<?php
session_start();
session_regenerate_id(true);

// LAYER 1: Rate Limit. 3x salah = ban 1 jam
if (!isset($_SESSION['fail_count'])) $_SESSION['fail_count'] = 0;
if ($_SESSION['fail_count'] >= 3 && isset($_SESSION['ban_time']) && time() - $_SESSION['ban_time'] < 3600) {
    http_response_code(403);
    die('Akses diblokir sementara. Coba lagi nanti.');
}

// LAYER 2: Blok User-Agent bot
$ua = $_SERVER['HTTP_USER_AGENT'] ?? '';
if (preg_match('/bot|curl|python|headless|scrapy|spider|crawler|wget/i', $ua)) {
    $_SESSION['fail_count']++; $_SESSION['ban_time'] = time();
    die('Blocked');
}

// LAYER 3: Bikin token 32 karakter, expired 5 menit
if (empty($_SESSION['secToken']) || time() - $_SESSION['secToken_time'] > 300) {
    $_SESSION['secToken'] = bin2hex(random_bytes(16));
    $_SESSION['secToken_time'] = time();
    $_SESSION['page_load_time'] = time();
}

// LAYER 4: Cek hasil submit form
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!empty($_POST['email'])) {
        $_SESSION['fail_count']++; $_SESSION['ban_time'] = time(); die('Blocked');
    }
    if (time() - $_SESSION['page_load_time'] < 4) {
        $_SESSION['fail_count']++; $_SESSION['ban_time'] = time();
        die("<script>alert('Tunggu sebentar.'); window.location='/';</script>");
    }
    if (empty($_POST['mouse_moved']) || $_POST['mouse_moved'] !== 'yes') {
        $_SESSION['fail_count']++; $_SESSION['ban_time'] = time();
        die("<script>alert('Terjadi kesalahan koneksi.'); window.location='/';</script>");
    }
    if (isset($_POST['gcodeToken']) && hash_equals($_SESSION['secToken'], $_POST['gcodeToken'])) {
        $_SESSION['akses_index'] = true;
        $_SESSION['fail_count'] = 0;
        unset($_SESSION['secToken'], $_SESSION['secToken_time'], $_SESSION['page_load_time']);
        die("<script>window.location.replace('/');</script>");
    } else {
        $_SESSION['fail_count']++; $_SESSION['ban_time'] = time();
        die("<script>alert('Sesi telah berakhir, silakan coba lagi.'); window.location='/';</script>");
    }
}
?>
<!DOCTYPE html>
<html lang="id">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="robots" content="noindex, nofollow, noarchive, nosnippet">
    <title> </title>
    <style>
        @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap');
        
        * { box-sizing: border-box; margin: 0; padding: 0; }
        
        body {
            font-family: 'Inter', system-ui, -apple-system, sans-serif;
            background-color: #f8fafc; 
            color: #1e293b;
            display: flex;
            align-items: center;
            justify-content: center;
            min-height: 100vh;
            -webkit-font-smoothing: antialiased;
        }

        .container {
            background-color: #ffffff;
            border: 1px solid #e2e8f0;
            border-radius: 12px;
            padding: 40px 32px;
            width: 100%;
            max-width: 400px;
            text-align: center;
            box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.05), 0 2px 4px -1px rgba(0, 0, 0, 0.03);
        }

        /* Icon Verified Badge (Bintang Gerigi Biru) - Ukuran Pas */
        .icon-box {
            margin: 0 auto 20px;
            display: flex;
            align-items: center;
            justify-content: center;
        }
        .icon-box svg {
            width: 44px; /* Ukuran tidak terlalu besar, pas elegan */
            height: 44px;
            color: #3b82f6; /* Biru terang khas verified badge */
        }

        h2 {
            font-size: 20px;
            font-weight: 600;
            color: #0f172a;
            margin-bottom: 8px;
        }

        p {
            font-size: 14px;
            color: #64748b;
            line-height: 1.5;
            margin-bottom: 32px;
        }

        #lanjutBtn {
            background-color: #2563eb;
            color: #ffffff;
            border: none;
            border-radius: 8px;
            padding: 14px 24px;
            font-size: 14px;
            font-weight: 500;
            width: 100%;
            cursor: pointer;
            transition: background-color 0.2s ease;
            display: flex;
            align-items: center;
            justify-content: center;
            gap: 8px;
        }

        #lanjutBtn:hover:not(:disabled) {
            background-color: #1d4ed8;
        }

        #lanjutBtn:disabled {
            background-color: #94a3b8;
            cursor: wait;
        }

        .spinner {
            width: 16px; 
            height: 16px;
            border: 2px solid #ffffff;
            border-right-color: transparent;
            border-radius: 50%;
            animation: spin 0.8s linear infinite;
        }

        @keyframes spin { 
            to { transform: rotate(360deg); } 
        }

        /* Honeypot hidden field */
        .honey { 
            position: absolute; 
            opacity: 0; 
            z-index: -1; 
            pointer-events: none; 
        }
    </style>
</head>
<body>

    <div class="container">
        <div class="icon-box">
            <svg viewBox="0 0 24 24" fill="currentColor">
                <path fill-rule="evenodd" d="M8.603 3.799A4.49 4.49 0 0112 2.25c1.357 0 2.573.6 3.397 1.549a4.49 4.49 0 013.498 1.307 4.491 4.491 0 011.307 3.497A4.49 4.49 0 0121.75 12a4.49 4.49 0 01-1.549 3.397 4.491 4.491 0 01-1.307 3.497 4.491 4.491 0 01-3.497 1.307A4.49 4.49 0 0112 21.75a4.49 4.49 0 01-3.397-1.549 4.49 4.49 0 01-3.498-1.306 4.491 4.491 0 01-1.307-3.498A4.49 4.49 0 012.25 12c0-1.357.6-2.573 1.549-3.397a4.49 4.49 0 011.307-3.497 4.49 4.49 0 013.497-1.307zm7.007 6.387a.75.75 0 10-1.22-.872l-3.236 4.53L9.53 12.22a.75.75 0 00-1.06 1.06l2.25 2.25a.75.75 0 001.14-.094l3.75-5.25z" clip-rule="evenodd" />
            </svg>
        </div>
        
        <h2>Access Confirmation</h2>
        <p>The page is being prepared. Please click the button below to proceed to the site.</p>
        
        <form method="POST" action="" id="formVerif">
            <input type="text" name="email" class="honey" autocomplete="off" tabindex="-1">
            <input type="hidden" name="gcodeToken" value="<?= htmlspecialchars($_SESSION['secToken'], ENT_QUOTES) ?>">
            <input type="hidden" name="mouse_moved" id="mouse_moved" value="no">
            
            <button id="lanjutBtn" type="submit">Continue</button>
        </form>
    </div>

    <script>
        // 1. Deteksi interaksi user (Syarat lolos bot)
        let interaksi = false;
        function setInteraksi() {
            if (!interaksi) {
                interaksi = true;
                document.getElementById('mouse_moved').value = 'yes';
            }
        }
        ['mousemove', 'touchstart', 'keydown', 'click'].forEach(evt => {
            document.addEventListener(evt, setInteraksi, { once: true });
        });

        // 2. Handle Submit & Jeda Waktu PHP
        const loadTime = Date.now();
        const form = document.getElementById('formVerif');
        const btn = document.getElementById('lanjutBtn');

        form.addEventListener('submit', function(e) {
            e.preventDefault(); 
            
            const timeElapsed = Date.now() - loadTime;
            const requiredDelay = 4500; // Minimal 4.5 detik
            const timeRemaining = requiredDelay - timeElapsed;

            // Ubah tombol jadi loading state
            btn.disabled = true;
            btn.innerHTML = '<div class="spinner"></div><span>Processing...</span>';

            if (timeRemaining > 0) {
                // Tunggu sisa waktu secara transparan
                setTimeout(() => {
                    form.submit();
                }, timeRemaining);
            } else {
                form.submit();
            }
        });
    </script>
</body>
</html>
