<?php
/* Silentt Design: AI crawler logging.
 *
 * .htaccess sends a request here ONLY when its user agent names one of the AI crawlers in
 * $BOTS (Googlebot, Bingbot and people never come through PHP). This script serves exactly
 * the static file Apache would have served, then tells the chat server which bot fetched
 * which page (POST https://chat.silenttdesign.com/api/a/bot), in the background, with a
 * one-second limit. Logging can never fail or slow the response.
 *
 * No secrets live here on purpose: if PHP were ever misconfigured and this file's source
 * were shown, there would be nothing to learn. The chat server checks the user agent
 * against the same list and rate-limits instead.
 *
 * Keep $BOTS the same as the RewriteCond in .htaccess and BOTS in chat-server/src/bots.js. */

$BOTS = array('GPTBot', 'OAI-SearchBot', 'ChatGPT-User', 'PerplexityBot', 'Perplexity-User', 'ClaudeBot',
  'Claude-User', 'Claude-SearchBot', 'anthropic-ai', 'CCBot', 'Bytespider', 'Amazonbot', 'Applebot-Extended',
  'meta-externalagent', 'DuckAssistBot', 'MistralAI-User', 'Google-CloudVertexBot', 'cohere-ai');
// SD_BOT_LOG_URL only for testing locally (php -S); on Hostinger it is never set.
$LOG_URL = getenv('SD_BOT_LOG_URL') ?: 'https://chat.silenttdesign.com/api/a/bot';

$TYPES = array(
  'html' => 'text/html; charset=utf-8', 'htm' => 'text/html; charset=utf-8', 'txt' => 'text/plain; charset=utf-8',
  'xml' => 'application/xml; charset=utf-8', 'json' => 'application/json; charset=utf-8', 'css' => 'text/css; charset=utf-8',
  'js' => 'text/javascript; charset=utf-8', 'mjs' => 'text/javascript; charset=utf-8', 'svg' => 'image/svg+xml',
  'png' => 'image/png', 'jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'webp' => 'image/webp', 'gif' => 'image/gif',
  'ico' => 'image/x-icon', 'pdf' => 'application/pdf', 'mp4' => 'video/mp4', 'woff2' => 'font/woff2', 'otf' => 'font/otf',
  'webmanifest' => 'application/manifest+json',
);

if (function_exists('header_remove')) @header_remove('X-Powered-By');
$root = realpath(__DIR__);
$method = isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : 'GET';
$uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/';
$ua = isset($_SERVER['HTTP_USER_AGENT']) ? substr($_SERVER['HTTP_USER_AGENT'], 0, 300) : '';
$qpos = strpos($uri, '?');
$rawPath = $qpos === false ? $uri : substr($uri, 0, $qpos);
$path = rawurldecode($rawPath);
if ($path === '' || $path[0] !== '/') $path = '/' . $path;

function sd_bot_name($ua, $bots) {
  $best = '';
  foreach ($bots as $b) if (stripos($ua, $b) !== false && strlen($b) > strlen($best)) $best = $b;
  return $best;
}

/* The file Apache would serve: inside the docroot only, never a dotfile, never PHP source,
 * a directory's index.html, and a directory without its trailing slash redirects like
 * Apache's DirectorySlash does. Returns array(status, file or redirect target). */
function sd_resolve($root, $path) {
  if ($root === false || strpos($path, "\0") !== false || strpos($path, '\\') !== false) return array(404, null);
  foreach (explode('/', $path) as $seg) {
    if ($seg === '..' || ($seg !== '' && $seg[0] === '.' && $seg !== '.well-known')) return array(404, null);
  }
  $full = realpath($root . $path);
  if ($full === false) return array(404, null);
  if ($full !== $root && strpos($full, $root . DIRECTORY_SEPARATOR) !== 0) return array(404, null);
  if (is_dir($full)) {
    if (substr($path, -1) !== '/') return array(301, $path . '/');
    $full = $full . DIRECTORY_SEPARATOR . 'index.html';
    if (!is_file($full)) return array(404, null);
  }
  if (!is_file($full) || !is_readable($full)) return array(404, null);
  if (preg_match('/\.(php\d?|phtml|phar|inc|htaccess|htpasswd|env|ini|log|sql|bak|orig|swp)$/i', $full)) return array(404, null);
  return array(200, $full);
}

list($status, $target) = sd_resolve($root, $path);
$head = ($method === 'HEAD');

if ($method !== 'GET' && $method !== 'HEAD') {
  $status = 405;
  header('Allow: GET, HEAD');
  header('Content-Type: text/plain; charset=utf-8');
  http_response_code(405);
  if (!$head) echo "Method not allowed\n";
} elseif ($status === 301) {
  $qs = $qpos === false ? '' : substr($uri, $qpos);
  http_response_code(301);
  header('Location: ' . str_replace('%2F', '/', rawurlencode($target)) . $qs);
} elseif ($status === 200) {
  $ext = strtolower(pathinfo($target, PATHINFO_EXTENSION));
  $type = isset($TYPES[$ext]) ? $TYPES[$ext] : 'application/octet-stream';
  $mtime = filemtime($target);
  $size = filesize($target);
  $etag = '"' . dechex($mtime) . '-' . dechex($size) . '"';
  header('Content-Type: ' . $type);
  header('Last-Modified: ' . gmdate('D, d M Y H:i:s', $mtime) . ' GMT');
  header('ETag: ' . $etag);
  header('Cache-Control: ' . (preg_match('/^(html|txt|xml)$/', $ext) ? 'no-cache, must-revalidate' : 'public, max-age=31536000, immutable'));
  $inm = isset($_SERVER['HTTP_IF_NONE_MATCH']) ? trim($_SERVER['HTTP_IF_NONE_MATCH']) : '';
  $ims = isset($_SERVER['HTTP_IF_MODIFIED_SINCE']) ? strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']) : false;
  if (($inm !== '' && $inm === $etag) || ($inm === '' && $ims !== false && $ims >= $mtime)) {
    $status = 304;
    http_response_code(304);
  } else {
    http_response_code(200);
    header('Content-Length: ' . $size);
    if (!$head) readfile($target);
  }
} else {
  $status = 404;
  http_response_code(404);
  header('Content-Type: text/html; charset=utf-8');
  $nf = $root === false ? false : $root . DIRECTORY_SEPARATOR . '404.html';
  if (!$head) {
    if ($nf && is_file($nf)) readfile($nf); else echo "<!doctype html><title>Not found</title><h1>Not found</h1>\n";
  }
}

/* ------------------------------------------------------------------ log, after the reply */
$bot = sd_bot_name($ua, $BOTS);
if ($bot === '') exit;
if (function_exists('litespeed_finish_request')) { @litespeed_finish_request(); }
elseif (function_exists('fastcgi_finish_request')) { @fastcgi_finish_request(); }
else { @ob_end_flush(); @flush(); }
ignore_user_abort(true);

try {
  $body = json_encode(array('bot' => $bot, 'path' => substr($rawPath, 0, 300), 'status' => $status, 'ua' => $ua, 't' => time()));
  if ($body !== false) {
    if (function_exists('curl_init')) {
      $ch = curl_init($LOG_URL);
      curl_setopt_array($ch, array(
        CURLOPT_POST => true, CURLOPT_POSTFIELDS => $body, CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => array('Content-Type: application/json'), CURLOPT_USERAGENT => 'SilenttSite/1.0 (sd-bot.php)',
        CURLOPT_CONNECTTIMEOUT_MS => 700, CURLOPT_TIMEOUT_MS => 1000, CURLOPT_NOSIGNAL => 1,
      ));
      @curl_exec($ch);
      @curl_close($ch);
    } else {
      $ctx = stream_context_create(array('http' => array(
        'method' => 'POST', 'timeout' => 1, 'ignore_errors' => true,
        'header' => "Content-Type: application/json\r\nUser-Agent: SilenttSite/1.0 (sd-bot.php)\r\n",
        'content' => $body,
      )));
      @file_get_contents($LOG_URL, false, $ctx);
    }
  }
} catch (Throwable $e) {
  // Logging is best effort: the page has already been sent.
}