<?php declare(strict_types=1);
/**
 * Blocked user functionality
 *
 * @package wp-fail2ban
 * @since   4.4.0   Require PHP 7.4
 * @since   4.0.0
 */
namespace org\lecklider\charles\wordpress\wp_fail2ban\feature;

use org\lecklider\charles\wordpress\wp_fail2ban\Config;
use org\lecklider\charles\wordpress\wp_fail2ban\Syslog;

use function org\lecklider\charles\wordpress\wp_fail2ban\bail;

defined( 'ABSPATH' ) or exit;

/**
 * Catch blocked users
 *
 * @see \wp_authenticate()
 *
 * @since  4.4.0    Add type hints
 * @since  4.3.4.0  Refactor to use Syslog::single
 * @since  4.3.0    Add blocking username logins
 * @since  3.5.0    Refactored for unit testing
 * @since  2.0.0
 *
 * @param  mixed|null $user
 * @param  string     $username
 * @param  string     $password
 *
 * @return mixed|null
 *
 * @wp-f2b-hard Blocked authentication attempt for .*
 * @wp-f2b-soft Blocked username authentication attempt for .*
 */
function block_users( $user, string $username, string $password ) {
	// : ?mixed
	if ( ! empty( $username ) ) {
		if ( Config::get( 'WP_FAIL2BAN_BLOCK_USERNAME_LOGIN' ) ) {
			if ( is_email( $username ) ) {
				// OK!
			} else {
				Syslog::single( LOG_NOTICE, "Blocked username authentication attempt for {$username}" );

				do_action( __FUNCTION__ . '.block_username_login', $user, $username, $password );

				return bail(); // for testing
			}
		}

		if ( ! empty( Config::get( 'WP_FAIL2BAN_BLOCKED_USERS' ) ) ) {
			/**
			 * @since 3.5.0 Arrays allowed in PHP 7
			 */
			$blocked_users = Config::get( 'WP_FAIL2BAN_BLOCKED_USERS' );
			$matched       = ( is_array( $blocked_users ) )
				? in_array( $username, $blocked_users )
				: preg_match( '/' . $blocked_users . '/i', $username );

			if ( $matched ) {
				Syslog::single( LOG_NOTICE, "Blocked authentication attempt for {$username}" );

				do_action( __FUNCTION__ . '.blocked_users', $user, $username, $password );

				return bail(); // for testing
			}
		}
	}

	return $user;
}