<?php
/**
 * @package Hafenstudios\Wellenbrecher
 */

namespace Hafenstudios\Wellenbrecher\Rules;

use Hafenstudios\Wellenbrecher\Engine\Context;
use Hafenstudios\Wellenbrecher\Engine\RuleResult;

defined( 'ABSPATH' ) || exit;

/**
 * Chrome/Chromium-UA ohne Sec-Fetch-Header: moderne Chromium-Browser senden
 * bei Formular-POSTs immer Sec-Fetch-Site. Fehlt der Header trotz
 * Chrome-Claim, luegt der Client ueber seine Identitaet.
 */
class SecFetchRule extends AbstractRule {

	public const ID             = 'sec_fetch_missing';
	public const DEFAULT_POINTS = 15;

	public function __construct( int $points = self::DEFAULT_POINTS ) {
		parent::__construct( $points );
	}

	public function id(): string {
		return self::ID;
	}

	public function stage(): int {
		return 1;
	}

	public function evaluate( Context $context ): RuleResult {
		$ua = $context->server( 'user_agent' );
		if ( false === stripos( $ua, 'chrome/' ) && false === stripos( $ua, 'chromium/' ) ) {
			return $this->miss();
		}
		if ( '' === trim( $context->server( 'sec_fetch_site' ) ) ) {
			return $this->hit();
		}
		return $this->miss();
	}
}
