Client.php

<?php

/**
 * IP Block Protection - a XenForo 2 add-on.
 *
 * @copyright 2026 ip-block.com
 * @license   GNU General Public License v2.0 only
 */

namespace IpBlock\Protection;

use GuzzleHttp\Client as GuzzleClient;

/**
 * HTTP client for the ip-block.com screening API.
 *
 * Shared API contract:
 *   POST https://api.ip-block.com/v1/check
 *   Header:  Content-Type: application/json
 *   Body:    {"api_key","site_id","ip","user_agent","referrer"}
 *   Reply:   {"action":"allow"} | {"action":"block"}
 *   Timeout: 1 second. Blocked ONLY when action === "block".
 */
class Client
{
	/** @var \XF\App */
	protected $app;

	public function __construct(\XF\App $app)
	{
		$this->app = $app;
	}

	/**
	 * Ask the API whether an IP should be allowed or blocked.
	 *
	 * @param string $ip
	 * @param string $userAgent
	 * @param string $referrer
	 *
	 * @return string|null 'allow', 'block', or null on ANY error/timeout so the
	 *                      caller can apply its fail mode.
	 */
	public function check($ip, $userAgent, $referrer)
	{
		$options = $this->app->options();

		$apiUrl = $options->ipBlockApiUrl ?: 'https://api.ip-block.com/v1/check';

		$payload = [
			'api_key'    => (string) $options->ipBlockApiKey,
			'site_id'    => (string) $options->ipBlockSiteId,
			'ip'         => (string) $ip,
			'user_agent' => (string) $userAgent,
			'referrer'   => (string) $referrer,
		];

		try
		{
			/** @var GuzzleClient $http */
			$http = $this->app->http()->client();

			$response = $http->post($apiUrl, [
				'headers'         => ['Content-Type' => 'application/json'],
				'json'            => $payload,
				'timeout'         => 1,
				'connect_timeout' => 1,
				'http_errors'     => false,
			]);

			$status = $response->getStatusCode();
			if ($status < 200 || $status >= 300)
			{
				return null;
			}

			$data = @json_decode((string) $response->getBody(), true);
			if (!is_array($data) || !isset($data['action']))
			{
				return null;
			}

			// Blocked ONLY on an explicit "block" action.
			return ($data['action'] === 'block') ? 'block' : 'allow';
		}
		catch (\Throwable $e)
		{
			// Timeout, DNS failure, connection reset, etc. => let the caller fail open/closed.
			return null;
		}
	}
}