<?php
/**
 * AdProtektor first-party tracking — the WordPress proxy.
 *
 * Serves the AdProtektor tracking script and relays its requests through this
 * site's own origin under a base path (default /_adp), so to the browser the
 * tracking is first-party traffic: filter lists that block AdProtektor by
 * domain (cdn.adprotektor.app / api.adprotektor.app) do not match it.
 * adprotektor.php loads this file only when "First-party tracking" is on and a
 * site key is saved. The site key is what lets AdProtektor trust the visitor IP
 * (and, behind a trusted edge, the JA4) this proxy forwards; the backend
 * ignores forwarded signals from unauthenticated callers.
 *
 * Sites without WordPress use the standalone proxy,
 * integrations/php/adprotektor-firstparty.php. This class does the same job
 * with WordPress's own APIs: the HTTP API instead of cURL, a transient instead
 * of temp files for the script cache, and unslashed input. Until 1.17.1 the
 * plugin bundled the standalone file, which read $_SERVER as WordPress leaves
 * it — slashed — and so relayed a verified AI agent's quoted Signature headers
 * with backslashes in them, which never verified. cdn/build.js fails the build
 * when the two proxies disagree on what they relay (the script names, the API
 * paths and the custom-script pattern), so an endpoint added to one cannot be
 * missing from the other.
 */

if (!defined('ABSPATH')) {
    exit;
}

final class AdProtektor_First_Party {

    /**
     * The only scripts served, by first-party name → the CDN bundle. t.js is
     * the opaque entry point (filter lists also match on the file name); the
     * rest are the bundles track.js loads from its own base. Any other name
     * 404s: an open *.js passthrough would fetch unintended CDN paths and let
     * any visitor fill the cache.
     */
    const BUNDLES = array(
        't.js'               => 'track.js',
        'track.js'           => 'track.js',
        'track.min.js'       => 'track.min.js',
        'rrweb.min.js'       => 'rrweb.min.js',
        'conversions.min.js' => 'conversions.min.js',
    );

    /** The tracking endpoints relayed — this is not an open proxy. */
    const API_PATHS = array(
        '/v1/tracking/event',
        '/v1/tracking/config',
        '/v1/tracking/recording',
        '/v1/tracking/recording-telemetry',
        // Page click/scroll heatmaps (cdn/src/heatmap.js, Pro and up).
        '/v1/tracking/heatmap',
        '/v1/tracking/heatmap-snapshot',
    );

    /**
     * Custom Scripts are one path per snippet, so they need a pattern rather
     * than a fixed entry. The character classes mirror the backend route's own
     * {host}/{scriptId} constraints, keeping this a narrow allowlist rather
     * than a wildcard passthrough to /v1/tracking/*.
     */
    const CUSTOM_SCRIPT_PATTERN = '#^/v1/tracking/cs/[A-Za-z0-9.-]+/[A-Za-z0-9_-]+\.js$#';

    /** Seconds to wait for the CDN or the API. */
    const TIMEOUT = 10;

    private $site_key;
    private $base_path;
    private $trusted_edge;
    private $ja4_header;
    private $ja4h_header;
    private $cdn_host;
    private $api_host;
    private $cache_ttl;

    /**
     * The proxy configured from Settings → AdProtektor. A constant of the same
     * name defined in wp-config.php wins, as it did when the plugin bundled the
     * standalone proxy.
     */
    public static function from_settings() {
        return new self(array(
            'site_key'     => defined('ADPROTEKTOR_SITE_KEY') ? ADPROTEKTOR_SITE_KEY : get_option('adprotektor_site_key', ''),
            'base_path'    => defined('ADPROTEKTOR_BASE_PATH') ? ADPROTEKTOR_BASE_PATH : '/_adp',
            // Only when the admin confirms an edge (Cloudflare/nginx) fronts this
            // site; otherwise forwarded IP/JA4 headers are visitor-controlled.
            'trusted_edge' => defined('ADPROTEKTOR_TRUSTED_EDGE') ? ADPROTEKTOR_TRUSTED_EDGE : get_option('adprotektor_trusted_edge', false),
            'ja4_header'   => defined('ADPROTEKTOR_JA4_HEADER') ? ADPROTEKTOR_JA4_HEADER : get_option('adprotektor_ja4_header', 'X-Adp-JA4'),
            'ja4h_header'  => defined('ADPROTEKTOR_JA4H_HEADER') ? ADPROTEKTOR_JA4H_HEADER : get_option('adprotektor_ja4h_header', 'X-Adp-JA4H'),
            'cdn_host'     => defined('ADPROTEKTOR_CDN_HOST') ? ADPROTEKTOR_CDN_HOST : 'https://cdn.adprotektor.app',
            'api_host'     => defined('ADPROTEKTOR_API_HOST') ? ADPROTEKTOR_API_HOST : 'https://api.adprotektor.app',
            // The CDN sends no-cache; a short local TTL keeps the proxy fast without
            // delaying bundle updates more than a few minutes.
            'cache_ttl'    => defined('ADPROTEKTOR_JS_CACHE_TTL') ? ADPROTEKTOR_JS_CACHE_TTL : 600,
        ));
    }

    public function __construct(array $settings) {
        $this->site_key = (string) $settings['site_key'];
        $this->base_path = rtrim((string) $settings['base_path'], '/');
        $this->trusted_edge = (bool) $settings['trusted_edge'];
        $this->ja4_header = (string) $settings['ja4_header'];
        $this->ja4h_header = (string) $settings['ja4h_header'];
        $this->cdn_host = rtrim((string) $settings['cdn_host'], '/');
        $this->api_host = rtrim((string) $settings['api_host'], '/');
        $this->cache_ttl = max(0, (int) $settings['cache_ttl']);
    }

    /** Intercept as early as possible, before WordPress routes or redirects the request. */
    public function register() {
        add_action('init', array($this, 'dispatch'), 0);
    }

    /** Answer the request and stop if it is for the base path; otherwise WordPress carries on. */
    public function dispatch() {
        // Every request on the site passes here: leave the ones that are not ours
        // before reading anything else of them, the body above all.
        if ($this->subpath((string) wp_parse_url(self::server_value('REQUEST_URI'), PHP_URL_PATH)) === null) {
            return;
        }
        $response = $this->handle($this->current_request());
        if ($response === null) {
            return;
        }
        if (!headers_sent()) {
            http_response_code($response['status']);
            foreach ($response['headers'] as $header) {
                header($header, stripos($header, 'Set-Cookie:') !== 0);
            }
        }
        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- the tracking script or the API's JSON, relayed byte for byte under its own Content-Type; escaping would corrupt it.
        echo $response['body'];
        exit;
    }

    /**
     * This request as handle() takes it: unslashed (WordPress adds slashes to
     * $_SERVER) and stripped of tags. wp_strip_all_tags() rather than
     * sanitize_text_field(), because these values are relayed and must reach
     * AdProtektor as the visitor sent them — sanitize_text_field() drops
     * percent-encoded octets and collapses whitespace, which would rewrite the
     * request target and the user agent and break a verified agent's
     * signature. Control characters are stripped where a value becomes an
     * outbound header (clean()).
     */
    public function current_request() {
        $names = array(
            'Accept-Language', 'User-Agent', 'Origin', 'Referer', 'Cookie', 'Host',
            'CF-Connecting-IP', 'X-Forwarded-For', 'X-Forwarded-Proto',
            'Signature-Agent', 'Signature-Input', 'Signature', 'If-None-Match',
            $this->ja4_header, $this->ja4h_header,
        );
        $headers = array();
        foreach ($names as $name) {
            $value = $name === '' ? '' : self::server_value('HTTP_' . strtoupper(str_replace('-', '_', $name)));
            if ($value !== '') {
                $headers[strtolower($name)] = $value;
            }
        }
        // PHP exposes the request's Content-Type as CONTENT_TYPE, and only some
        // servers as HTTP_CONTENT_TYPE too (Apache does not).
        $type = self::server_value('CONTENT_TYPE');
        if ($type === '') {
            $type = self::server_value('HTTP_CONTENT_TYPE');
        }
        if ($type !== '') {
            $headers['content-type'] = $type;
        }

        $method = strtoupper(self::server_value('REQUEST_METHOD'));
        $method = preg_match('/^[A-Z]+$/', $method) ? $method : 'GET';
        return array(
            'method'      => $method,
            'uri'         => self::server_value('REQUEST_URI'),
            'https'       => is_ssl(),
            'remote_addr' => self::server_value('REMOTE_ADDR'),
            'headers'     => $headers,
            'body'        => in_array($method, array('POST', 'PUT'), true) ? (string) file_get_contents('php://input') : '',
        );
    }

    /**
     * The response for a request, or null when it is not for the base path.
     *
     * @param array $request method, uri, https, remote_addr, headers (lower-case names), body
     * @return array|null status, headers ("Name: value" lines), body
     */
    public function handle(array $request) {
        $sub = $this->subpath((string) wp_parse_url($request['uri'], PHP_URL_PATH));
        if ($sub === null) {
            return null;
        }
        $sub = $sub === '' ? '/' : $sub;

        // Custom Scripts: track.js builds each snippet's <script src> from its
        // OWN src, so on a first-party install they arrive here as
        // <base>/cs/<host>/<id>.js. Checked BEFORE the .js branch below, which
        // only knows the fixed bundle names and would 404 these. Relaying them
        // is what keeps customer snippets first-party — otherwise track.js's
        // onerror fallback refetches them from api.adprotektor.app, the very
        // third-party origin this proxy exists to avoid.
        if (strpos($sub, '/cs/') === 0) {
            return $this->relay('/v1/tracking' . $sub, $request);
        }
        if (preg_match('/\.js$/i', $sub)) {
            return $this->script(ltrim($sub, '/'), $request);
        }
        return $this->relay($sub, $request);
    }

    /** The request path relative to the base path, or null when this request is not for us. */
    private function subpath($path) {
        // A base path of "/" would capture every request on the site.
        if ($this->base_path === '') {
            return null;
        }
        if ($path === $this->base_path || strpos($path, $this->base_path . '/') === 0) {
            return substr($path, strlen($this->base_path)); // e.g. "/t.js", "/v1/tracking/event"
        }
        return null;
    }

    /**
     * A script bundle from the CDN, cached for cache_ttl seconds. The cached
     * copy is kept for a week, so the last good bundle is still served while
     * the CDN cannot be reached; WordPress removes it once it expires.
     */
    private function script($name, array $request) {
        if (!array_key_exists($name, self::BUNDLES)) {
            return self::bare(404);
        }
        $remote = self::BUNDLES[$name];
        $key = 'adprotektor_fp_' . str_replace('.', '_', $remote);

        $cached = get_transient($key);
        $cached_body = (is_array($cached) && isset($cached['body']) && is_string($cached['body'])) ? $cached['body'] : '';
        if ($cached_body !== '' && isset($cached['fetched']) && time() - (int) $cached['fetched'] < $this->cache_ttl) {
            return self::javascript($cached_body, $request);
        }

        $response = wp_remote_get($this->cdn_host . '/' . $remote, array('timeout' => self::TIMEOUT));
        if (!is_wp_error($response) && (int) wp_remote_retrieve_response_code($response) === 200) {
            $body = (string) wp_remote_retrieve_body($response);
            // An empty 200 is a broken upstream, never a bundle to cache.
            if ($body !== '') {
                set_transient($key, array('fetched' => time(), 'body' => $body), WEEK_IN_SECONDS);
                return self::javascript($body, $request);
            }
        }

        // Upstream failed — fall back to the last good copy if we have one.
        if ($cached_body !== '') {
            return self::javascript($cached_body, $request);
        }
        return self::bare(502);
    }

    /** Relay a tracking API call upstream, adding the site-key-gated visitor signals. */
    private function relay($sub, array $request) {
        $path = '/' . ltrim($sub, '/');
        if (!in_array($path, self::API_PATHS, true) && !preg_match(self::CUSTOM_SCRIPT_PATTERN, $path)) {
            return self::bare(404);
        }
        $query = (string) wp_parse_url($request['uri'], PHP_URL_QUERY);
        $url = $this->api_host . $path . ($query !== '' ? '?' . $query : '');
        $in = $request['headers'];

        // The visitor's own request headers, where they matter.
        $headers = array();
        $passthrough = array(
            'content-type'    => 'Content-Type',
            'accept-language' => 'Accept-Language',
            'origin'          => 'Origin',
            'referer'         => 'Referer',
        );
        foreach ($passthrough as $key => $name) {
            if (isset($in[$key]) && $in[$key] !== '') {
                $headers[$name] = self::clean($in[$key]);
            }
        }
        // Forward ONLY our own cookies (the HttpOnly adp_sid identity cookie
        // round-trips here). Passing the whole Cookie header would send the
        // visitor's wordpress_logged_in_* / wordpress_sec_* authentication
        // cookies — plus whatever every other plugin on the site sets — to an
        // external host on every proxied request. Those are WordPress session
        // credentials; nothing upstream needs them.
        if (isset($in['cookie'])) {
            $forwarded = array();
            foreach (explode(';', $in['cookie']) as $pair) {
                $name = trim((string) strtok($pair, '='));
                if ($name !== '' && strpos($name, 'adp_') === 0) {
                    $forwarded[] = trim($pair);
                }
            }
            if ($forwarded) {
                $headers['Cookie'] = self::clean(implode('; ', $forwarded));
            }
        }

        // Trusted, site-key-gated visitor signals.
        $headers['X-Adp-Site-Key'] = self::clean($this->site_key);
        $ip = $this->client_ip($request);
        if ($ip !== null) {
            $headers['X-Adp-Client-IP'] = $ip; // already FILTER_VALIDATE_IP-checked
        }
        // JA4 is only forwarded behind a trusted edge — on a bare host the
        // inbound JA4 header is client-supplied and a bot could spoof a clean
        // fingerprint to evade JA4-based blocking.
        if ($this->trusted_edge) {
            $ja4 = array($this->ja4_header => 'X-Adp-Client-JA4', $this->ja4h_header => 'X-Adp-Client-JA4H');
            foreach ($ja4 as $inbound => $name) {
                $value = isset($in[strtolower($inbound)]) ? self::clean($in[strtolower($inbound)]) : '';
                if ($value !== '') {
                    $headers[$name] = $value;
                }
            }
        }
        // Verified AI agents (Web Bot Auth): an assistant such as ChatGPT agent
        // signs this request to THIS host, and that signature can only be checked
        // against the original request — so relay it with the authority, method,
        // scheme and request target it was sent with. Unlike JA4 this is safe on
        // a bare host: a forged value simply fails the cryptographic check. The
        // backend reads these only behind the site key above.
        if (isset($in['signature-agent']) && $in['signature-agent'] !== '') {
            $scheme = $request['https'] ? 'https' : 'http';
            $proto = isset($in['x-forwarded-proto']) ? strtolower($in['x-forwarded-proto']) : '';
            if ($this->trusted_edge && in_array($proto, array('http', 'https'), true)) {
                $scheme = $proto;
            }
            $signature = array(
                'X-Adp-Sig-Agent'     => $in['signature-agent'],
                'X-Adp-Sig-Input'     => isset($in['signature-input']) ? $in['signature-input'] : '',
                'X-Adp-Sig'           => isset($in['signature']) ? $in['signature'] : '',
                'X-Adp-Sig-Authority' => isset($in['host']) ? $in['host'] : '',
                'X-Adp-Sig-Method'    => $request['method'],
                'X-Adp-Sig-Scheme'    => $scheme,
                'X-Adp-Sig-Target'    => $request['uri'],
            );
            foreach ($signature as $name => $value) {
                if ($value !== '') {
                    $headers[$name] = self::clean($value);
                }
            }
        }

        $args = array(
            'method'      => $request['method'],
            'timeout'     => self::TIMEOUT,
            'redirection' => 0,
            'headers'     => $headers,
            // The visitor's, never WordPress's own: with none, none is sent.
            'user-agent'  => isset($in['user-agent']) ? self::clean($in['user-agent']) : '',
        );
        if (in_array($request['method'], array('POST', 'PUT'), true)) {
            $args['body'] = $request['body'];
        }
        $response = wp_remote_request($url, $args);
        if (is_wp_error($response)) {
            return self::bare(502);
        }
        $status = (int) wp_remote_retrieve_response_code($response);
        if ($status < 100) {
            return self::bare(502);
        }

        $type = self::header_values($response, 'content-type');
        $out = array('Content-Type: ' . self::clean($type ? end($type) : 'application/json'));
        // Relay the upstream cache policy and nosniff verbatim. Custom-script
        // responses are immutable on a content-hash hit, so swallowing
        // Cache-Control here would make every page load refetch every snippet
        // through this proxy.
        $cache = self::header_values($response, 'cache-control');
        if ($cache) {
            $out[] = 'Cache-Control: ' . self::clean(implode(', ', $cache));
        }
        $nosniff = self::header_values($response, 'x-content-type-options');
        if ($nosniff) {
            $out[] = 'X-Content-Type-Options: ' . self::clean(end($nosniff));
        }
        // Only the AdProtektor identity cookie — never arbitrary upstream cookies
        // onto this host — with the upstream Domain stripped, so it binds
        // host-only to this first-party domain.
        foreach (self::header_values($response, 'set-cookie') as $cookie) {
            if (preg_match('/^adp_sid=/i', $cookie)) {
                $out[] = 'Set-Cookie: ' . self::clean(preg_replace('/;\s*Domain=[^;]+/i', '', $cookie));
            }
        }

        return array(
            'status'  => $status,
            'headers' => $out,
            'body'    => $request['method'] === 'HEAD' ? '' : (string) wp_remote_retrieve_body($response),
        );
    }

    /**
     * The real visitor IP. Only behind a trusted edge are the forwarded headers
     * believed (CF-Connecting-IP, then the first X-Forwarded-For); otherwise the
     * browser connects here directly, REMOTE_ADDR is authoritative, and any
     * X-Forwarded-For is attacker-supplied.
     */
    private function client_ip(array $request) {
        $in = $request['headers'];
        if ($this->trusted_edge) {
            $cf = isset($in['cf-connecting-ip']) ? trim($in['cf-connecting-ip']) : '';
            if ($cf !== '' && filter_var($cf, FILTER_VALIDATE_IP)) {
                return $cf;
            }
            if (isset($in['x-forwarded-for'])) {
                $first = trim(explode(',', $in['x-forwarded-for'])[0]);
                if (filter_var($first, FILTER_VALIDATE_IP)) {
                    return $first;
                }
            }
        }
        return filter_var($request['remote_addr'], FILTER_VALIDATE_IP) ? $request['remote_addr'] : null;
    }

    /** Every value of a response header, in order. */
    private static function header_values($response, $name) {
        $value = wp_remote_retrieve_header($response, $name);
        $values = is_array($value) ? $value : array($value);
        return array_values(array_filter(array_map('strval', $values), 'strlen'));
    }

    /** One request header or CGI variable as the visitor sent it. See current_request(). */
    private static function server_value($key) {
        return isset($_SERVER[$key]) ? wp_strip_all_tags(wp_unslash($_SERVER[$key])) : '';
    }

    /**
     * Strip CR/LF and other control characters from a value before it goes into
     * a header — defence in depth against header injection if an inbound value
     * (User-Agent, edge JA4, …) carries a newline.
     */
    private static function clean($value) {
        return preg_replace('/[\r\n\x00-\x1F\x7F]+/', ' ', (string) $value);
    }

    /**
     * A script response. no-cache makes the browser revalidate on every page
     * view, and without a validator revalidating means downloading the whole
     * bundle again (track.js is ~700 KB), so it carries an ETag and a matching
     * If-None-Match is answered 304. "W/" is ignored: nginx weakens the ETag of
     * a response it gzips.
     */
    private static function javascript($body, array $request) {
        $etag = '"' . md5($body) . '"';
        $headers = array(
            'Content-Type: application/javascript; charset=utf-8',
            'Cache-Control: no-cache, must-revalidate, max-age=0',
            'ETag: ' . $etag,
        );
        $match = isset($request['headers']['if-none-match']) ? $request['headers']['if-none-match'] : '';
        if ($match !== '' && in_array($etag, array_map('trim', explode(',', str_replace('W/', '', $match))), true)) {
            return array('status' => 304, 'headers' => $headers, 'body' => '');
        }
        return array('status' => 200, 'headers' => $headers, 'body' => $body);
    }

    private static function bare($status) {
        return array('status' => $status, 'headers' => array(), 'body' => '');
    }
}