<?php
/**
 * Fast tracking endpoint for Ad impressions/clicks.
 *
 * Opt-in only via the ADPRESSO_FAST_TRACKING constant, or the `adpresso_enable_fast_tracking` filter.
 * When disabled, this file is never linked to from the frontend and is effectively dead code;
 *
 * Deliberately mostly self-contained: no Composer autoloader, no other AdPresso class except a single direct require() of TrackingStorage
 *
 */

define( 'SHORTINIT', true );

// No wp_unslash()/sanitize_text_field() available yet - wp-load.php (required below) hasn't run,
// A strict-equals check against a fixed literal needs no sanitization regardless.
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- See comment above.
if ( 'POST' !== ( $_SERVER['REQUEST_METHOD'] ?? '' ) ) {
	header( 'Allow: POST' );
	http_response_code( 405 );
	exit;
}

// Discover wp-load.php by walking up from this file.
$adpresso_wp_load = null;
$adpresso_dir     = __DIR__;
for ( $adpresso_i = 0; $adpresso_i < 6; $adpresso_i++ ) {
	$adpresso_candidate = $adpresso_dir . '/wp-load.php';
	if ( file_exists( $adpresso_candidate ) ) {
		$adpresso_wp_load = $adpresso_candidate;
		break;
	}
	$adpresso_parent = dirname( $adpresso_dir );
	if ( $adpresso_parent === $adpresso_dir ) {
		break;
	}
	$adpresso_dir = $adpresso_parent;
}

if ( ! $adpresso_wp_load ) {
	http_response_code( 500 );
	exit;
}

require $adpresso_wp_load;
require_once ABSPATH . WPINC . '/kses.php';
require __DIR__ . '/modules/tracking/class-tracking-storage.php';

// Note: TrackingStorage's crawler check (Jaybizzle\CrawlerDetect\CrawlerDetect) silently no-ops here
use AdPresso\Modules\Tracking\TrackingStorage;

unset( $adpresso_wp_load, $adpresso_dir, $adpresso_i, $adpresso_candidate, $adpresso_parent );

$adpresso_enabled = ( defined( 'ADPRESSO_FAST_TRACKING' ) && ADPRESSO_FAST_TRACKING )
	|| '1' === get_option( 'adpresso_fast_tracking_enabled', '0' );
if ( ! $adpresso_enabled ) {
	http_response_code( 404 );
	exit;
}

nocache_headers();
header( 'X-Content-Type-Options: nosniff' );
header( 'X-Robots-Tag: noindex' );

/**
 * Same-HOST check (not a full same-origin check - scheme and port aren't compared.)
 *
 * @return bool True if the request's origin matches the site's home URL's host.
 */
function adpresso_fast_track_is_same_host(): bool {
	// wp_unslash()/sanitize_text_field() are available here (wp-load.php has already run above),
	// but the AdPresso\Infrastructure\Params class deliberately isn't used in this file - AdPresso avoids any class beyond TrackingStorage.
	$origin = sanitize_text_field( wp_unslash( $_SERVER['HTTP_ORIGIN'] ?? ( $_SERVER['HTTP_REFERER'] ?? '' ) ) );
	$origin_host = $origin ? parse_url( $origin, PHP_URL_HOST ) : '';
	$home_host   = parse_url( (string) get_option( 'home' ), PHP_URL_HOST );

	return $origin_host && $home_host && $origin_host === $home_host;
}

if ( ! adpresso_fast_track_is_same_host() ) {
	http_response_code( 403 );
	exit;
}

$adpresso_raw = file_get_contents( 'php://input' );
if ( strlen( $adpresso_raw ) > 256 * 1024 ) {
	http_response_code( 413 );
	exit;
}

$adpresso_payload = json_decode( (string) $adpresso_raw, true );
$adpresso_events  = is_array( $adpresso_payload ) ? ( $adpresso_payload['events'] ?? $adpresso_payload ) : null;

if ( ! is_array( $adpresso_events ) || empty( $adpresso_events ) ) {
	http_response_code( 204 );
	exit;
}

// Reject a clearly-abusive request.
if ( count( $adpresso_events ) > TrackingStorage::MAX_EVENTS_PER_BATCH ) {
	http_response_code( 413 );
	exit;
}

/**
 * Auth salt substitute - wp_salt() (pluggable.php) isn't available under SHORTINIT.
 * Only used to anonymize a hash, not for authentication, so this doesn't need to match wp_salt()'s own output.
 */
function adpresso_fast_track_ip_hash_salt(): string {
	$parts = [];
	foreach ( [ 'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT', 'AUTH_KEY', 'SECURE_AUTH_KEY', 'LOGGED_IN_KEY', 'NONCE_KEY' ] as $constant ) {
		if ( defined( $constant ) && '' !== constant( $constant ) ) {
			$parts[] = constant( $constant );
		}
	}

	if ( ! empty( $parts ) ) {
		return hash( 'sha256', implode( '|', $parts ) );
	}

	return hash( 'sha256', DB_NAME . DB_USER . (string) get_option( 'home', '' ) );
}

// can_use_premium_code() (Freemius) isn't callable under SHORTINIT either
// see class-tracking-admin.php, which keeps this option in sync on every normal frontend page load.
$adpresso_is_premium = '1' === get_option( 'adpresso_track_premium', '0' );

$adpresso_success = TrackingStorage::record_batch( $adpresso_events, $adpresso_is_premium, adpresso_fast_track_ip_hash_salt() );

if ( ! $adpresso_success ) {
	// The primary stats upsert itself failed - report a real failure so tracking.js falls back to the REST route.
	http_response_code( 500 );
	exit;
}

http_response_code( 204 );