<?php
if (!defined('ABSPATH')) {
    exit; // Exit if accessed directly
}

function moesec_bad_bot_blocking_tab() {
    if (!current_user_can('manage_options')) {
        wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'moesec'));
    }

    if (isset($_POST['moesec_save_bad_bot_blocking']) && check_admin_referer('moesec_bad_bot_blocking', 'moesec_bad_bot_blocking_nonce')) {
        $enable_bad_bot_blocking = isset($_POST['enable_bad_bot_blocking']) ? 1 : 0;
        update_option('moesec_enable_bad_bot_blocking', $enable_bad_bot_blocking);
        
        $bad_bot_list = isset($_POST['bad_bot_list']) ? sanitize_textarea_field($_POST['bad_bot_list']) : '';
        update_option('moesec_bad_bot_list', $bad_bot_list);
        
        echo '<div class="updated"><p>' . esc_html__('Bad bot blocking settings saved successfully.', 'moesec') . '</p></div>';
    }
    
    $enable_bad_bot_blocking = get_option('moesec_enable_bad_bot_blocking', false);
    $bad_bot_list = get_option('moesec_bad_bot_list', '');
    
    ?>
    <h3><?php esc_html_e('Bad Bot Blocking', 'moesec'); ?></h3>
    <form method="post" action="">
        <?php wp_nonce_field('moesec_bad_bot_blocking', 'moesec_bad_bot_blocking_nonce'); ?>
        <table class="form-table">
            <tr>
                <th><label for="enable_bad_bot_blocking"><?php esc_html_e('Enable Bad Bot Blocking', 'moesec'); ?></label></th>
                <td><input type="checkbox" id="enable_bad_bot_blocking" name="enable_bad_bot_blocking" <?php checked($enable_bad_bot_blocking); ?>></td>
            </tr>
            <tr>
                <th><label for="bad_bot_list"><?php esc_html_e('Bad Bot List', 'moesec'); ?></label></th>
                <td>
                    <textarea id="bad_bot_list" name="bad_bot_list" rows="10" cols="50" class="large-text code"><?php echo esc_textarea($bad_bot_list); ?></textarea>
                    <p class="description"><?php esc_html_e('Enter one bot name per line. You can use wildcards (*) for partial matches.', 'moesec'); ?></p>
                </td>
            </tr>
        </table>
        <p class="submit">
            <input type="submit" name="moesec_save_bad_bot_blocking" class="button button-primary" value="<?php esc_attr_e('Save Bad Bot Blocking Settings', 'moesec'); ?>">
        </p>
    </form>
    <?php
}

// Implement bad bot blocking
if (get_option('moesec_enable_bad_bot_blocking', false)) {
    add_action('init', 'moesec_block_bad_bots');
}

function moesec_block_bad_bots() {
    $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field($_SERVER['HTTP_USER_AGENT']) : '';
    $bad_bot_list = get_option('moesec_bad_bot_list', '');
    $bad_bots = array_map('trim', explode("\n", $bad_bot_list));
    
    foreach ($bad_bots as $bad_bot) {
        if (empty($bad_bot)) {
            continue;
        }
        
        $pattern = str_replace('*', '.*', preg_quote($bad_bot, '/'));
        if (preg_match('/^' . $pattern . '$/i', $user_agent)) {
            moesec_log(sprintf(
                /* translators: %s: User agent string */
                esc_html__('Bad bot blocked: %s', 'moesec'),
                esc_html($user_agent)
            ));
            wp_die(
                esc_html__('Access denied by MoeSec', 'moesec'),
                esc_html__('Bad Bot Blocked by MoeSec', 'moesec'),
                array('response' => 403)
            );
        }
    }
}
