<?php
// If this file is called directly, abort.
if ( ! defined( 'WPINC' ) ) {
	die;
}

// Check Current Plugin Active
if ( ! function_exists( 'aio_tools_check_active_plugin' ) ) {
	function aio_tools_check_active_plugin( $plugin ) {
		$active_plugins = (array) get_option( 'active_plugins', array() );
		if ( in_array( $plugin, $active_plugins, true ) ) {
			return true;
		}
		if ( is_multisite() ) {
			if ( ! function_exists( 'is_plugin_active_for_network' ) ) {
				require_once ABSPATH . 'wp-admin/includes/plugin.php';
			}
			return is_plugin_active_for_network( $plugin );
		}
		return false;
	}
}

// Check Current Theme Active
if ( ! function_exists( 'aio_tools_check_active_theme' ) ) {
	function aio_tools_check_active_theme( $theme ) {
		return ( $theme === get_option( 'template' ) );
	}
}

// Check whether an AIO Tools module is enabled (defaults to true if never configured)
if ( ! function_exists( 'aio_is_module_active' ) ) {
	function aio_is_module_active( $key ) {
		$val = aio_get_option( $key );
		return $val === null || ! empty( $val );
	}
}

// Safe Mode query parameter (?aio_no_opt=1) to bypass frontend speed optimizations & cache for instant testing
if ( ! function_exists( 'aio_is_speed_safe_mode' ) ) {
	function aio_is_speed_safe_mode() {
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended
		return isset( $_GET['aio_no_opt'] ) && (string) wp_unslash( $_GET['aio_no_opt'] ) === '1';
	}
}

// Safely resolve client IP address (prevents X-Forwarded-For / CF-Connecting-IP spoofing unless trusted)
if ( ! function_exists( 'aio_get_client_ip' ) ) {
	function aio_get_client_ip() {
		$remote_addr = isset( $_SERVER['REMOTE_ADDR'] ) ? trim( sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) ) : '';
		$trust_proxy = ! empty( aio_get_option( 'optTrustProxyHeaders' ) );

		if ( $trust_proxy ) {
			$proxy_headers = array( 'HTTP_CF_CONNECTING_IP', 'HTTP_X_REAL_IP', 'HTTP_X_FORWARDED_FOR' );
			foreach ( $proxy_headers as $key ) {
				if ( ! empty( $_SERVER[ $key ] ) ) {
					$raw = sanitize_text_field( wp_unslash( $_SERVER[ $key ] ) );
					foreach ( explode( ',', $raw ) as $ip ) {
						$ip = trim( $ip );
						if ( filter_var( $ip, FILTER_VALIDATE_IP ) !== false ) {
							return $ip;
						}
					}
				}
			}
		}

		if ( filter_var( $remote_addr, FILTER_VALIDATE_IP ) !== false ) {
			return $remote_addr;
		}

		return '0.0.0.0';
	}
}

// Check whether an IP matches any entry (exact IPv4/IPv6 or IPv4/IPv6 CIDR) in a newline/comma-separated list
if ( ! function_exists( 'aio_is_ip_in_list' ) ) {
	function aio_is_ip_in_list( $ip, $raw_list ) {
		$ip = trim( (string) $ip );
		if ( '' === $ip || empty( $raw_list ) || ! filter_var( $ip, FILTER_VALIDATE_IP ) ) {
			return false;
		}
		$ip_bin   = @inet_pton( $ip ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
		if ( false === $ip_bin ) {
			return false;
		}
		$max_bits = strlen( $ip_bin ) * 8;
		$lines    = preg_split( '/[\r\n,]+/', (string) $raw_list );

		foreach ( $lines as $entry ) {
			$entry = trim( $entry );
			if ( '' === $entry || '#' === $entry[0] ) {
				continue;
			}
			if ( false === strpos( $entry, '/' ) ) {
				if ( filter_var( $entry, FILTER_VALIDATE_IP ) ) {
					$entry_bin = @inet_pton( $entry ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
					if ( false !== $entry_bin && $entry_bin === $ip_bin ) {
						return true;
					}
				}
				continue;
			}

			list( $subnet, $bits_raw ) = array_pad( explode( '/', $entry, 2 ), 2, '' );
			$subnet   = trim( $subnet );
			$bits_raw = trim( $bits_raw );
			if ( '' === $bits_raw || ! ctype_digit( $bits_raw ) || ! filter_var( $subnet, FILTER_VALIDATE_IP ) ) {
				continue;
			}
			$sub_bin = @inet_pton( $subnet ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
			$bits    = (int) $bits_raw;
			if ( false === $sub_bin || strlen( $sub_bin ) !== strlen( $ip_bin ) || $bits < 0 || $bits > $max_bits ) {
				continue;
			}
			if ( 0 === $bits ) {
				return true;
			}

			$full_bytes = intdiv( $bits, 8 );
			$rem_bits   = $bits % 8;
			if ( $full_bytes > 0 && substr( $ip_bin, 0, $full_bytes ) !== substr( $sub_bin, 0, $full_bytes ) ) {
				continue;
			}
			if ( $rem_bits > 0 ) {
				$mask = ( 0xFF << ( 8 - $rem_bits ) ) & 0xFF;
				if ( ( ord( $ip_bin[ $full_bytes ] ) & $mask ) !== ( ord( $sub_bin[ $full_bytes ] ) & $mask ) ) {
					continue;
				}
			}
			return true;
		}
		return false;
	}
}