<?php
/**
 * Name: AnonCaptcha
 * Description: Adds a math captcha for anonymous commenters to prevent spam
 * Version: 0.92
 * Author: ivan zlax <@zlax@ussr.win>
 * Maintainer: ivan zlax <@zlax@ussr.win>
 */

define('ANONCAPTCHA_SECRET', 'heresecretsalt');
define('ANONCAPTCHA_LIFE', 300);

/**
 * Register hooks and config on addon load
 */
function anoncaptcha_load() {
    register_hook('post_local_start', 'addon/anoncaptcha/anoncaptcha.php', 'anoncaptcha_post_local_start');
    register_hook('page_end', 'addon/anoncaptcha/anoncaptcha.php', 'anoncaptcha_page_end');
    set_config('anoncaptcha', 'enabled', 1);
}

/**
 * Unregister hooks and config on addon unload
 */
function anoncaptcha_unload() {
    unregister_hook('post_local_start', 'addon/anoncaptcha/anoncaptcha.php', 'anoncaptcha_post_local_start');
    unregister_hook('page_end', 'addon/anoncaptcha/anoncaptcha.php', 'anoncaptcha_page_end');
    del_config('anoncaptcha', 'enabled');
}

/**
 * Validate the captcha answer submitted via POST.
 * Checks that both token and answer are present, the answer is numeric,
 * and that the HMAC token is valid and not expired.
 */
function anoncaptcha_validate() {
    $token = $_POST['anoncaptcha_token'] ?? '';
    $submitted = trim($_POST['anoncaptcha_answer'] ?? '');

    if ($token === '' || $submitted === '') {
        return false;
    }
    if (!is_numeric($submitted)) {
        return false;
    }

    $correct = anoncaptcha_validate_token($token);
    if ($correct === false) {
        return false;
    }
    return (int)$submitted === $correct;
}

/**
 * Decode and verify an HMAC captcha token.
 * Returns the correct answer on success, or false if the token is
 * malformed, expired, or has an invalid signature.
 */
function anoncaptcha_validate_token($token) {
    $decoded = @base64_decode($token);
    if (!$decoded || !str_contains($decoded, '|')) {
        return false;
    }
    $parts = explode('|', $decoded, 3);
    if (count($parts) !== 3) {
        return false;
    }

    $hmac = $parts[0];
    $answer = $parts[1];
    $expires = (int)$parts[2];

    // Reject expired tokens
    if ($expires < time()) {
        return false;
    }

    // Verify HMAC signature (constant-time comparison)
    $data = $answer . '|' . $expires;
    $expected_hmac = hash_hmac('sha256', $data, ANONCAPTCHA_SECRET);
    if (!hash_equals($expected_hmac, $hmac)) {
        return false;
    }

    return (int)$answer;
}

/**
 * Hook: post_local_start — validate captcha before a comment is persisted.
 * Skips preview submissions and logged-in users (non-anonymous).
 */
function anoncaptcha_post_local_start(&$data) {
    // Skip preview submissions
    if (!empty($_POST['preview'])) {
        return;
    }
    // Skip non-anonymous comments (logged-in users)
    if (empty($_POST['anonname']) || empty($_POST['anonmail'])) {
        return;
    }

    // Validate captcha for anonymous submissions
    if (!anoncaptcha_validate()) {
        if (!isset($_SESSION['_NOTICES_'])) {
            $_SESSION['_NOTICES_'] = [];
        }
        $_SESSION['_NOTICES_'][] = t('Captcha verification failed. Please try again.');

        header('Content-Type: application/json');
        $msg = addslashes(t('Captcha verification failed. Please try again.'));
        echo json_encode(['captcha_fail' => true, 'error_msg' => $msg, 'success' => false]);
        exit;
    }
}

/**
 * Hook: page_end — inject JavaScript into the page footer.
 * On /moderate pages: adds Approve/Delete buttons (not rendered by default).
 * On other pages: injects captcha into anonymous comment editors
 *                  and hides moderation buttons for unauthenticated visitors.
 */
function anoncaptcha_page_end($content) {
    // Skip POST requests (AJAX form submissions)
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        return;
    }

    // Prevent page caching
    if (!headers_sent()) {
        header('Cache-Control: no-cache, no-store, must-revalidate');
        header('Pragma: no-cache');
        header('Expires: 0');
    }

    // Generate captcha token server-side (fresh on every request)
    $use_image = get_config('anoncaptcha', 'use_image', false);
    $a = rand(5, 49);
    $b = rand(5, 49);
    $answer = $a + $b;
    $expires = time() + ANONCAPTCHA_LIFE;
    $data = $answer . '|' . $expires;
    $hmac = hash_hmac('sha256', $data, ANONCAPTCHA_SECRET);
    $token = base64_encode($hmac . '|' . $data);

    $path = $_SERVER['REQUEST_URI'] ?? '';
    if (strpos($path, '/moderate') !== false) {
        // Inject Approve/Delete buttons on /moderate pages
        $mod_js = <<<JSEOF
<script>
(function(){
var added=new Set();
function addModerButtons(){
    var items = document.querySelectorAll('[id*="wall-item-content-wrapper-"]');
    for(var i=0;i<items.length;i++){
        var item = items[i];
        var id = item.id;
        if(added.has(id)) continue;
        var match = id.match(/(\d+)/);
        if(!match) continue;
        var num = match[1];
        added.add(id);
        var btns = document.createElement('div');
        btns.className = 'moderate-buttons';
        btns.style.cssText = 'margin:10px 0;display:flex;gap:8px;clear:both;';
        btns.innerHTML = '<a href="moderate/'+num+'/approve" class="btn btn-sm btn-outline-success"><i class="bi bi-check-lg"></i> Approve</a>'
            + '<a href="moderate/'+num+'/drop" class="btn btn-sm btn-outline-danger"><i class="bi bi-trash"></i> Delete</a>';
        var tools = item.querySelector('#wall-item-tools-right-'+num);
        if(tools){
            tools.parentNode.insertBefore(btns, tools.nextSibling);
        } else {
            item.parentNode.appendChild(btns);
        }
    }
}
try{addModerButtons();}catch(e){}
if(typeof MutationObserver!=="undefined"){
    try{var mo=new MutationObserver(addModerButtons);mo.observe(document.body,{childList:true,subtree:true});}catch(e){}
}
})();
</script>
JSEOF;
        App::$page['content'] .= $mod_js;
        return;
    }

    // Build captcha HTML with server-generated token
    if ($use_image && function_exists('imagecreatetruecolor')) {
        // Generate images inline
        $img_a = anoncaptcha_gen_img($a);
        $img_b = anoncaptcha_gen_img($b);
        $captcha_html = '<div class="anoncaptcha-form mb-3">'
            . '<label style="display:block;margin-bottom:6px;font-size:1.1em;">'
            . '<img src="' . $img_a . '" style="vertical-align:middle;" />'
            . ' + '
            . '<img src="' . $img_b . '" style="vertical-align:middle;" />'
            . ' = ?</label>'
            . '<input type="text" name="anoncaptcha_answer" required class="form-control" style="width:auto;max-width:200px;" autocomplete="off" />'
            . '<input type="hidden" name="anoncaptcha_token" value="' . $token . '" />'
            . '<small class="form-text text-muted">Captcha</small></div>';
    } else {
        $captcha_html = '<div class="anoncaptcha-form mb-3">'
            . '<label style="display:block;margin-bottom:6px;">What is ' . $a . ' + ' . $b . '?</label>'
            . '<input type="text" name="anoncaptcha_answer" required class="form-control" style="width:auto;max-width:200px;" autocomplete="off" />'
            . '<input type="hidden" name="anoncaptcha_token" value="' . $token . '" />'
            . '<small class="form-text text-muted">Captcha</small></div>';
    }

    $b64 = base64_encode($captcha_html);
    $debug = get_config('anoncaptcha', 'debug', false) ? 'true' : 'false';

    $js = <<<JSEOF
<script>
(function(){
var debugEnabled={$debug};
function dc(msg){if(debugEnabled)console.log('anoncaptcha: '+msg);}
// Show alert when captcha validation fails on item submission
if(typeof jQuery!=='undefined'){
    jQuery(document).ajaxComplete(function(event, xhr, settings){
        if(settings && settings.url && settings.url.indexOf('item')!==-1){
            dc('ajaxComplete for item request, url='+settings.url);
            dc('responseStatus='+xhr.status+' responseLength='+xhr.responseText.length);
            try{
                if(xhr.responseText){
                    var resp = JSON.parse(xhr.responseText);
                    dc('response parsed, captcha_fail='+resp.captcha_fail);
                    if(resp && resp.captcha_fail){
                        alert(resp.error_msg || 'Captcha failed');
                    }
                } else {
                    dc('empty response from server');
                    dc('check if anoncaptcha_token is in form data');
                }
            }catch(e){
                dc('error parsing response: '+e.message);
            }
        }
    });
}

// Detect whether the visitor is logged in
function isLoggedIn(){
    if(document.querySelector('#my_channels')) return true;
    if(document.querySelector('#user-menu')) return true;
    if(document.querySelector('#profile-link')) return true;
    if(document.querySelector('#settings-link')) return true;
    return false;
}

// Hide moderation buttons for anonymous visitors only.
function hideModButtons(){
    if(isLoggedIn()) return;
    var els = document.querySelectorAll('a[href*="moderate"]');
    for(var i=0;i<els.length;i++){
        var h=els[i].href||els[i].getAttribute('href')||'';
        if(/\\/moderate\\/\\d+\\/(approve|drop)/i.test(h) || /\\/moderate\\/\\d+$/i.test(h)){
            els[i].style.display='none';
            els[i].parentNode.style.display='none';
        }
    }
}
try{hideModButtons();}catch(e){}
if(typeof MutationObserver!=="undefined"){
    try{
        var mo=new MutationObserver(function(){
            if(!isLoggedIn()) hideModButtons();
        });
        mo.observe(document.body,{childList:true,subtree:true});
    }catch(e){}
}

// Inject captcha form into anonymous comment editors.
var h=atob('{$b64}');
dc('captcha HTML loaded, length='+h.length);
function addC(){
    var els=document.querySelectorAll('[id^="comment-edit-anon"]');
    dc('found '+els.length+' comment-edit-anon elements');
    for(var i=0;i<els.length;i++){
        if(!els[i].querySelector(".anoncaptcha-form")){
            var d=document.createElement("div");
            d.className="anoncaptcha-form";
            d.innerHTML=h;
            els[i].appendChild(d);
            dc('injected into '+els[i].id);
        }
    }
}
// Try immediately
addC();
// If no elements found, retry up to 30 times with 300ms delay (9 seconds total)
// Hubzilla loads comment forms via AJAX after initial page load
if(document.querySelectorAll('[id^="comment-edit-anon"]').length===0){
    var retries=0;
    var retry=setInterval(function(){
        retries++;
        addC();
        if(retries>=30 || document.querySelectorAll('[id^="comment-edit-anon"]').length>0){
            clearInterval(retry);
        }
    },300);
}
// Observe for dynamically added comment forms
if(typeof MutationObserver!=="undefined"){
    try{
        var mo=new MutationObserver(function(mutations){
            for(var m=0;m<mutations.length;m++){
                for(var i=0;i<mutations[m].addedNodes.length;i++){
                    var node=mutations[m].addedNodes[i];
                    if(node.nodeType===1 && node.id && node.id.indexOf('comment-edit-anon')===0){
                        if(!node.querySelector(".anoncaptcha-form")){
                            var d=document.createElement("div");
                            d.className="anoncaptcha-form";
                            d.innerHTML=h;
                            node.appendChild(d);
                        }
                    }
                }
            }
        });
        mo.observe(document.body,{childList:true,subtree:true});
    }catch(e){}
}
})();
</script>
JSEOF;

    // Inject into page content
    App::$page['content'] .= $js;
}

/**
 * Generate a PNG image with a number and return as base64 data URI.
 */
function anoncaptcha_gen_img($answer) {
    $width = 64;
    $height = 32;
    $img = imagecreatetruecolor($width, $height);
    $bgR = rand(180, 230);
    $bgG = rand(180, 230);
    $bgB = rand(180, 230);
    $bg = imagecolorallocate($img, $bgR, $bgG, $bgB);
    imagefill($img, 0, 0, $bg);
    for ($i = 0; $i < 3; $i++) {
        $color = imagecolorallocate($img, rand(100, 200), rand(100, 200), rand(100, 200));
        imageline($img, rand(0, $width), rand(0, $height), rand(0, $width), rand(0, $height), $color);
    }
    for ($i = 0; $i < 10; $i++) {
        $color = imagecolorallocate($img, rand(100, 200), rand(100, 200), rand(100, 200));
        imagesetpixel($img, rand(0, $width), rand(0, $height), $color);
    }
    imagestring($img, 5, ($width - 40) / 2, 4, (string)$answer,
        imagecolorallocate($img, 255 - $bgR, 255 - $bgG, 255 - $bgB));
    ob_start();
    imagepng($img);
    $data = ob_get_contents();
    ob_end_clean();
    imagedestroy($img);
    return 'data:image/png;base64,' . base64_encode($data);
}

function anoncaptcha_plugin_admin(&$a) {
    $use_image = get_config('anoncaptcha', 'use_image', false);
    $debug = get_config('anoncaptcha', 'debug', false);
    $t = get_markup_template('admin.tpl', 'addon/anoncaptcha/');
    $a = replace_macros($t, [
        '$submit' => t('Submit'),
        '$use_image' => ['use_image', t('Draw digital symbols using graphics'), $use_image, t('When enabled, captcha numbers will be drawn as small images instead of text.')],
        '$debug' => ['debug', t('Enable debug console logging'), $debug, t('When enabled, shows detailed debug messages in browser console for troubleshooting.')],
    ]);
}

function anoncaptcha_plugin_admin_post() {
    $use_image = intval($_POST['use_image'] ?? 0);
    $debug = intval($_POST['debug'] ?? 0);
    set_config('anoncaptcha', 'use_image', $use_image);
    set_config('anoncaptcha', 'debug', $debug);
    info(t('Settings updated.') . EOL);
}