Merge pull request #1 from patchstack/feature/drupal-extension

Feature: Added Drupal extension.

Author: patchstackdave

src/Extensions/Drupal/Extension.php

@@ -0,0 +1,227 @@
+<?php
+
+namespace Patchstack\Extensions\Drupal;
+
+use Patchstack\Extensions\ExtensionInterface;
+
+/**
+ * Drupal-specific implementation of the Patchstack firewall extension.
+ *
+ * This extension provides Drupal integration for the Patchstack firewall engine.
+ * It handles logging, IP detection, and block page rendering within Drupal's context.
+ */
+class Extension implements ExtensionInterface {
+
+  /**
+   * Log the request to the patchstack_logs table.
+   *
+   * @param int $ruleId
+   *   The firewall rule ID that matched.
+   * @param string $bodyData
+   *   The request body data.
+   * @param string $blockType
+   *   The type of block performed (BLOCK, LOG, or REDIRECT).
+   */
+  public function logRequest($ruleId, $bodyData, $blockType): void {
+    try {
+      $request = \Drupal::request();
+
+      // Get POST data.
+      $postData = $request->request->all();
+      if (empty($postData)) {
+        $rawContent = $request->getContent();
+        $postData = !empty($rawContent) ? $rawContent : NULL;
+      }
+      else {
+        $postData = json_encode($postData);
+      }
+
+      // Insert into the logs table.
+      $connection = \Drupal::database();
+      $connection->insert('patchstack_logs')
+        ->fields([
+          'ip' => $this->getIpAddress(),
+          'request_uri' => $request->getRequestUri() ?? '',
+          'user_agent' => $request->headers->get('User-Agent') ?? '',
+          'method' => $request->getMethod() ?? '',
+          'fid' => (int) $ruleId,
+          'post_data' => $postData,
+          'block_type' => $blockType,
+          'log_date' => \Drupal::time()->getRequestTime(),
+        ])
+        ->execute();
+    }
+    catch (\Throwable $e) {
+      // Silently fail to avoid breaking the site.
+      \Drupal::logger('patchstack')->error('Failed to log blocked request: @message', [
+        '@message' => $e->getMessage(),
+      ]);
+    }
+  }
+
+  /**
+   * Determine if the current visitor can bypass the firewall.
+   *
+   * @param bool $isMuCall
+   *   Whether this is an early call before user session is available.
+   *
+   * @return bool
+   *   TRUE if the visitor can bypass, FALSE otherwise.
+   */
+  public function canBypass($isMuCall): bool {
+    // If called too early, we can't check user permissions.
+    if ($isMuCall) {
+      return FALSE;
+    }
+
+    try {
+      $currentUser = \Drupal::currentUser();
+
+      // Allow administrators to bypass.
+      if ($currentUser->hasPermission('administer site configuration')) {
+        return TRUE;
+      }
+    }
+    catch (\Throwable $e) {
+      // If we can't determine user, don't bypass.
+    }
+
+    return FALSE;
+  }
+
+  /**
+   * Determine if the visitor is blocked due to too many blocked requests.
+   *
+   * @param int $minutes
+   *   The time window in minutes.
+   * @param int $blockTime
+   *   Additional block time in minutes.
+   * @param int $attempts
+   *   Maximum allowed attempts before blocking.
+   *
+   * @return bool
+   *   TRUE if the visitor should be blocked, FALSE otherwise.
+   */
+  public function isBlocked($minutes, $blockTime, $attempts): bool {
+    // Currently disabled - return false to not auto-block based on attempts.
+    // This can be enabled later with proper configuration.
+    if (empty($minutes) || empty($blockTime) || empty($attempts)) {
+      return FALSE;
+    }
+
+    try {
+      // Calculate the time window.
+      $time = ($minutes + $blockTime) * 60;
+      $cutoffTime = \Drupal::time()->getRequestTime() - $time;
+
+      // Count blocked requests from this IP in the time window.
+      $connection = \Drupal::database();
+      $count = $connection->select('patchstack_logs', 'pl')
+        ->condition('block_type', 'BLOCK')
+        ->condition('ip', $this->getIpAddress())
+        ->condition('log_date', $cutoffTime, '>=')
+        ->countQuery()
+        ->execute()
+        ->fetchField();
+
+      return (int) $count >= $attempts;
+    }
+    catch (\Throwable $e) {
+      return FALSE;
+    }
+  }
+
+  /**
+   * Force exit the page when a request has been blocked.
+   *
+   * @param int $ruleId
+   *   The firewall rule ID that matched.
+   */
+  public function forceExit($ruleId): void {
+    // Set cache control headers.
+    header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
+    header('Cache-Control: post-check=0, pre-check=0', FALSE);
+    header('Pragma: no-cache');
+    http_response_code(403);
+
+    // Include the blocked page template.
+    $blockedPage = __DIR__ . '/Views/Blocked.php';
+    if (file_exists($blockedPage)) {
+      include $blockedPage;
+    }
+    else {
+      // Fallback simple message.
+      echo '<!DOCTYPE html><html><head><title>Access Denied</title></head>';
+      echo '<body><h1>Access Denied</h1>';
+      echo '<p>This request has been blocked by the firewall. Error code: ' . (int) $ruleId . '</p>';
+      echo '</body></html>';
+    }
+
+    exit;
+  }
+
+  /**
+   * Get the IP address of the request.
+   *
+   * @return string
+   *   The client IP address.
+   */
+  public function getIpAddress(): string {
+    try {
+      return \Drupal::request()->getClientIp() ?? '0.0.0.0';
+    }
+    catch (\Throwable $e) {
+      // Fallback if Drupal request isn't available.
+      return $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+    }
+  }
+
+  /**
+   * Get the hostname of the environment.
+   *
+   * @return string
+   *   The HTTP host.
+   */
+  public function getHostName(): string {
+    try {
+      return \Drupal::request()->getHost();
+    }
+    catch (\Throwable $e) {
+      return $_SERVER['HTTP_HOST'] ?? '';
+    }
+  }
+
+  /**
+   * Determine if the request should bypass the firewall based on whitelist.
+   *
+   * @param array $whitelistRules
+   *   The whitelist rules.
+   * @param array $request
+   *   The request data.
+   *
+   * @return bool
+   *   TRUE if the request is whitelisted, FALSE otherwise.
+   */
+  public function isWhitelisted($whitelistRules, $request): bool {
+    // Whitelist processing is handled by the firewall engine itself.
+    // This method can be used for additional Drupal-specific whitelisting.
+    return FALSE;
+  }
+
+  /**
+   * Determine if the current request is a file upload request.
+   *
+   * @return bool
+   *   TRUE if files are being uploaded, FALSE otherwise.
+   */
+  public function isFileUploadRequest(): bool {
+    try {
+      $files = \Drupal::request()->files->all();
+      return !empty($files);
+    }
+    catch (\Throwable $e) {
+      return isset($_FILES) && count($_FILES) > 0;
+    }
+  }
+
+}