<?php
/**
 * Handle bot detection functionality.
 *
 * @package    AI_Scraping_Protector
 * @subpackage AI_Scraping_Protector/includes
 */

class AISP_Bot_Detector {
    private $known_bots = [
        'Googlebot', 'Bingbot', 'Slurp', 'DuckDuckBot', 'Baiduspider',
        'YandexBot', 'Sogou', 'facebookexternalhit', 'Twitterbot',
        'LinkedInBot', 'WhatsApp', 'TelegramBot', 'Discordbot',
        'ChatGPT-User', 'GPTBot', 'CCBot', 'anthropic-ai',
        'Claude-Web', 'Omgilibot', 'Applebot', 'SemrushBot'
    ];

    private $bot_ip_ranges = [
        '66.249.64.0/19',    // Google
        '207.46.13.0/24',    // Microsoft
        '131.253.21.0/24',   // Microsoft
        '157.55.0.0/16',     // Microsoft
        '40.77.0.0/16',      // Microsoft
        '13.64.0.0/11',      // Microsoft
        '13.104.0.0/14',     // Microsoft
        '52.96.0.0/12',      // Microsoft
        '52.224.0.0/11',     // Microsoft
        '52.240.0.0/13',     // Microsoft
        '52.248.0.0/14',     // Microsoft
        '52.252.0.0/14',     // Microsoft
        '52.254.0.0/16',     // Microsoft
        '52.255.0.0/16',     // Microsoft
        '104.196.0.0/14',    // Google
        '104.200.0.0/14',    // Google
        '104.204.0.0/14',    // Google
        '104.208.0.0/14',    // Google
        '104.212.0.0/14',    // Google
        '104.216.0.0/14',    // Google
        '104.220.0.0/14',    // Google
        '104.224.0.0/14',    // Google
        '104.228.0.0/14',    // Google
        '104.232.0.0/14',    // Google
        '104.236.0.0/14',    // Google
        '104.240.0.0/14',    // Google
        '104.244.0.0/14',    // Google
        '104.248.0.0/14',    // Google
        '104.252.0.0/14',    // Google
        '104.254.0.0/16',    // Google
        '35.184.0.0/13',     // Google
        '35.192.0.0/14',     // Google
        '35.196.0.0/15',     // Google
        '35.198.0.0/16',     // Google
        '35.199.0.0/16',     // Google
        '35.200.0.0/15',     // Google
        '35.202.0.0/15',     // Google
        '35.204.0.0/14',     // Google
        '35.208.0.0/12',     // Google
        '35.224.0.0/12',     // Google
        '35.240.0.0/13',     // Google
        '35.248.0.0/14',     // Google
        '35.252.0.0/14',     // Google
        '35.254.0.0/16',     // Google
        '35.255.0.0/16',     // Google
        '8.8.8.0/24',        // Google DNS
        '8.8.4.0/24',        // Google DNS
        '142.250.0.0/15',    // Google
        '142.252.0.0/14',    // Google
        '142.254.0.0/16',    // Google
        '142.255.0.0/16',    // Google
        '172.217.0.0/16',    // Google
        '172.218.0.0/15',    // Google
        '172.220.0.0/14',    // Google
        '172.224.0.0/12',    // Google
        '172.240.0.0/13',    // Google
        '172.248.0.0/14',    // Google
        '172.252.0.0/14',    // Google
        '172.254.0.0/16',    // Google
        '172.255.0.0/16',    // Google
        '173.194.0.0/16',    // Google
        '173.195.0.0/16',    // Google
        '173.196.0.0/15',    // Google
        '173.198.0.0/15',    // Google
        '173.200.0.0/14',    // Google
        '173.204.0.0/14',    // Google
        '173.208.0.0/12',    // Google
        '173.224.0.0/12',    // Google
        '173.240.0.0/13',    // Google
        '173.248.0.0/14',    // Google
        '173.252.0.0/14',    // Google
        '173.254.0.0/16',    // Google
        '173.255.0.0/16',    // Google
        '192.168.0.0/16',    // Private network
        '10.0.0.0/8',        // Private network
        '172.16.0.0/12',     // Private network
    ];

    public function __construct() {
        // Constructor
    }

    public function init() {
        add_action('template_redirect', array($this, 'detect_bots'));
    }

    /**
     * Detects if the current request is from a known bot.
     *
     * @return bool True if a bot is detected, false otherwise.
     */
    public function detect_bots() {
        // Skip detection for logged-in users
        if (is_user_logged_in()) {
            return false;
        }

        $user_agent = $this->get_user_agent();
        $remote_addr = $this->get_remote_addr();
        
        // Check user agent for known bots
        if ($this->is_bot_user_agent($user_agent)) {
            return true;
        }

        // Check IP address against known bot ranges
        if ($this->is_bot_ip($remote_addr)) {
            return true;
        }

        // Check for suspicious patterns
        if ($this->has_suspicious_patterns($user_agent, $remote_addr)) {
            return true;
        }

        return false;
    }

    /**
     * Gets the sanitized user agent string.
     *
     * @return string
     */
    private function get_user_agent() {
        return isset($_SERVER['HTTP_USER_AGENT']) ? 
            sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'])) : '';
    }

    /**
     * Gets the sanitized remote address.
     *
     * @return string
     */
    private function get_remote_addr() {
        return isset($_SERVER['REMOTE_ADDR']) ? 
            sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '';
    }

    /**
     * Checks if the user agent matches known bot patterns.
     *
     * @param string $user_agent
     * @return bool
     */
    private function is_bot_user_agent($user_agent) {
        if (empty($user_agent)) {
            return true; // Empty user agent is suspicious
        }

        foreach ($this->known_bots as $bot) {
            if (stripos($user_agent, $bot) !== false) {
                return true;
            }
        }

        // Check for common bot patterns
        $bot_patterns = [
            '/bot/i', '/crawler/i', '/spider/i', '/scraper/i',
            '/harvester/i', '/collector/i', '/grabber/i',
            '/ai/i', '/chatgpt/i', '/claude/i', '/anthropic/i',
            '/openai/i', '/gpt/i', '/llm/i', '/language-model/i'
        ];

        foreach ($bot_patterns as $pattern) {
            if (preg_match($pattern, $user_agent)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Checks if the IP address is in known bot ranges.
     *
     * @param string $ip
     * @return bool
     */
    private function is_bot_ip($ip) {
        if (empty($ip) || !filter_var($ip, FILTER_VALIDATE_IP)) {
            return false;
        }

        foreach ($this->bot_ip_ranges as $range) {
            if ($this->ip_in_range($ip, $range)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Checks if an IP address is within a CIDR range.
     *
     * @param string $ip
     * @param string $cidr
     * @return bool
     */
    private function ip_in_range($ip, $cidr) {
        list($subnet, $bits) = explode('/', $cidr);
        $ip = ip2long($ip);
        $subnet = ip2long($subnet);
        $mask = -1 << (32 - $bits);
        $subnet &= $mask;
        return ($ip & $mask) === $subnet;
    }

    /**
     * Checks for suspicious patterns that might indicate AI scraping.
     *
     * @param string $user_agent
     * @param string $ip
     * @return bool
     */
    private function has_suspicious_patterns($user_agent, $ip) {
        // Check for missing or very short user agent
        if (strlen($user_agent) < 10) {
            return true;
        }

        // Check for missing referer (common with automated requests)
        $referer = isset($_SERVER['HTTP_REFERER']) ? 
            sanitize_text_field(wp_unslash($_SERVER['HTTP_REFERER'])) : '';
        
        if (empty($referer) && !is_home() && !is_front_page()) {
            return true;
        }

        // Check for rapid requests (basic rate limiting)
        $this->check_request_frequency($ip);

        return false;
    }

    /**
     * Basic request frequency check.
     *
     * @param string $ip
     */
    private function check_request_frequency($ip) {
        $transient_name = 'aisp_bot_freq_' . md5($ip);
        $current_count = get_transient($transient_name);
        
        if ($current_count === false) {
            set_transient($transient_name, 1, 60); // 1 minute window
        } else {
            if ($current_count > 30) { // More than 30 requests per minute
                return true;
            }
            set_transient($transient_name, $current_count + 1, 60);
        }
        
        return false;
    }
}