<?php
/**
 * IP brute-force throttle.
 *
 * Reacts to repeated failed login attempts from the same IP by short-
 * circuiting the WordPress authentication flow. Uses transients so it
 * works on any host without extra storage.
 *
 * @package ActivityPilot
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class APWPM_IP_Throttle {

	const TRANSIENT_PREFIX = 'apwpm_ipt_';
	const BLOCK_PREFIX     = 'apwpm_ipb_';

	public static function init() {
		$s = (array) get_option( 'apwpm_settings', array() );
		if ( empty( $s['enable_ip_throttle'] ) ) {
			return;
		}
		add_filter( 'authenticate', array( __CLASS__, 'pre_auth' ), 30, 3 );
		add_action( 'wp_login_failed', array( __CLASS__, 'on_failed_login' ), 5 );
		add_action( 'wp_login', array( __CLASS__, 'on_login_success' ), 10, 2 );
	}

	protected static function ip() {
		$candidates = array( 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'REMOTE_ADDR' );
		foreach ( $candidates as $key ) {
			if ( empty( $_SERVER[ $key ] ) ) {
				continue;
			}
			$value = sanitize_text_field( wp_unslash( $_SERVER[ $key ] ) );
			if ( strpos( $value, ',' ) !== false ) {
				$value = trim( explode( ',', $value )[0] );
			}
			if ( filter_var( $value, FILTER_VALIDATE_IP ) ) {
				return $value;
			}
		}
		return '';
	}

	protected static function settings() {
		$s      = (array) get_option( 'apwpm_settings', array() );
		$limit  = isset( $s['ip_throttle_limit'] ) ? max( 3, (int) $s['ip_throttle_limit'] ) : 5;
		$window = isset( $s['ip_throttle_window'] ) ? max( 1, (int) $s['ip_throttle_window'] ) : 5;
		return array( $limit, $window );
	}

	public static function pre_auth( $user, $username, $password ) {
		if ( is_wp_error( $user ) ) {
			return $user;
		}
		$ip = self::ip();
		if ( ! $ip ) {
			return $user;
		}
		if ( get_transient( self::BLOCK_PREFIX . md5( $ip ) ) ) {
			return new WP_Error( 'apwpm_blocked',
				__( 'Too many failed login attempts. Please try again later.', 'activitypilot' )
			);
		}
		return $user;
	}

	public static function on_failed_login( $username ) {
		$ip = self::ip();
		if ( ! $ip ) {
			return;
		}
		list( $limit, $window ) = self::settings();
		$key      = self::TRANSIENT_PREFIX . md5( $ip );
		$attempts = (int) get_transient( $key );
		$attempts++;
		set_transient( $key, $attempts, $window * MINUTE_IN_SECONDS );

		if ( $attempts >= $limit ) {
			set_transient( self::BLOCK_PREFIX . md5( $ip ), 1, $window * MINUTE_IN_SECONDS );
			APWPM_Logger::log(
				array(
					'action_type'  => 'ip_blocked',
					'object_type'  => 'ip',
					'object_title' => $ip,
					'description'  => sprintf(
						/* translators: 1: IP, 2: count, 3: window */
						__( 'IP %1$s blocked after %2$d failed logins within %3$d minutes.', 'activitypilot' ),
						$ip,
						$attempts,
						$window
					),
					'severity'     => 'critical',
					'context'      => array(
						'ip'       => $ip,
						'attempts' => $attempts,
						'window'   => $window,
					),
				)
			);
		}
	}

	public static function on_login_success( $user_login, $user ) {
		$ip = self::ip();
		if ( $ip ) {
			delete_transient( self::TRANSIENT_PREFIX . md5( $ip ) );
		}
	}

	public static function unblock_ip( $ip ) {
		delete_transient( self::BLOCK_PREFIX . md5( $ip ) );
		delete_transient( self::TRANSIENT_PREFIX . md5( $ip ) );
		return true;
	}
}