<?php

if (!defined('ABSPATH')) {
    exit;
}

class AdGhost_Crawler_Allowlist {

    const VERIFIED_DOMAINS = [
        '.googlebot.com',
        '.google.com',
        '.search.msn.com',
        '.crawl.yahoo.net',
        '.applebot.apple.com',
        '.duckduckgo.com',
    ];

    const UA_HINTS = [
        'googlebot', 'google-inspectiontool', 'storebot-google', 'adsbot-google',
        'mediapartners-google', 'bingbot', 'adidxbot', 'msnbot',
        'slurp', 'duckduckbot', 'applebot',
    ];

    const CACHE_TTL = DAY_IN_SECONDS;

    const DNS_LOOKUPS_PER_MINUTE = 30;

    public static function is_verified_crawler($ip = null, $ua = null) {
        $ip = $ip ?? (isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '');
        $ua = strtolower($ua ?? (isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : ''));

        if ($ip === '' || $ua === '') {
            return false;
        }

        $claims = false;
        foreach (self::UA_HINTS as $hint) {
            if (strpos($ua, $hint) !== false) {
                $claims = true;
                break;
            }
        }
        if (!$claims) {
            return false;
        }

        if (!filter_var($ip, FILTER_VALIDATE_IP)) {
            return false;
        }

        $cache_key = 'adghost_crawler_' . md5($ip);
        $cached    = get_transient($cache_key);
        if ($cached !== false) {
            return $cached === 'yes';
        }

        if (!self::dns_budget()) {
            return false;
        }

        $verified = self::reverse_dns_verify($ip);
        set_transient($cache_key, $verified ? 'yes' : 'no', self::CACHE_TTL);

        return $verified;
    }

    private static function dns_budget() {
        $key   = 'adghost_crawler_dns_' . gmdate('YmdHi');
        $spent = (int) get_transient($key);
        if ($spent >= self::DNS_LOOKUPS_PER_MINUTE) {
            return false;
        }
        set_transient($key, $spent + 1, 2 * MINUTE_IN_SECONDS);
        return true;
    }

    private static function reverse_dns_verify($ip) {
        $host = @gethostbyaddr($ip);
        if (!$host || $host === $ip) {
            return false;
        }

        $host = strtolower(rtrim($host, '.'));

        $recognised = false;
        foreach (self::VERIFIED_DOMAINS as $domain) {
            if (substr($host, -strlen($domain)) === $domain) {
                $recognised = true;
                break;
            }
        }
        if (!$recognised) {
            return false;
        }

        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
            $records = @dns_get_record($host, DNS_AAAA);
            foreach ((array) $records as $record) {
                if (!empty($record['ipv6']) && inet_pton($record['ipv6']) === inet_pton($ip)) {
                    return true;
                }
            }
            return false;
        }

        $forward = @gethostbynamel($host);
        return is_array($forward) && in_array($ip, $forward, true);
    }
}