<?php
/**
 * Privacy and request filtering.
 *
 * Handles:
 * - Determining which requests to skip (admin, cron, AJAX, REST, denied paths)
 * - Client IP detection through proxy chains (Cloudflare, load balancers, etc.)
 * - Sensitive query parameter redaction (passwords, tokens, credit cards)
 * - Input sanitization for safe storage and transmission
 *
 * @package Aiadvisors
 */

namespace Aiadvisors;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Privacy {

	/**
	 * Paths that are always excluded from tracking.
	 */
	private static $always_deny = array(
		'wp-admin',
		'wp-login.php',
		'wp-cron.php',
		'admin-ajax.php',
		'wp-json/wp/v2/users',
		'xmlrpc.php',
	);

	/**
	 * Check if the current request should be skipped.
	 *
	 * @param Settings $settings Plugin settings.
	 * @return bool True if request should be skipped.
	 */
	public static function should_skip_request( $settings ) {
		// Skip admin requests.
		if ( is_admin() && ! wp_doing_ajax() ) {
			return true;
		}

		// Skip cron.
		if ( defined( 'DOING_CRON' ) && DOING_CRON ) {
			return true;
		}

		// Skip AJAX.
		if ( wp_doing_ajax() ) {
			return true;
		}

		// Skip CLI.
		if ( defined( 'WP_CLI' ) && WP_CLI ) {
			return true;
		}

		// Skip REST API calls.
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( isset( $_GET['rest_route'] ) ) {
			return true;
		}

		$request_uri = isset( $_SERVER['REQUEST_URI'] )
			? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) )
			: '';

		if ( strpos( $request_uri, '/wp-json/' ) !== false ) {
			return true;
		}

		// Skip if referrer is from wp-admin.
		if ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
			$referer = sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) );
			if ( strpos( $referer, 'wp-admin' ) !== false ) {
				return true;
			}
		}

		// Check always-denied paths.
		$path = self::get_safe_path();
		foreach ( self::$always_deny as $deny ) {
			if ( strpos( $path, $deny ) !== false ) {
				return true;
			}
		}

		return false;
	}

	/**
	 * Get the real client IP address, handling proxies and CDNs.
	 *
	 * Checks headers in priority order:
	 * 1. X-Forwarded-For (standard proxy header)
	 * 2. CF-Connecting-IP (Cloudflare)
	 * 3. X-Real-IP (nginx)
	 * 4. True-Client-IP (Akamai, Cloudflare Enterprise)
	 * 5. REMOTE_ADDR (direct connection)
	 *
	 * @return string IP address or '0.0.0.0' if not determinable.
	 */
	public static function get_client_ip() {
		$remote_addr = isset( $_SERVER['REMOTE_ADDR'] )
			? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) )
			: '';

		// Forwarded headers are attacker-controllable, so only honor them when
		// the direct peer (REMOTE_ADDR) is a configured trusted proxy. By
		// default no proxies are trusted, so a visitor cannot spoof their IP.
		$trusted = self::trusted_proxies();
		if ( $remote_addr && ! empty( $trusted ) && in_array( $remote_addr, $trusted, true ) ) {
			$headers = array(
				'HTTP_CF_CONNECTING_IP', // Cloudflare
				'HTTP_TRUE_CLIENT_IP',   // Akamai / Cloudflare Enterprise
				'HTTP_X_REAL_IP',        // nginx
				'HTTP_X_FORWARDED_FOR',  // standard proxy chain
			);
			foreach ( $headers as $header ) {
				if ( ! empty( $_SERVER[ $header ] ) ) {
					$value = sanitize_text_field( wp_unslash( $_SERVER[ $header ] ) );
					// X-Forwarded-For can contain multiple IPs; take the first.
					if ( $header === 'HTTP_X_FORWARDED_FOR' ) {
						$ips   = explode( ',', $value );
						$value = trim( $ips[0] );
					}
					if ( self::is_valid_ip( $value ) ) {
						return substr( $value, 0, 45 ); // Support IPv6.
					}
				}
			}
		}

		return ( $remote_addr && self::is_valid_ip( $remote_addr ) ) ? substr( $remote_addr, 0, 45 ) : '0.0.0.0';
	}

	/**
	 * Trusted proxy IPs whose forwarded headers may be honored. Empty by
	 * default. Configure via the AIADVISORS_TRUSTED_PROXIES constant
	 * (comma-separated) or the 'aiadvisors_trusted_proxies' filter.
	 *
	 * @return array
	 */
	private static function trusted_proxies() {
		$proxies = array();
		if ( defined( 'AIADVISORS_TRUSTED_PROXIES' ) && AIADVISORS_TRUSTED_PROXIES ) {
			$proxies = array_map( 'trim', explode( ',', (string) AIADVISORS_TRUSTED_PROXIES ) );
		}
		$proxies = apply_filters( 'aiadvisors_trusted_proxies', $proxies );
		return is_array( $proxies ) ? $proxies : array();
	}

	/**
	 * Validate an IP address (v4 or v6).
	 */
	private static function is_valid_ip( $ip ) {
		return filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6 ) !== false;
	}

	/**
	 * Get safe, sanitized URL path from request.
	 *
	 * @return string URL path (max 2048 chars).
	 */
	public static function get_safe_path() {
		$path = '/';

		if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
			$parsed = wp_parse_url( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
			$path   = $parsed['path'] ?? '/';
		}

		$path = '/' . trim( $path, '/' );
		if ( $path !== '/' ) {
			$path = rtrim( $path, '/' );
		}

		return substr( $path, 0, 2048 );
	}

	/**
	 * Sanitize and truncate a user-agent string.
	 *
	 * @return string Cleaned UA string (max 1024 chars).
	 */
	public static function sanitize_user_agent( $user_agent ) {
		if ( empty( $user_agent ) ) {
			return '';
		}
		$clean = preg_replace( '/[\x00-\x1F\x7F]/', '', $user_agent );
		return substr( $clean, 0, 1024 );
	}

	/**
	 * Sanitize a referer URL.
	 *
	 * @return string|null Valid URL or null.
	 */
	public static function sanitize_referer( $referer ) {
		if ( empty( $referer ) ) {
			return null;
		}
		if ( ! filter_var( $referer, FILTER_VALIDATE_URL ) ) {
			return null;
		}
		return substr( $referer, 0, 2048 );
	}

	/**
	 * Redact sensitive query parameters.
	 *
	 * @param Settings $settings Plugin settings (for redact_query_keys config).
	 * @return array Redacted key-value pairs.
	 */
	public static function redact_query_params( $settings ) {
        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( empty( $_GET ) ) {
			return array();
		}

		$redact_keys = $settings->get( 'redact_query_keys', '' );
		if ( empty( $redact_keys ) ) {
            // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			return self::sanitize_params( $_GET );
		}

		$redact_list = array_map( 'trim', explode( ',', strtolower( $redact_keys ) ) );
		$filtered    = array();

        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		foreach ( $_GET as $key => $value ) {
			$key_lower     = strtolower( $key );
			$should_redact = false;

			foreach ( $redact_list as $redact_key ) {
				if ( ! empty( $redact_key ) && strpos( $key_lower, $redact_key ) !== false ) {
					$should_redact = true;
					break;
				}
			}

			if ( $should_redact ) {
				$filtered[ sanitize_key( $key ) ] = '[REDACTED]';
			} elseif ( is_array( $value ) ) {
				$filtered[ sanitize_key( $key ) ] = '[ARRAY]';
			} else {
				$clean_key              = substr( sanitize_key( wp_unslash( $key ) ), 0, 100 );
				$clean_value            = substr( sanitize_text_field( wp_unslash( (string) $value ) ), 0, 1000 );
				$filtered[ $clean_key ] = $clean_value;
			}
		}

		return $filtered;
	}

	/**
	 * Sanitize query params without redaction.
	 */
	private static function sanitize_params( $params ) {
		$sanitized = array();
		foreach ( $params as $key => $value ) {
			$clean_key = substr( sanitize_key( wp_unslash( $key ) ), 0, 100 );
			if ( is_array( $value ) ) {
				$sanitized[ $clean_key ] = '[ARRAY]';
			} else {
				$sanitized[ $clean_key ] = substr( sanitize_text_field( wp_unslash( (string) $value ) ), 0, 1000 );
			}
		}
		return $sanitized;
	}
}