<?php
// freeloader_common.php
// Shared security helpers for Freeloader (hardened)
// N5AD - July 2026

if (!defined('FREELOADER_COMMON')) {
    define('FREELOADER_COMMON', true);
}

/**
 * Allowed directories (must match freeloader-helper.sh).
 * Intentionally excludes:
 *   - /usr/local/bin (prevents overwriting the privileged helper)
 *   - /var/www/html/freeloader (prevents overwriting the app itself)
 */
function freeloader_allowed_dirs(): array {
    return [
        '/my_uploads',
        '/etc/asterisk',
        '/etc/asterisk/local',
        '/etc/allmon3',
        '/var/lib/asterisk',
        '/var/www/html/supermon',
        '/usr/share/allmon3',
    ];
}

/** Human-readable allowlist for UI tooltips. */
function freeloader_allowed_dirs_label(): string {
    return implode(', ', freeloader_allowed_dirs());
}

/**
 * Filename patterns eligible for the Edit UI / save API (fnmatch, case-insensitive).
 * Dotfiles are not listed in the file browser; do not include leading-dot-only names here.
 */
function freeloader_editable_patterns(): array {
    return [
        '*.ini', 'ini.*',
        '*.conf', 'conf.*', '*.conf.*',
        '*.sh', '*.bash',
        '*.txt', '*.cfg', '*.json', '*.xml',
        '*.log', '*.md', '*.yml', '*.yaml',
        '*.js', '*.css', '*.html', '*.htm',
        '*.c', '*.h', '*.py', '*.pl', '*.rb', '*.sql',
        '*.env',
        '*.service', '*.timer',
        '*.bak', '*.old', '*.dist', '*.sample', '*.tpl', '*.inc',
    ];
}

/** Extensions that must never be uploaded or saved (webshell / executable risk). */
function freeloader_dangerous_extensions(): array {
    return [
        'php', 'phtml', 'php3', 'php4', 'php5', 'php7', 'php8',
        'phar', 'exe', 'htaccess', 'cgi', 'asp', 'aspx', 'jsp',
    ];
}

function freeloader_is_dangerous_filename(string $name): bool {
    $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
    if ($ext !== '' && in_array($ext, freeloader_dangerous_extensions(), true)) {
        return true;
    }
    // Bare names like ".htaccess"
    $base = strtolower(basename($name));
    return in_array($base, ['.htaccess', 'htaccess', '.htpasswd'], true);
}

function freeloader_is_editable_filename(string $name): bool {
    foreach (freeloader_editable_patterns() as $pat) {
        if (fnmatch($pat, $name, FNM_CASEFOLD)) {
            return true;
        }
    }
    return false;
}

function freeloader_validate_dir(string $input): string|false {
    $input = trim($input);
    if ($input === '' || str_contains($input, "\0")) {
        return false;
    }

    $resolved = realpath($input);
    if ($resolved === false || !is_dir($resolved)) {
        return false;
    }

    foreach (freeloader_allowed_dirs() as $base) {
        $baseReal = realpath($base);
        if ($baseReal === false) {
            continue;
        }
        if ($resolved === $baseReal || str_starts_with($resolved, $baseReal . DIRECTORY_SEPARATOR)) {
            return $resolved;
        }
    }

    return false;
}

function freeloader_validate_filename(string $name): string|false {
    $name = basename($name);
    if ($name === '' || $name === '.' || $name === '..') {
        return false;
    }
    if (preg_match('/[\/\\\\\x00]/', $name)) {
        return false;
    }
    return $name;
}

/** Safe Content-Disposition filename (ASCII fallback). */
function freeloader_content_disposition(string $filename): string {
    $safe = preg_replace('/[\r\n"\\\\]/', '_', basename($filename)) ?: 'download';
    return 'attachment; filename="' . $safe . '"';
}

function freeloader_bootstrap_session(): void {
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }
    $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
    session_set_cookie_params([
        'lifetime' => 0,
        'path' => '/',
        'secure' => $secure,
        'httponly' => true,
        'samesite' => 'Strict',
    ]);
    session_start();
}

function freeloader_require_auth(): void {
    freeloader_bootstrap_session();

    if (empty($_SESSION['freeloader_loggedin'])) {
        http_response_code(403);
        die('Access denied. Please log in.');
    }

    $timeout = 1800;
    if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $timeout)) {
        session_unset();
        session_destroy();
        http_response_code(403);
        die('Session expired. Please log in again.');
    }

    $_SESSION['last_activity'] = time();
}

function freeloader_csrf_token(): string {
    freeloader_bootstrap_session();
    if (empty($_SESSION['freeloader_csrf'])) {
        $_SESSION['freeloader_csrf'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['freeloader_csrf'];
}

function freeloader_verify_csrf(?string $token): bool {
    if (empty($token) || empty($_SESSION['freeloader_csrf'])) {
        return false;
    }
    return hash_equals($_SESSION['freeloader_csrf'], $token);
}

function freeloader_helper(string $command, array $args = []): array {
    $helper = '/usr/local/bin/freeloader-helper';
    if (!file_exists($helper)) {
        return [false, 'Helper script not found.'];
    }

    $cmd = 'sudo ' . escapeshellarg($helper) . ' ' . escapeshellarg($command);
    foreach ($args as $a) {
        $cmd .= ' ' . escapeshellarg($a);
    }

    $output = [];
    $returnCode = 0;
    exec($cmd . ' 2>&1', $output, $returnCode);

    return [$returnCode === 0, implode("\n", $output)];
}