<?php
declare(strict_types=1);

/**
 * Login brute-force throttle.
 *
 * Failed logins are recorded per client IP and per username. If either
 * passes its limit inside the window, further attempts are refused until
 * enough failures age out. A successful login clears that IP + username's
 * failures.
 */

require_once __DIR__ . '/db.php';

const LOGIN_WINDOW_SECONDS = 900; // 15 minutes
const LOGIN_MAX_PER_IP = 5;
const LOGIN_MAX_PER_USERNAME = 10;

/**
 * The real client IP. Behind a reverse proxy (NPM or Caddy), REMOTE_ADDR
 * is the proxy's Docker-network address, so X-Forwarded-For is trusted —
 * but only when the request came from a private or loopback address (the
 * proxy), never from a public address that could set the header itself.
 *
 * The rightmost entry is used because it's the one our proxy appended.
 * NPM appends to any value the client sent, so leftmost entries can be
 * forged; Caddy discards the client's value, so it's the only entry.
 */
function client_ip(): string {
	$remote = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
	$isPublic = filter_var($remote, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false;
	if (!$isPublic) {
		$chain = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '');
		$forwarded = trim(end($chain));
		if (filter_var($forwarded, FILTER_VALIDATE_IP) !== false) {
			return $forwarded;
		}
	}
	return $remote;
}

/**
 * Seconds until this IP / username may try again, or 0 if not locked.
 * Locked means the Nth most recent failure (N = the limit) is still
 * inside the window; the lock lifts when that failure ages out.
 */
function login_lock_seconds(string $ip, string $username): int {
	$pdo = get_db();
	$since = time() - LOGIN_WINDOW_SECONDS;
	$checks = [
		['ip', $ip, LOGIN_MAX_PER_IP],
		['username', $username, LOGIN_MAX_PER_USERNAME],
	];
	$wait = 0;
	foreach ($checks as [$column, $value, $max]) {
		$stmt = $pdo->prepare(
			"SELECT attempted_at FROM login_attempts
			WHERE $column = ? AND attempted_at > ?
			ORDER BY attempted_at DESC LIMIT 1 OFFSET ?"
		);
		$stmt->execute([$value, $since, $max - 1]);
		$nth = $stmt->fetchColumn();
		if ($nth !== false) {
			$wait = max($wait, (int) $nth + LOGIN_WINDOW_SECONDS - time());
		}
	}
	return $wait;
}

function record_login_failure(string $ip, string $username): void {
	$pdo = get_db();
	$pdo->prepare("INSERT INTO login_attempts (ip, username, attempted_at) VALUES (?, ?, ?)")
		->execute([$ip, $username, time()]);
	// Prune anything outside the window so the table stays small.
	$pdo->prepare("DELETE FROM login_attempts WHERE attempted_at <= ?")
		->execute([time() - LOGIN_WINDOW_SECONDS]);
}

function clear_login_failures(string $ip, string $username): void {
	get_db()->prepare("DELETE FROM login_attempts WHERE ip = ? AND username = ?")
		->execute([$ip, $username]);
}