<?php
declare(strict_types=1);

const LOOKUP_LIMIT = 10; // RFC 7208 section 4.6.4 limit on DNS-querying mechanisms

/**
 * Recursively resolves an SPF record, following include/redirect, and counts
 * the DNS-querying mechanisms toward the RFC 7208 limit of 10.
 */
class SpfResolver
{
    public int $lookupCount = 0;
    /** @var string[] */
    public array $warnings = [];
    /** @var array<int,array{display:string,query:string,source:string,mechanism:string}> */
    public array $ips = [];
    /** @var array<string,bool> */
    private array $visited = [];

    public function resolve(string $domain, int $depth = 0): array
    {
        $node = ['domain' => $domain, 'record' => null, 'error' => null, 'terms' => []];

        if ($depth > 20) {
            $node['error'] = 'Maximum recursion depth exceeded.';
            return $node;
        }
        if (isset($this->visited[$domain])) {
            $node['error'] = 'Already evaluated — skipped to avoid an include loop.';
            return $node;
        }
        $this->visited[$domain] = true;

        $record = self::getSpfRecord($domain);
        if ($record === null) {
            $node['error'] = 'No "v=spf1" TXT record found.';
            return $node;
        }
        $node['record'] = $record;

        foreach (preg_split('/\s+/', trim($record)) as $term) {
            if ($term === '' || strtolower($term) === 'v=spf1') {
                continue;
            }
            $node['terms'][] = $this->processTerm($term, $domain, $depth);
        }
        return $node;
    }

    private function processTerm(string $term, string $domain, int $depth): array
    {
        $result = ['raw' => $term, 'type' => 'unknown', 'value' => null, 'lookup' => false, 'child' => null];
        $lower = strtolower($term);

        // Modifiers (no qualifier prefix)
        if (str_starts_with($lower, 'redirect=')) {
            $target = substr($term, 9);
            $this->countLookup('redirect=' . $target);
            $result['type'] = 'redirect';
            $result['value'] = $target;
            $result['lookup'] = true;
            $result['child'] = $this->resolve($target, $depth + 1);
            return $result;
        }
        if (str_starts_with($lower, 'exp=')) {
            $result['type'] = 'exp';
            $result['value'] = substr($term, 4);
            return $result;
        }

        // Mechanisms may carry a qualifier (+ - ~ ?)
        $qualifier = '';
        if (strlen($term) && in_array($term[0], ['+', '-', '~', '?'], true)) {
            $qualifier = $term[0];
            $term = substr($term, 1);
            $lower = strtolower($term);
        }
        $result['qualifier'] = $qualifier;

        if ($lower === 'all') {
            $result['type'] = 'all';
            $result['value'] = ($qualifier ?: '+') . 'all';
            return $result;
        }
        if (str_starts_with($lower, 'include:')) {
            $target = substr($term, 8);
            $this->countLookup('include:' . $target);
            $result['type'] = 'include';
            $result['value'] = $target;
            $result['lookup'] = true;
            $result['child'] = $this->resolve($target, $depth + 1);
            return $result;
        }
        if ($lower === 'a' || str_starts_with($lower, 'a:') || str_starts_with($lower, 'a/')) {
            $this->countLookup($term);
            $result['type'] = 'a';
            $result['value'] = $term;
            $result['lookup'] = true;
            $this->collectHostIps(self::mechanismHost($term, 'a', $domain), $term, $domain);
            return $result;
        }
        if ($lower === 'mx' || str_starts_with($lower, 'mx:') || str_starts_with($lower, 'mx/')) {
            $this->countLookup($term);
            $result['type'] = 'mx';
            $result['value'] = $term;
            $result['lookup'] = true;
            $host = self::mechanismHost($term, 'mx', $domain);
            foreach ((@dns_get_record($host, DNS_MX) ?: []) as $mx) {
                if (!empty($mx['target'])) {
                    $this->collectHostIps($mx['target'], $term, $domain);
                }
            }
            return $result;
        }
        if (str_starts_with($lower, 'ip4:') || str_starts_with($lower, 'ip6:')) {
            $value = substr($term, 4);
            $result['type'] = strtolower(substr($term, 0, 3));
            $result['value'] = $value;
            $this->ips[] = [
                'display' => $value,
                'query' => explode('/', $value)[0],
                'source' => $domain,
                'mechanism' => $result['type'],
            ];
            return $result;
        }
        if ($lower === 'ptr' || str_starts_with($lower, 'ptr:')) {
            $this->countLookup($term);
            $result['type'] = 'ptr';
            $result['value'] = $term;
            $result['lookup'] = true;
            return $result;
        }
        if (str_starts_with($lower, 'exists:')) {
            $this->countLookup($term);
            $result['type'] = 'exists';
            $result['value'] = substr($term, 7);
            $result['lookup'] = true;
            return $result;
        }
        return $result;
    }

    private function countLookup(string $label): void
    {
        $this->lookupCount++;
        if ($this->lookupCount === LOOKUP_LIMIT) {
            $this->warnings[] = sprintf(
                'Reached the RFC 7208 limit of %d DNS lookups at "%s". Any further lookup mechanism will make evaluators return a PermError.',
                LOOKUP_LIMIT,
                $label
            );
        } elseif ($this->lookupCount > LOOKUP_LIMIT) {
            $this->warnings[] = sprintf(
                'Exceeded the %d-lookup limit (now %d) at "%s" — this SPF record will fail with a PermError.',
                LOOKUP_LIMIT,
                $this->lookupCount,
                $label
            );
        }
    }

    private function collectHostIps(string $host, string $mechanism, string $source): void
    {
        foreach (self::hostIps($host) as $ip) {
            $this->ips[] = [
                'display' => $ip,
                'query' => $ip,
                'source' => $source,
                'mechanism' => $mechanism,
            ];
        }
    }

    /** Returns the target host for an a/mx mechanism, stripping any CIDR suffix. */
    private static function mechanismHost(string $term, string $name, string $domain): string
    {
        $rest = substr($term, strlen($name)); // "", ":host", "/24", ":host/24"
        if ($rest === '' || $rest[0] === '/') {
            return $domain;
        }
        $rest = ltrim($rest, ':');
        return explode('/', $rest)[0];
    }

    /** @return string[] */
    private static function hostIps(string $host): array
    {
        $ips = [];
        foreach ((@dns_get_record($host, DNS_A) ?: []) as $r) {
            if (!empty($r['ip'])) {
                $ips[] = $r['ip'];
            }
        }
        foreach ((@dns_get_record($host, DNS_AAAA) ?: []) as $r) {
            if (!empty($r['ipv6'])) {
                $ips[] = $r['ipv6'];
            }
        }
        return $ips;
    }

    private static function getSpfRecord(string $domain): ?string
    {
        foreach ((@dns_get_record($domain, DNS_TXT) ?: []) as $r) {
            $txt = $r['txt'] ?? (isset($r['entries']) ? implode('', $r['entries']) : '');
            if (stripos($txt, 'v=spf1') === 0) {
                return $txt;
            }
        }
        return null;
    }
}

/**
 * Enriches IPs with ASN / country / company via ip-api.com's free batch endpoint.
 * @param string[] $ips
 * @return array<string,array>
 */
function lookupIpInfo(array $ips): array
{
    $out = [];
    $ips = array_values(array_unique(array_filter($ips)));
    if (empty($ips)) {
        return $out;
    }
    $fields = 'query,status,message,country,countryCode,as,asname,isp,org';
    foreach (array_chunk($ips, 100) as $chunk) {
        $payload = array_map(static fn($ip) => ['query' => $ip, 'fields' => $fields], $chunk);
        $ch = curl_init('http://ip-api.com/batch');
        curl_setopt_array($ch, [
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => json_encode($payload),
            CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => 20,
        ]);
        $resp = curl_exec($ch);
        curl_close($ch);
        foreach ((json_decode((string) $resp, true) ?: []) as $item) {
            if (isset($item['query'])) {
                $out[$item['query']] = $item;
            }
        }
    }
    return $out;
}

$domain = trim((string) ($_GET['domain'] ?? ''));
$resolver = null;
$ipInfo = [];
$inputError = null;

if ($domain !== '') {
    // Accept a bare hostname; strip scheme/path if a URL was pasted.
    $domain = preg_replace('#^\w+://#', '', $domain);
    $domain = explode('/', $domain)[0];
    $domain = strtolower(trim($domain));

    if (!preg_match('/^(?=.{1,253}$)([a-z0-9](-?[a-z0-9])*\.)+[a-z]{2,}$/', $domain)) {
        $inputError = 'Please enter a valid domain name (e.g. example.com).';
    } else {
        $resolver = new SpfResolver();
        $tree = $resolver->resolve($domain);
        $ipInfo = lookupIpInfo(array_column($resolver->ips, 'query'));
    }
}

/** Renders the resolved SPF tree as nested lists. */
function renderTree(array $node): string
{
    $h = 'htmlspecialchars';
    $out = '<div class="node">';
    $out .= '<div class="node-domain">🌐 ' . $h($node['domain']) . '</div>';

    if ($node['error']) {
        $out .= '<div class="node-error">⚠️ ' . $h($node['error']) . '</div></div>';
        return $out;
    }
    $out .= '<div class="record">' . $h((string) $node['record']) . '</div>';
    $out .= '<ul class="terms">';
    foreach ($node['terms'] as $term) {
        $badge = strtoupper($h($term['type']));
        $cls = $term['lookup'] ? 'term lookup' : 'term';
        $out .= '<li class="' . $cls . '"><span class="badge badge-' . $h($term['type']) . '">' . $badge . '</span> '
            . '<code>' . $h($term['raw']) . '</code>';
        if ($term['lookup']) {
            $out .= ' <span class="lk">DNS lookup</span>';
        }
        if (!empty($term['child'])) {
            $out .= renderTree($term['child']);
        }
        $out .= '</li>';
    }
    $out .= '</ul></div>';
    return $out;
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>SPF Record Checker</title>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
            max-width: 1200px;
            margin: 40px auto;
            padding: 0 20px;
            background: #f5f5f5;
            color: #333;
        }
        h1 { color: #333; }
        .info { background: #e3f2fd; padding: 15px; border-radius: 5px; margin-bottom: 20px; }
        form.lookup { margin-bottom: 20px; display: flex; gap: 10px; flex-wrap: wrap; }
        input[type=text] {
            flex: 1; min-width: 240px; padding: 10px; font-size: 15px;
            border: 1px solid #ccc; border-radius: 5px;
        }
        .btn {
            display: inline-block; padding: 10px 20px; background: #2196F3; color: white;
            text-decoration: none; border-radius: 5px; border: none; cursor: pointer; font-size: 15px;
        }
        .btn:hover { background: #1976D2; }
        .error { background: #ffebee; color: #c62828; padding: 10px; border-radius: 5px; margin: 10px 0; }
        .warning {
            background: #fff8e1; color: #e65100; padding: 12px 15px; border-radius: 5px;
            margin: 10px 0; border-left: 5px solid #ff9800;
        }
        .counter {
            display: inline-block; padding: 8px 14px; border-radius: 5px; font-weight: 600;
            background: #e8f5e9; color: #2e7d32;
        }
        .counter.warn { background: #fff8e1; color: #e65100; }
        .counter.over { background: #ffebee; color: #c62828; }
        .node { margin: 8px 0; }
        .node-domain { font-weight: 600; margin-top: 6px; }
        .node-error { color: #c62828; margin: 4px 0 4px 10px; }
        .record {
            background: #263238; color: #aed581; padding: 8px 12px; border-radius: 4px;
            font-family: monospace; font-size: 13px; word-break: break-all; margin: 4px 0;
        }
        ul.terms { list-style: none; margin: 4px 0 4px 8px; padding-left: 16px; border-left: 2px solid #e0e0e0; }
        .term { margin: 4px 0; }
        .term code { background: #eceff1; padding: 2px 6px; border-radius: 3px; font-size: 13px; }
        .badge {
            display: inline-block; min-width: 54px; text-align: center; padding: 2px 6px;
            border-radius: 3px; font-size: 11px; font-weight: 700; color: white; background: #90a4ae;
        }
        .badge-include, .badge-redirect { background: #5c6bc0; }
        .badge-ip4, .badge-ip6 { background: #26a69a; }
        .badge-a, .badge-mx { background: #ec407a; }
        .badge-all { background: #78909c; }
        .badge-exists, .badge-ptr { background: #ab47bc; }
        .lk { font-size: 11px; color: #ef6c00; font-weight: 600; }
        table { width: 100%; border-collapse: collapse; background: white; box-shadow: 0 1px 3px rgba(0,0,0,0.1); margin-top: 10px; }
        th, td { padding: 10px 12px; text-align: left; border-bottom: 1px solid #ddd; font-size: 13px; }
        th { background: #2196F3; color: white; }
        tr:hover { background: #f5f5f5; }
        td.ip { font-family: monospace; }
        h2 { color: #333; margin-top: 30px; }
        .empty { text-align: center; color: #999; padding: 40px; }
    </style>
</head>
<body>
    <h1>🛡️ SPF Record Checker</h1>

    <div class="info">
        Resolves a domain's <strong>SPF</strong> record, follows every <code>include:</code> and
        <code>redirect=</code>, and enriches each authorised IP with its <strong>ASN, country and company</strong>.
        Counts the DNS-querying mechanisms and warns when the
        <strong>RFC 7208 limit of <?= LOOKUP_LIMIT ?> lookups</strong> is reached.
    </div>

    <form class="lookup" method="GET">
        <input type="text" name="domain" placeholder="example.com" value="<?= htmlspecialchars($domain) ?>" autofocus>
        <button type="submit" class="btn">🔍 Check SPF</button>
    </form>

    <?php if ($inputError): ?>
        <div class="error"><?= htmlspecialchars($inputError) ?></div>
    <?php endif; ?>

    <?php if ($resolver !== null): ?>
        <?php
            $count = $resolver->lookupCount;
            $counterCls = $count > LOOKUP_LIMIT ? 'over' : ($count >= LOOKUP_LIMIT ? 'warn' : '');
        ?>
        <div style="margin: 16px 0;">
            <span class="counter <?= $counterCls ?>">
                DNS lookups used: <?= $count ?> / <?= LOOKUP_LIMIT ?>
            </span>
        </div>

        <?php foreach ($resolver->warnings as $w): ?>
            <div class="warning">⚠️ <?= htmlspecialchars($w) ?></div>
        <?php endforeach; ?>

        <h2>Resolution tree</h2>
        <?= renderTree($tree) ?>

        <h2>Authorised IPs (<?= count($resolver->ips) ?>)</h2>
        <?php if (empty($resolver->ips)): ?>
            <div class="empty">No ip4/ip6/a/mx mechanisms produced any IP addresses.</div>
        <?php else: ?>
            <table>
                <thead>
                    <tr>
                        <th>IP / Range</th>
                        <th>Mechanism</th>
                        <th>Via</th>
                        <th>ASN</th>
                        <th>Company / ISP</th>
                        <th>Country</th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach ($resolver->ips as $entry): ?>
                        <?php
                            $info = $ipInfo[$entry['query']] ?? null;
                            $ok = $info && ($info['status'] ?? '') === 'success';
                            $asn = $ok ? ($info['as'] ?: '—') : '—';
                            $company = $ok ? ($info['org'] ?: ($info['isp'] ?? '') ?: ($info['asname'] ?? '')) : '';
                            $country = $ok ? trim(($info['country'] ?? '') . ' (' . ($info['countryCode'] ?? '') . ')', ' ()') : '';
                        ?>
                        <tr>
                            <td class="ip"><?= htmlspecialchars($entry['display']) ?></td>
                            <td><span class="badge badge-<?= htmlspecialchars($entry['mechanism']) ?>"><?= htmlspecialchars(strtoupper($entry['mechanism'])) ?></span></td>
                            <td><?= htmlspecialchars($entry['source']) ?></td>
                            <td><?= htmlspecialchars($asn) ?></td>
                            <td><?= htmlspecialchars($company ?: '—') ?></td>
                            <td><?= htmlspecialchars($country ?: '—') ?></td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
            <p style="color:#888;font-size:12px;">IP intelligence via ip-api.com (free tier).</p>
        <?php endif; ?>
    <?php endif; ?>
</body>
</html>