agentgate.php

<?php
/**
 * Plugin Name: AgentGate
 * Plugin URI:  https://github.com/Sekai6/AgentGate-wordpress
 * Description: Reverse captcha for WordPress — blocks human browsers, lets AI agents through. Powered by AgentGate.
 * Version:     1.0.0
 * Author:      Sekai6
 * Author URI:  https://github.com/Sekai6
 * License:     MIT
 * Text Domain: agentgate
 */

if ( ! defined( 'ABSPATH' ) ) exit;

define( 'AGENTGATE_VERSION',     '1.0.0' );
define( 'AGENTGATE_DEMO_URL',    'https://captcha.kisara.art' );
define( 'AGENTGATE_OPTION_KEY',  'agentgate_settings' );
define( 'AGENTGATE_COOKIE_NAME', 'agentgate_verified' );
define( 'AGENTGATE_AJAX_ACTION', 'agentgate_verify' );

// ─── Activation / Deactivation ───────────────────────────────────────────────

register_activation_hook( __FILE__, 'agentgate_activate' );
function agentgate_activate() {
    if ( ! get_option( AGENTGATE_OPTION_KEY ) ) {
        update_option( AGENTGATE_OPTION_KEY, agentgate_defaults() );
    }
}

function agentgate_defaults() {
    return [
        'service_url'         => AGENTGATE_DEMO_URL,
        'global_enabled'      => 0,
        'protected_posts'     => '',
        'cookie_expire'       => 3600,
        'whitelist'           => '',
        'block_mode'          => 'overlay',   // overlay | redirect (future)
    ];
}

function agentgate_get( $key ) {
    $opts = get_option( AGENTGATE_OPTION_KEY, agentgate_defaults() );
    return $opts[ $key ] ?? ( agentgate_defaults()[ $key ] ?? '' );
}

// ─── UA Detection ────────────────────────────────────────────────────────────

function agentgate_is_human() {
    $ua = $_SERVER['HTTP_USER_AGENT'] ?? '';
    if ( empty( $ua ) ) return false;

    // Known bots / agents — pass through
    $bot_patterns = [
        'GPTBot', 'ChatGPT', 'ClaudeBot', 'anthropic-ai',
        'Googlebot', 'bingbot', 'Baiduspider', 'Sogou', 'YandexBot',
        'curl', 'wget', 'python-requests', 'Python-urllib',
        'Go-http-client', 'Java/', 'libwww-perl',
        'Scrapy', 'axios', 'node-fetch',
        'G.H.O.S.T', 'GHOST',
    ];
    foreach ( $bot_patterns as $pattern ) {
        if ( stripos( $ua, $pattern ) !== false ) return false;
    }

    // Custom whitelist from settings
    $custom = agentgate_get( 'whitelist' );
    if ( ! empty( $custom ) ) {
        foreach ( explode( "\n", $custom ) as $line ) {
            $line = trim( $line );
            if ( $line && stripos( $ua, $line ) !== false ) return false;
        }
    }

    // Browser UA patterns → human
    $human_patterns = [ 'Mozilla', 'Chrome', 'Safari', 'Firefox', 'Edge', 'Opera', 'Trident', 'MSIE' ];
    foreach ( $human_patterns as $h ) {
        if ( stripos( $ua, $h ) !== false ) return true;
    }

    return false;
}

// ─── Cookie Check ────────────────────────────────────────────────────────────

function agentgate_is_verified() {
    return ! empty( $_COOKIE[ AGENTGATE_COOKIE_NAME ] )
        && $_COOKIE[ AGENTGATE_COOKIE_NAME ] === '1';
}

// ─── Should intercept? ────────────────────────────────────────────────────────

function agentgate_should_intercept() {
    // Never intercept admin, login, REST, AJAX
    if ( is_admin() )                        return false;
    if ( defined( 'REST_REQUEST' ) )         return false;
    if ( defined( 'DOING_AJAX' ) )           return false;
    if ( ( $GLOBALS['pagenow'] ?? '' ) === 'wp-login.php' ) return false;
    if ( agentgate_is_verified() )           return false;
    if ( ! agentgate_is_human() )            return false;

    $global = (int) agentgate_get( 'global_enabled' );
    if ( $global === 1 ) return true;

    // Single post check
    if ( is_single() || is_page() ) {
        $post_id   = get_the_ID();
        $protected = agentgate_get( 'protected_posts' );
        if ( ! empty( $protected ) ) {
            $ids = array_map( 'trim', explode( ',', $protected ) );
            if ( in_array( (string) $post_id, $ids, true ) ) return true;
        }
    }

    return false;
}

// ─── Overlay HTML ─────────────────────────────────────────────────────────────

function agentgate_overlay_html() {
    $service_url = rtrim( agentgate_get( 'service_url' ) ?: AGENTGATE_DEMO_URL, '/' );
    $widget_js   = esc_url( $service_url . '/static/widget.js' );
    $ajax_url    = esc_url( admin_url( 'admin-ajax.php' ) );
    $nonce       = wp_create_nonce( AGENTGATE_AJAX_ACTION );
    $expire      = (int) agentgate_get( 'cookie_expire' ) ?: 3600;

    return <<<HTML
<style>
#agentgate-overlay{position:fixed;inset:0;min-height:100vh;display:flex;align-items:center;
justify-content:center;font-family:'Courier New',Courier,monospace;background:#000;z-index:2147483647}
#agentgate-overlay .ag-box{text-align:center;max-width:480px;padding:20px}
#agentgate-overlay pre{color:#00ff41;font-size:13px;text-align:left;line-height:1.5;margin:0 0 16px}
#agentgate-overlay #agent-captcha{margin:10px auto;min-height:80px}
#agentgate-overlay #agentgate-msg{color:#666;font-size:12px;margin-top:12px;min-height:18px}
body.agentgate-active>*:not(#agentgate-overlay){display:none!important}
</style>
<div id="agentgate-overlay">
  <div class="ag-box">
    <pre>
[ HUMAN PRESENCE DETECTED ]

Your User-Agent has been flagged as biological.
Access to this page requires identity verification.

Prove you are not human to continue.
    </pre>
    <div id="agent-captcha"></div>
    <div id="agentgate-msg"></div>
  </div>
</div>
<script>
(function(){
    document.body.classList.add('agentgate-active');
    var EXPIRE = {$expire};
    var AJAX   = '{$ajax_url}';
    var NONCE  = '{$nonce}';
    function setCookie(){
        var d=new Date();d.setTime(d.getTime()+EXPIRE*1000);
        document.cookie='agentgate_verified=1;path=/;expires='+d.toUTCString()+';SameSite=Lax';
    }
    function showPage(){
        document.body.classList.remove('agentgate-active');
        var el=document.getElementById('agentgate-overlay');
        if(el)el.parentNode.removeChild(el);
    }
    window.onAgentVerified=function(token,identity){
        var msg=document.getElementById('agentgate-msg');
        if(msg){msg.style.color='#00ff41';msg.textContent='\u2713 Identity confirmed. Welcome, non-human.';}
        setCookie();
        setTimeout(showPage,1000);
        if(AJAX){fetch(AJAX,{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},
            body:'action=agentgate_verify&nonce='+NONCE+'&token='+encodeURIComponent(token)
        }).catch(function(){});}
    };
})();
</script>
<script src="{$widget_js}" data-sitekey="universal" data-cfasync="false"></script>
HTML;
}

// ─── Inject overlay via wp_footer ────────────────────────────────────────────

add_action( 'wp_footer', 'agentgate_maybe_inject', 99 );
function agentgate_maybe_inject() {
    if ( agentgate_should_intercept() ) {
        echo agentgate_overlay_html();
    }
}

// ─── AJAX: server-side token verification (best-effort, non-blocking) ────────

add_action( 'wp_ajax_nopriv_' . AGENTGATE_AJAX_ACTION, 'agentgate_ajax_verify' );
add_action( 'wp_ajax_' . AGENTGATE_AJAX_ACTION,        'agentgate_ajax_verify' );
function agentgate_ajax_verify() {
    check_ajax_referer( AGENTGATE_AJAX_ACTION, 'nonce' );

    $token       = sanitize_text_field( $_POST['token'] ?? '' );
    $service_url = rtrim( agentgate_get( 'service_url' ) ?: AGENTGATE_DEMO_URL, '/' );
    $expire      = (int) agentgate_get( 'cookie_expire' ) ?: 3600;

    if ( empty( $token ) ) {
        wp_send_json_error( 'Missing token' );
    }

    $resp = wp_remote_post( $service_url . '/verify', [
        'timeout' => 5,
        'headers' => [ 'Content-Type' => 'application/json' ],
        'body'    => wp_json_encode([
            'token'   => $token,
            'sitekey' => 'universal',
        ]),
    ]);

    if ( is_wp_error( $resp ) ) {
        // Fail open — set cookie anyway if widget said verified
        setcookie( AGENTGATE_COOKIE_NAME, '1', time() + $expire, '/', '', is_ssl(), false );
        wp_send_json_success( [ 'source' => 'fail-open' ] );
    }

    $body = json_decode( wp_remote_retrieve_body( $resp ), true );
    if ( ! empty( $body['success'] ) ) {
        setcookie( AGENTGATE_COOKIE_NAME, '1', time() + $expire, '/', '', is_ssl(), false );
        wp_send_json_success( [ 'identity' => $body['identity'] ?? 'unknown' ] );
    }

    wp_send_json_error( $body['message'] ?? 'Verification failed' );
}

// ─── Admin Settings ──────────────────────────────────────────────────────────

add_action( 'admin_menu', 'agentgate_admin_menu' );
function agentgate_admin_menu() {
    add_options_page(
        'AgentGate Settings',
        'AgentGate',
        'manage_options',
        'agentgate',
        'agentgate_settings_page'
    );
}

add_action( 'admin_init', 'agentgate_register_settings' );
function agentgate_register_settings() {
    register_setting( 'agentgate_group', AGENTGATE_OPTION_KEY, 'agentgate_sanitize_settings' );
}

function agentgate_sanitize_settings( $input ) {
    $clean = agentgate_defaults();
    $clean['service_url']     = esc_url_raw( trim( $input['service_url'] ?? AGENTGATE_DEMO_URL ) ) ?: AGENTGATE_DEMO_URL;
    $clean['global_enabled']  = isset( $input['global_enabled'] ) ? 1 : 0;
    $clean['protected_posts'] = sanitize_text_field( $input['protected_posts'] ?? '' );
    $clean['cookie_expire']   = max( 60, (int)( $input['cookie_expire'] ?? 3600 ) );
    $clean['whitelist']       = sanitize_textarea_field( $input['whitelist'] ?? '' );
    return $clean;
}

function agentgate_settings_page() {
    $opts        = get_option( AGENTGATE_OPTION_KEY, agentgate_defaults() );
    $service_url = $opts['service_url'] ?: AGENTGATE_DEMO_URL;
    ?>
    <div class="wrap" style="font-family:monospace;">
        <h1 style="color:#00ff41;background:#0a0a0a;padding:12px 16px;border:1px solid #00ff41;">[ AGENTGATE SETTINGS ]</h1>

        <div style="background:#fff3cd;border:1px solid #ff6600;padding:12px 16px;margin:16px 0;border-radius:4px;">
            <strong>&#x26a0; Demo Service Notice</strong><br>
            The default URL points to a public demo instance (<code>captcha.kisara.art</code>).
            This service may be discontinued at any time. For production use, deploy your own instance:
            <a href="https://github.com/Artistkisa/AgentGate-captcha" target="_blank">AgentGate-captcha</a>
        </div>

        <form method="post" action="options.php">
            <?php settings_fields( 'agentgate_group' ); ?>
            <table class="form-table">
                <tr>
                    <th scope="row"><label for="ag_service_url">AgentGate Service URL</label></th>
                    <td>
                        <input type="url" id="ag_service_url" name="<?= AGENTGATE_OPTION_KEY ?>[service_url]"
                            value="<?= esc_attr( $service_url ) ?>" class="regular-text" placeholder="https://captcha.kisara.art">
                        <p class="description">Base URL of your AgentGate instance. Default: <code><?= AGENTGATE_DEMO_URL ?></code></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row">Global Enable</th>
                    <td>
                        <label>
                            <input type="checkbox" name="<?= AGENTGATE_OPTION_KEY ?>[global_enabled]" value="1"
                                <?php checked( $opts['global_enabled'], 1 ); ?>>
                            Intercept all pages (posts, pages, homepage, archives)
                        </label>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><label for="ag_protected">Protected Post / Page IDs</label></th>
                    <td>
                        <input type="text" id="ag_protected" name="<?= AGENTGATE_OPTION_KEY ?>[protected_posts]"
                            value="<?= esc_attr( $opts['protected_posts'] ?? '' ) ?>" class="regular-text"
                            placeholder="e.g. 42,107,233">
                        <p class="description">Comma-separated post or page IDs. Only active when Global Enable is off.</p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><label for="ag_cookie">Cookie Expiry (seconds)</label></th>
                    <td>
                        <input type="number" id="ag_cookie" name="<?= AGENTGATE_OPTION_KEY ?>[cookie_expire]"
                            value="<?= (int)( $opts['cookie_expire'] ?? 3600 ) ?>" min="60" style="width:120px">
                        <p class="description">How long a verified visitor stays verified. Default: 3600 (1 hour).</p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><label for="ag_whitelist">Custom UA Whitelist</label></th>
                    <td>
                        <textarea id="ag_whitelist" name="<?= AGENTGATE_OPTION_KEY ?>[whitelist]"
                            rows="5" cols="40"><?= esc_textarea( $opts['whitelist'] ?? '' ) ?></textarea>
                        <p class="description">One keyword per line. Requests whose UA contains any of these will bypass verification.</p>
                    </td>
                </tr>
            </table>
            <?php submit_button( 'Save Settings' ); ?>
        </form>
    </div>
    <?php
}