<?php
/**
 * Audit check: is Cloudflare in front of this site?
 *
 * @package AIBlackout
 */

namespace AIBlackout\Audit\Checks;

use AIBlackout\Audit\Check;
use AIBlackout\Audit\Result;

defined( 'ABSPATH' ) || exit;

/**
 * Detects whether the current request arrived through Cloudflare's edge.
 *
 * @since 1.0.0
 */
class CloudflareCheck implements Check {

	/**
	 * Returns the check identifier.
	 *
	 * @return string Identifier.
	 */
	public function get_id(): string {
		return 'cloudflare';
	}

	/**
	 * Whether a loopback request is required.
	 *
	 * @return bool False.
	 */
	public function needs_loopback(): bool {
		return false;
	}

	/**
	 * Runs the check.
	 *
	 * @return Result The finding.
	 */
	public function run(): Result {
		$label = __( 'Cloudflare', 'ai-blackout' );

		$ray = isset( $_SERVER['HTTP_CF_RAY'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_RAY'] ) ) : '';
		$ip  = isset( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ) : '';

		$detail = array(
			'cf_ray'           => '' !== $ray,
			'cf_connecting_ip' => '' !== $ip,
		);

		if ( '' !== $ray || '' !== $ip ) {
			return new Result(
				$this->get_id(),
				$label,
				Result::INFO,
				__( 'This site is being served through Cloudflare.', 'ai-blackout' ),
				__( 'Cloudflare sees every request before your server does, including requests that would be served from a cache. That makes it the strongest place to block AI crawlers, and it can see traffic this plugin never will.', 'ai-blackout' ),
				__( 'Cloudflare has its own AI crawler controls in your Cloudflare dashboard, under Security. This plugin does not manage them for you.', 'ai-blackout' ),
				$detail
			);
		}

		return new Result(
			$this->get_id(),
			$label,
			Result::INFO,
			__( 'This request did not come through Cloudflare.', 'ai-blackout' ),
			__( 'Blocking is happening on your own server only. A site can be signed up to Cloudflare and still bypass it, if the DNS record is set to DNS-only rather than proxied. In that case Cloudflare sees nothing and cannot block anything.', 'ai-blackout' ),
			'',
			$detail
		);
	}
}