<?php
/**
 * Controller: Incident Detector.
 *
 * Real-time incident detection and automated response system.
 * Analyzes security event patterns, detects coordinated attacks,
 * and triggers automated responses (lockdowns, notifications, etc.).
 *
 * @package advan
 *
 * @since 5.2.0
 */

declare(strict_types=1);

namespace ADVAN\Controllers;

use ADVAN\Helpers\Settings;
use ADVAN\Entities\Security_Events_Entity;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! class_exists( '\ADVAN\Controllers\Incident_Detector' ) ) {
	/**
	 * Detects security incidents and triggers automated responses.
	 *
	 * Incident types detected:
	 * - DDoS: Multiple unique IPs hitting the site in a short window.
	 * - Brute force campaigns: Distributed login attempts.
	 * - Privilege escalation chains: Multiple escalation events in sequence.
	 * - File modification storms: Unusual file editing activity.
	 *
	 * Responses:
	 * - Auto-lockdown (tighten rate limits temporarily).
	 * - Admin email notification.
	 * - WP-CLI / webhook alerts (extensible via filters).
	 *
	 * @since 5.2.0
	 */
	class Incident_Detector {

		use Controller_Init_Trait;

		/**
		 * Cron hook for periodic incident analysis.
		 *
		 * @var string
		 */
		public const CRON_ANALYSIS_HOOK = ADVAN_PREFIX . 'security_incident_analysis';

		/**
		 * Transient key for lockdown state.
		 *
		 * @var string
		 */
		private const LOCKDOWN_TRANSIENT = ADVAN_PREFIX . 'security_lockdown';

		/**
		 * Default thresholds.
		 */
		private const DEFAULT_DDOS_IP_THRESHOLD         = 50;
		private const DEFAULT_DDOS_WINDOW_MINUTES        = 5;
		private const DEFAULT_BRUTE_FORCE_THRESHOLD      = 20;
		private const DEFAULT_BRUTE_FORCE_WINDOW_MINUTES = 10;
		private const DEFAULT_ESCALATION_THRESHOLD       = 3;
		private const DEFAULT_ESCALATION_WINDOW_MINUTES  = 30;
		private const DEFAULT_LOCKDOWN_DURATION_MINUTES  = 30;

		/**
		 * Initialize incident detection.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		public static function init(): void {
			if ( ! Settings::get_option( 'security_module_enabled' ) ) {
				return;
			}

			static::conditional_init(
				'advana_security_incident_detect_enable',
				function () {
					// Periodic analysis via cron.
					\add_filter( 'cron_schedules', array( __CLASS__, 'add_cron_schedules' ) );
					\add_action( self::CRON_ANALYSIS_HOOK, array( __CLASS__, 'run_analysis' ) );
					self::schedule_cron();

					// Real-time checks on security events (hook into entity writes).
					\add_action( 'shutdown', array( __CLASS__, 'realtime_check' ), 5 );

					// Apply lockdown restrictions if active.
					if ( self::is_lockdown_active() ) {
						\add_filter( 'advan_security_rate_limit_override', array( __CLASS__, 'apply_lockdown_limits' ) );
					}
				}
			);
		}

		/**
		 * Run periodic incident analysis.
		 *
		 * Analyzes event patterns over configurable time windows to detect
		 * coordinated attacks that individual request-level checks might miss.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		public static function run_analysis(): void {
			self::detect_ddos();
			self::detect_brute_force_campaign();
			self::detect_escalation_chain();
		}

		/**
		 * Realtime check at shutdown — lightweight pattern detection.
		 *
		 * Only runs if there were security events in the current request cycle.
		 * Uses cached counts to avoid expensive queries on every request.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		public static function realtime_check(): void {
			// Use a transient-based counter to avoid DB queries on every request.
			$counter_key = ADVAN_PREFIX . 'sec_event_counter';
			$counter     = (int) \get_transient( $counter_key );
			$counter++;

			// Only run full analysis every N requests that have events.
			if ( $counter < 10 ) {
				\set_transient( $counter_key, $counter, 300 );
				return;
			}

			// Reset counter and run analysis.
			\delete_transient( $counter_key );
			self::run_analysis();
		}

		/**
		 * Detect DDoS attacks.
		 *
		 * A DDoS is characterized by many unique IPs triggering rate limits
		 * or blocks in a short time window. This is distinct from a DoS which
		 * comes from a single source.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		private static function detect_ddos(): void {
			$threshold = (int) ( Settings::get_option( 'security_ddos_ip_threshold' ) ?: self::DEFAULT_DDOS_IP_THRESHOLD );
			$window    = (int) ( Settings::get_option( 'security_ddos_window_minutes' ) ?: self::DEFAULT_DDOS_WINDOW_MINUTES );

			$unique_blocked_ips = Security_Events_Entity::count_unique_ips(
				Security_Events_Entity::EVENT_BLOCKED,
				$window
			);

			$unique_dos_ips = Security_Events_Entity::count_unique_ips(
				Security_Events_Entity::EVENT_DOS,
				$window
			);

			// Use the higher of the two counts to avoid double-counting IPs
			// that triggered both event types.
			$total_unique = max( $unique_blocked_ips, $unique_dos_ips );

			if ( $total_unique >= $threshold ) {
				// Check if we already reported this incident recently.
				$recent_incidents = Security_Events_Entity::count_events(
					Security_Events_Entity::EVENT_INCIDENT,
					null,
					60 // Last 60 minutes.
				);

				if ( $recent_incidents > 0 ) {
					return; // Already reported.
				}

				Security_Events_Entity::log_event(
					Security_Events_Entity::EVENT_INCIDENT,
					Security_Events_Entity::SEVERITY_CRITICAL,
					'',
					sprintf(
						'DDoS attack detected: %d unique IPs triggered security events in %d minutes',
						$total_unique,
						$window
					),
					array(
						'unique_blocked_ips' => $unique_blocked_ips,
						'unique_dos_ips'     => $unique_dos_ips,
						'threshold'          => $threshold,
						'window_minutes'     => $window,
						'incident_type'      => 'ddos',
					)
				);

				self::trigger_response( 'ddos', array(
					'unique_ips' => $total_unique,
					'window'     => $window,
				) );
			}
		}

		/**
		 * Detect distributed brute force campaigns.
		 *
		 * Multiple IPs attempting logins across the same time window suggests
		 * a coordinated credential stuffing or brute force attack.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		private static function detect_brute_force_campaign(): void {
			$threshold = (int) ( Settings::get_option( 'security_brute_force_threshold' ) ?: self::DEFAULT_BRUTE_FORCE_THRESHOLD );
			$window    = (int) ( Settings::get_option( 'security_brute_force_window_minutes' ) ?: self::DEFAULT_BRUTE_FORCE_WINDOW_MINUTES );

			$brute_force_count = Security_Events_Entity::count_events(
				Security_Events_Entity::EVENT_BRUTE_FORCE,
				null,
				$window
			);

			$unique_ips = Security_Events_Entity::count_unique_ips(
				Security_Events_Entity::EVENT_BRUTE_FORCE,
				$window
			);

			// Distributed: many events from many IPs.
			if ( $brute_force_count >= $threshold && $unique_ips >= 3 ) {
				$recent = Security_Events_Entity::count_events(
					Security_Events_Entity::EVENT_INCIDENT,
					null,
					60 // Last 60 minutes.
				);

				if ( $recent > 0 ) {
					return;
				}

				Security_Events_Entity::log_event(
					Security_Events_Entity::EVENT_INCIDENT,
					Security_Events_Entity::SEVERITY_CRITICAL,
					'',
					sprintf(
						'Distributed brute force campaign detected: %d attempts from %d unique IPs in %d minutes',
						$brute_force_count,
						$unique_ips,
						$window
					),
					array(
						'attempt_count'  => $brute_force_count,
						'unique_ips'     => $unique_ips,
						'threshold'      => $threshold,
						'window_minutes' => $window,
						'incident_type'  => 'brute_force_campaign',
					)
				);

				self::trigger_response( 'brute_force', array(
					'attempts'   => $brute_force_count,
					'unique_ips' => $unique_ips,
					'window'     => $window,
				) );
			}
		}

		/**
		 * Detect privilege escalation chains.
		 *
		 * Multiple escalation events in a short window may indicate
		 * a compromised account or an active exploitation attempt.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		private static function detect_escalation_chain(): void {
			$threshold = (int) ( Settings::get_option( 'security_escalation_threshold' ) ?: self::DEFAULT_ESCALATION_THRESHOLD );
			$window    = (int) ( Settings::get_option( 'security_escalation_window_minutes' ) ?: self::DEFAULT_ESCALATION_WINDOW_MINUTES );

			$escalation_count = Security_Events_Entity::count_events(
				Security_Events_Entity::EVENT_PRIV_ESCALATION,
				null,
				$window
			);

			if ( $escalation_count >= $threshold ) {
				$recent = Security_Events_Entity::count_events(
					Security_Events_Entity::EVENT_INCIDENT,
					null,
					60 // Last 60 minutes.
				);

				if ( $recent > 0 ) {
					return;
				}

				Security_Events_Entity::log_event(
					Security_Events_Entity::EVENT_INCIDENT,
					Security_Events_Entity::SEVERITY_CRITICAL,
					'',
					sprintf(
						'Privilege escalation chain detected: %d escalation events in %d minutes',
						$escalation_count,
						$window
					),
					array(
						'escalation_count' => $escalation_count,
						'threshold'        => $threshold,
						'window_minutes'   => $window,
						'incident_type'    => 'escalation_chain',
					)
				);

				self::trigger_response( 'escalation', array(
					'count'  => $escalation_count,
					'window' => $window,
				) );
			}
		}

		// ─── Automated Response ─────────────────────────────────────────

		/**
		 * Trigger an automated incident response.
		 *
		 * @param string $incident_type Incident type (ddos, brute_force, escalation).
		 * @param array  $context       Context data for the response.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		private static function trigger_response( string $incident_type, array $context = array() ): void {
			// 1. Activate lockdown if configured.
			if ( Settings::get_option( 'advana_security_auto_lockdown' ) ) {
				self::activate_lockdown( $incident_type );
			}

			// 2. Send admin notification.
			if ( Settings::get_option( 'advana_security_email_alerts' ) ) {
				self::send_alert_email( $incident_type, $context );
			}

			// 3. Extensibility: allow other plugins/modules to respond.
			\do_action( 'advan_security_incident_detected', $incident_type, $context );
		}

		/**
		 * Activate site lockdown.
		 *
		 * Temporarily tightens all rate limits and enables additional protections.
		 *
		 * @param string $reason Reason for lockdown.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		private static function activate_lockdown( string $reason ): void {
			$duration = (int) ( Settings::get_option( 'security_lockdown_duration_minutes' ) ?: self::DEFAULT_LOCKDOWN_DURATION_MINUTES );

			$lockdown_data = array(
				'activated_at' => time(),
				'expires_at'   => time() + ( $duration * 60 ),
				'reason'       => $reason,
			);

			\set_transient(
				self::LOCKDOWN_TRANSIENT,
				$lockdown_data,
				$duration * 60
			);

			Security_Events_Entity::log_event(
				Security_Events_Entity::EVENT_INCIDENT,
				Security_Events_Entity::SEVERITY_CRITICAL,
				'',
				sprintf( 'Auto-lockdown activated for %d minutes due to: %s', $duration, $reason ),
				$lockdown_data
			);
		}

		/**
		 * Check if lockdown is currently active.
		 *
		 * @return bool
		 *
		 * @since 5.2.0
		 */
		public static function is_lockdown_active(): bool {
			$data = \get_transient( self::LOCKDOWN_TRANSIENT );
			if ( ! is_array( $data ) || ! isset( $data['expires_at'] ) ) {
				return false;
			}
			return time() < (int) $data['expires_at'];
		}

		/**
		 * Get lockdown info.
		 *
		 * @return array|false Lockdown data or false.
		 *
		 * @since 5.2.0
		 */
		public static function get_lockdown_info() {
			$data = \get_transient( self::LOCKDOWN_TRANSIENT );
			if ( ! is_array( $data ) ) {
				return false;
			}
			return $data;
		}

		/**
		 * Manually deactivate lockdown.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		public static function deactivate_lockdown(): void {
			\delete_transient( self::LOCKDOWN_TRANSIENT );

			Security_Events_Entity::log_event(
				Security_Events_Entity::EVENT_INCIDENT,
				Security_Events_Entity::SEVERITY_MEDIUM,
				'',
				'Lockdown manually deactivated by admin',
				array( 'deactivated_at' => time() )
			);
		}

		/**
		 * Apply lockdown rate limits (filter callback).
		 *
		 * During lockdown, rate limits are reduced by 75% and burst limits by 80%.
		 *
		 * @param array $limits Current rate limits.
		 *
		 * @return array Modified limits.
		 *
		 * @since 5.2.0
		 */
		public static function apply_lockdown_limits( array $limits ): array {
			$limits['rate_limit']  = max( 10, (int) ( ( $limits['rate_limit'] ?? 60 ) * 0.25 ) );
			$limits['burst_limit'] = max( 3, (int) ( ( $limits['burst_limit'] ?? 15 ) * 0.20 ) );
			return $limits;
		}

		/**
		 * Send alert email to site admin.
		 *
		 * @param string $incident_type Incident type.
		 * @param array  $context       Context.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		private static function send_alert_email( string $incident_type, array $context ): void {
			// Rate limit email notifications (max 1 per 15 minutes per incident type).
			$email_key = ADVAN_PREFIX . 'security_email_' . $incident_type;
			if ( false !== \get_transient( $email_key ) ) {
				return;
			}
			\set_transient( $email_key, 1, 900 );

			$admin_email = \get_option( 'admin_email' );
			if ( empty( $admin_email ) ) {
				return;
			}

			$site_name = \get_bloginfo( 'name' );
			$site_url  = \home_url();

			$type_labels = array(
				'ddos'        => __( 'DDoS Attack', '0-day-analytics' ),
				'brute_force' => __( 'Brute Force Campaign', '0-day-analytics' ),
				'escalation'  => __( 'Privilege Escalation Chain', '0-day-analytics' ),
			);

			$type_label = $type_labels[ $incident_type ] ?? ucfirst( str_replace( '_', ' ', $incident_type ) );

			$subject = sprintf(
				/* translators: 1: site name, 2: incident type */
				__( '[%1$s] Security Alert: %2$s Detected', '0-day-analytics' ),
				$site_name,
				$type_label
			);

			$message = sprintf(
				/* translators: 1: incident type, 2: site URL, 3: context details, 4: timestamp */
				__(
					"A security incident has been detected on your site.\n\n" .
					"Incident Type: %1\$s\n" .
					"Site: %2\$s\n" .
					"Time: %3\$s (UTC)\n\n" .
					"Details:\n%4\$s\n\n" .
					"Recommended Actions:\n" .
					"- Review the Security Dashboard in 0 Day Analytics\n" .
					"- Check recent user activity and role changes\n" .
					"- Verify no unauthorized changes were made\n\n" .
					"This is an automated alert from the 0 Day Analytics Security Module.",
					'0-day-analytics'
				),
				$type_label,
				$site_url,
				gmdate( 'Y-m-d H:i:s' ),
				self::format_context( $context )
			);

			\wp_mail( $admin_email, $subject, $message );
		}

		/**
		 * Format context array for email display.
		 *
		 * @param array $context Context data.
		 *
		 * @return string
		 *
		 * @since 5.2.0
		 */
		private static function format_context( array $context ): string {
			$lines = array();
			foreach ( $context as $key => $value ) {
				$label   = ucfirst( str_replace( '_', ' ', $key ) );
				$display = is_scalar( $value ) ? (string) $value : wp_json_encode( $value );
				$lines[] = sprintf( '  %s: %s', $label, $display );
			}
			return implode( "\n", $lines );
		}

		// ─── Cron management ────────────────────────────────────────────

		/**
		 * Schedule the analysis cron.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		private static function schedule_cron(): void {
			if ( ! \wp_next_scheduled( self::CRON_ANALYSIS_HOOK ) ) {
				\wp_schedule_event( time(), 'advan_five_minutes', self::CRON_ANALYSIS_HOOK );
			}
		}

		/**
		 * Add custom cron schedules.
		 *
		 * @param array $schedules Existing schedules.
		 *
		 * @return array
		 *
		 * @since 5.2.0
		 */
		public static function add_cron_schedules( array $schedules ): array {
			if ( ! isset( $schedules['advan_five_minutes'] ) ) {
				$schedules['advan_five_minutes'] = array(
					'interval' => 300,
					'display'  => \__( 'Every 5 minutes', '0-day-analytics' ),
				);
			}
			return $schedules;
		}

		/**
		 * Unschedule the analysis cron.
		 *
		 * @return void
		 *
		 * @since 5.2.0
		 */
		public static function unschedule_cron(): void {
			$timestamp = \wp_next_scheduled( self::CRON_ANALYSIS_HOOK );
			if ( $timestamp ) {
				\wp_unschedule_event( $timestamp, self::CRON_ANALYSIS_HOOK );
			}
		}
	}
}