $body_match[3];

        // Extract <script> tags from body — keep them separate so they execute normally.
        $scripts = array();
        $content_without_scripts = preg_replace_callback(
            '/<script\b[^>]*>.*?<\/script>/si',
            function ($match) use (&$scripts) {
                $scripts[] = $match[0];
                return ''; // Remove from content.
            },
            $body_content
        );

        // Base64-encode the non-script content.
        // Base64 charset (A-Z, a-z, 0-9, +, /, =) is HTML-attribute-safe.
        $encoded = base64_encode($content_without_scripts);

        // Build the protected body.
        $protected_body  = $body_open;

        // Encoded content container (hidden).
        $protected_body .= '<div id="_ap" style="display:none" data-c="' . $encoded . '"></div>';

        // Decoder script — runs immediately, decodes and injects the real content.
        $protected_body .= '<script id="_apd">';
        $protected_body .= '(function(){';
        $protected_body .= 'var d=document.getElementById("_ap");';
        $protected_body .= 'if(!d)return;';
        // Check if DevTools was detected by the head guard. If yes, refuse to decode layout.
        $protected_body .= 'if(window._accelvia_dt)return;';
        $protected_body .= 'var h=atob(d.getAttribute("data-c"));';
        // Create a temporary container, set innerHTML, then move children.
        $protected_body .= 'var f=document.createDocumentFragment();';
        $protected_body .= 'var t=document.createElement("div");';
        $protected_body .= 't.innerHTML=h;';
        $protected_body .= 'while(t.firstChild){f.appendChild(t.firstChild);}';
        $protected_body .= 'd.parentNode.replaceChild(f,d);';
        $protected_body .= '})();';
        $protected_body .= '</script>';

        // Re-insert extracted scripts (they execute in original order).
        $protected_body .= implode('', $scripts);

        $protected_body .= $body_close;

        // Replace original body in full HTML.
        $html = str_replace($body_match[0], $protected_body, $html);
    }

    return $html;
}
add_action('template_redirect', 'accelvia_start_output_minification', 1);


/**
 * Add security-related HTTP headers when protection is active.
 */
function accelvia_add_security_headers()
{
    if (is_admin()) {
        return;
    }

    $options = get_option(ACCELVIA_OPTION_KEY, array());

    if (empty($options['enable_protection']) || '1' !== $options['enable_protection']) {
        return;
    }

    // Skip for logged-in administrators.
    if (!empty($options['skip_admins']) && '1' === $options['skip_admins'] && current_user_can('manage_options')) {
        return;
    }

    // Prevent MIME-type sniffing.
    header('X-Content-Type-Options: nosniff');

    // Prevent the page from being embedded in iframes (clickjacking protection).
    header('X-Frame-Options: SAMEORIGIN');
}
add_action('send_headers', 'accelvia_add_security_headers');