<?php
/**
 * Firewall Status Model
 * 
 * Calculates firewall-related status percentages
 * 
 * @since 2.1.0
 * @since 2.2.2 Updated to reflect VMP Security branding
 * @package VMPFence
 * @subpackage StatusModal
 */

if (!defined('ABSPATH')) {
    exit;
}

class VMPFence_Firewall_Status {
    
    /**
     * Get WAF status calculation
     * 
     * Formula: Rules (25%) + Premium Rules (10%) + Real-Time IP Blocklist (35%) + 
     *          Optimize Firewall (20%) + Rate Limiting (10%)
     * 
     * @return array Status data
     */
    public static function get_waf_status() {
        // Check if WAF is enabled at base level
        $waf_enabled = (bool) VMPFence_Config::get('waf_enabled', 0);
        
        // If WAF is completely disabled, return 0% with single missing item
        if (!$waf_enabled) {
            return array(
                'percentage' => 0.0,
                'missing' => array(
                    array(
                        'percentage' => 1.0,
                        'title' => 'Enable Web Application Firewall.'
                    )
                ),
                'title' => 'Web Application Firewall Status',
                'helpLink' => admin_url('admin.php?page=vmpfence-firewall&view=options')
            );
        }
        
        // WAF is enabled, calculate detailed breakdown
        require_once VMPFENCE_PLUGIN_DIR . 'lib/class-license.php';
        require_once VMPFENCE_PLUGIN_DIR . 'lib/class-constants.php';
        
        $rule_status = self::get_rule_percentage();
        $is_premium = (VMPFence_License::get_license_type() === VMPFence_Constants::LICENSE_PREMIUM);
        $blacklist_enabled = (bool) VMPFence_Config::get('realtime_ip_blocklist_enabled', 0);
        $protection_level = VMPFence_Config::get('waf_protection_level', 'basic');
        $optimized = ($protection_level === 'extended');
        $rate_limiting = (bool) VMPFence_Config::get('rate_limiting_enabled', 0);
        
        $percentage = 0.0;
        $percentage += $rule_status * 0.25;  // 25% for enabled rules
        $percentage += ($is_premium ? 1.0 : 0.0) * 0.10;  // 10% for premium
        $percentage += ($blacklist_enabled ? 1.0 : 0.0) * 0.35;  // 35% for real-time blocklist
        $percentage += ($optimized ? 1.0 : 0.0) * 0.20;  // 20% for optimization
        $percentage += ($rate_limiting ? 1.0 : 0.0) * 0.10;  // 10% for rate limiting
        
        $missing = array();
        
        // Count disabled rules
        global $wpdb;
        $table_name = $wpdb->prefix . 'vmpfence_waf_rules';
        $total_rules = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$table_name}");
        $disabled_rules = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$table_name} WHERE enabled = 0");
        
        if ($rule_status < 1.0 && $disabled_rules > 0) {
            $missing[] = array(
                'percentage' => (1.0 - $rule_status) * 0.25,
                'title' => sprintf('Re-enable %d firewall rules.', $disabled_rules)
            );
        }
        if (!$is_premium) {
            $missing[] = array(
                'percentage' => 0.10,
                'title' => 'Enable Premium Rules.'
            );
        }
        if (!$blacklist_enabled) {
            $missing[] = array(
                'percentage' => 0.35,
                'title' => 'Enable Real-Time IP Blocklist.'
            );
        }
        if (!$optimized) {
            $missing[] = array(
                'percentage' => 0.20,
                'title' => 'Optimize the VMP Security Firewall.'
            );
        }
        if (!$rate_limiting) {
            $missing[] = array(
                'percentage' => 0.10,
                'title' => 'Enable Rate Limiting and Advanced Blocking.'
            );
        }
        
        return array(
            'percentage' => $percentage,
            'missing' => $missing,
            'title' => 'Web Application Firewall Status',
            'helpLink' => admin_url('admin.php?page=vmpfence-firewall&view=options')
        );
    }
    
    /**
     * Get brute force protection status
     * 
     * Formula: Base (10%) + Network (50%) + Strong Passwords (10%) + 
     *          Mask Errors (10%) + Block Admin (10%) + Disable Author (10%)
     * 
     * @return array Status data
     */
    public static function get_brute_force_status() {
        $login_security_enabled = (bool) VMPFence_Config::get('brute_force_enabled', 0);
        $network_protection = (bool) VMPFence_Config::get('participate_security_network', 0);
        $strong_passwords = (bool) VMPFence_Config::get('enforce_strong_passwords', 0);
        $mask_errors = (bool) VMPFence_Config::get('dont_reveal_users', 0);
        $block_admin = (bool) VMPFence_Config::get('prevent_admin_username', 0);
        $disable_author = (bool) VMPFence_Config::get('prevent_username_discovery', 0);
        
        $percentage = 0.0;
        if ($login_security_enabled) {
            $percentage += 0.1;
            if ($network_protection) $percentage += 0.5;
            if ($strong_passwords) $percentage += 0.1;
            if ($mask_errors) $percentage += 0.1;
            if ($block_admin) $percentage += 0.1;
            if ($disable_author) $percentage += 0.1;
        }
        
        $missing = array();
        if (!$login_security_enabled) {
            $missing[] = array(
                'percentage' => 1.0,
                'title' => 'Enable Brute Force Protection.'
            );
        } else {
            if (!$network_protection) {
                $missing[] = array(
                    'percentage' => 0.5,
                    'title' => 'Enable Real-Time VMP Security Network.'
                );
            }
            if (!$strong_passwords) {
                $missing[] = array(
                    'percentage' => 0.1,
                    'title' => 'Enforce Strong Passwords.'
                );
            }
            if (!$mask_errors) {
                $missing[] = array(
                    'percentage' => 0.1,
                    'title' => 'Enable Mask Login Errors.'
                );
            }
            if (!$block_admin) {
                $missing[] = array(
                    'percentage' => 0.1,
                    'title' => 'Enable Block Admin Registration.'
                );
            }
            if (!$disable_author) {
                $missing[] = array(
                    'percentage' => 0.1,
                    'title' => 'Disable Author Scanning.'
                );
            }
        }
        
        return array(
            'percentage' => $percentage,
            'missing' => $missing,
            'title' => 'Brute Force Protection Status',
            'helpLink' => admin_url('admin.php?page=vmpfence-firewall-brute-force')
        );
    }
    
    /**
     * Get rule enablement percentage
     * 
     * @return float Percentage of enabled rules (0.0 to 1.0)
     */
    private static function get_rule_percentage() {
        // Get total WAF rules count from database
        global $wpdb;
        $table_name = $wpdb->prefix . 'vmpfence_waf_rules';
        $total_rules = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$table_name}");
        $disabled_rules = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$table_name} WHERE enabled = 0");
        
        if ($total_rules == 0) {
            return 1.0; // If no rules table exists yet, consider it 100% (not applicable)
        }
        
        $enabled_rules = $total_rules - $disabled_rules;
        return $enabled_rules / $total_rules;
    }
}
