<?php
/**
 * Test harness for inc/bot-shield.php — run from the CLI, no WordPress needed:
 *
 *     php bin/test-bot-shield.php
 *
 * BOTS are the 28 accounts from the Aug-2026 BlackHawk Trading wave.
 * HUMANS is a deliberately awkward control set (Welsh, Polish, Czech, Irish,
 * Dutch, Scandinavian, German, Greek, Turkish, Igbo, Chinese, Vietnamese and
 * Indic names) — every one of these MUST pass. A false positive here is a real
 * bidder who cannot register.
 */

define('AUCTIONFORGE_BOTSHIELD_TEST', true);
require_once __DIR__ . '/../inc/bot-shield.php';

$BOTS = array(
    array('Awbd', 'Fplafk', 'rashmi@rashmiswaves.com'),
    array('Eczh', 'Tunnbkdo', 'questions@valvesoftware.com'),
    array('Vybxa', 'Ndrcxsrtu', 'admin@propertymanagementofpolk.com'),
    array('Zuhavmr', 'Vvdeleh', 'kldonnell@yahoo.com'),
    array('Ffojmd', 'Axpch', 'emil.zagorov@vertodigital.com'),
    array('Zrerg', 'Qxbzpe', 'shavranek@lottship.com'),
    array('Jtirt', 'Tmstabypp', 'shauna.unger@live.com'),
    array('Wcsytqh', 'Gulqh', 'o.nelo.v.ee@gmail.com'),
    array('Ehju', 'Vjonvshq', 'n.s.pi.ller7.2@gmail.com'),
    array('Pcciqx', 'Xlsopx', 'i.am@danielchoi.net'),
    array('Xsisdpk', 'Iimvjocyt', 'r.i.n.v.il.lil.a@gmail.com'),
    array('Erwmgr', 'Pxxonhpxh', 'r.in.v.ill.ila@gmail.com'),
    array('Kqjm', 'Ayjdvyspl', 'n.k.a.i.n.fai.th.8.4@gmail.com'),
    array('Ewivbqmn', 'Wvhpwcr', 'rha_hyungmin@lilly.com'),
    array('Nuqmrht', 'Ncasvsqc', 'hannahtheobald@yahoo.com'),
    array('Voyxnip', 'Jlfdtovc', 'aghaali.mammadzada@pipedrive.com'),
    array('Vebuj', 'Urzzring', 'mpatterson@hg.agency'),
    array('Sitxtc', 'Emvkelg', 'tcarvalho72@yahoo.com'),
    array('Ygdi', 'Hgbup', 'slippie77@aol.com'),
    array('Bind', 'Vgbudo', 'b.ho.w.e8.9@gmail.com'),
    array('Sxrndei', 'Supnbuf', 'sgrimes@kamispro.com'),
    array('Cslh', 'Flpohlrj', 'm.gelling@thecharlesgrp.com'),
    array('Bljqcus', 'Fqwsk', 'chris@thecharlesnyc.com'),
    array('Rfzbkom', 'Xjfijw', 'ridered_2005@hotmail.com'),
    array('Edoe', 'Itihe', 'ia.cos.t.a1.975@gmail.com'),
    array('Zimnmlku', 'Xnqfrtus', 'jessie@redlineasm.com'),
    array('Dbpwvoq', 'Vvefgqa', 'brent.burns@msn.com'),
    array('Flgx', 'Ewvbruyvs', 'bu.xu.p.e.x7.68@gmail.com'),
);

$HUMANS = array(
    // English / Irish / Scottish
    array('John', 'Smith', 'john.smith@gmail.com'),
    array('Mary', 'Johnson', 'mary.johnson@yahoo.com'),
    array('Sarah', 'Williams', 'sarah.williams@outlook.com'),
    array('Michael', "O'Connor", 'michael.oconnor@gmail.com'),
    array('Anne-Marie', 'Clarke', 'am.clarke@btinternet.com'),
    array('Siobhan', 'Bhraonain', 'siobhan.b@eircom.net'),
    array('Caoimhe', 'Ni Mhurchu', 'caoimhe@gmail.com'),
    array('Hamish', 'McTaggart', 'hamish@sky.com'),
    array('Fiona', 'Strachan', 'f.strachan@gmail.com'),
    array('Beth', 'Blyth', 'beth.blyth@aol.com'),
    array('Kirk', 'Lynch', 'klynch@hotmail.com'),
    array('Glenn', 'Flynn', 'gflynn@gmail.com'),
    // Welsh
    array('Rhys', 'Llewellyn', 'rhys.ll@gmail.com'),
    array('Gwyneth', 'Pryce', 'gwyneth.pryce@gmail.com'),
    array('Dafydd', 'Llwyd', 'dafydd@wales.co.uk'),
    array('Ffion', 'Gwynn', 'ffion.gwynn@gmail.com'),
    array('Bryn', 'Prydderch', 'bryn.p@gmail.com'),
    // Polish / Czech / Slovak / Russian / Ukrainian
    array('Krzysztof', 'Szczepanski', 'krzysztof.s@wp.pl'),
    array('Wojciech', 'Brzezinski', 'wojciech@interia.pl'),
    array('Zbigniew', 'Wrzesniewski', 'zbigniew.w@onet.pl'),
    array('Grzegorz', 'Strzelczyk', 'g.strzelczyk@gmail.com'),
    array('Zdenek', 'Svoboda', 'zdenek@seznam.cz'),
    array('Vaclav', 'Dvorak', 'vaclav.dvorak@seznam.cz'),
    array('Dmitri', 'Smirnov', 'd.smirnov@mail.ru'),
    array('Vladimir', 'Tkachenko', 'v.tkachenko@ukr.net'),
    array('Stanislav', 'Khrushchev', 'stanislav.k@gmail.com'),
    array('Bohdan', 'Vsevolodovych', 'bohdan.v@gmail.com'),
    // German / Dutch / Scandinavian
    array('Wolfgang', 'Schmidt', 'w.schmidt@web.de'),
    array('Jurgen', 'Schwarzkopf', 'juergen@gmx.de'),
    array('Christoph', 'Pfaff', 'christoph.pfaff@t-online.de'),
    array('Sjoerd', 'Vermeer', 'sjoerd@ziggo.nl'),
    array('Jan', 'van der Vlist', 'jan.vlist@kpn.nl'),
    array('Bjorn', 'Sjostrom', 'bjorn.sjostrom@telia.se'),
    array('Kjell', 'Nyqvist', 'kjell.n@telenor.no'),
    array('Thorvald', 'Gundersen', 'thorvald@online.no'),
    // Southern / Eastern European
    array('Konstantinos', 'Papadopoulos', 'k.papadopoulos@otenet.gr'),
    array('Gyorgy', 'Szabo', 'gyorgy.szabo@freemail.hu'),
    array('Zsolt', 'Nagy', 'zsolt.nagy@t-online.hu'),
    array('Mehmet', 'Yildirim', 'mehmet.y@gmail.com'),
    array('Giuseppe', 'Sgarbi', 'g.sgarbi@libero.it'),
    // Indic / Middle Eastern
    array('Rajesh', 'Bhattacharya', 'rajesh.b@gmail.com'),
    array('Shreya', 'Ghoshal', 'shreya.ghoshal@gmail.com'),
    array('Anil', 'Jhunjhunwala', 'anil.j@rediffmail.com'),
    array('Lakshmi', 'Krishnamurthy', 'lakshmi.k@gmail.com'),
    array('Muhammad', 'Al-Rashid', 'm.alrashid@gmail.com'),
    array('Khalid', 'Bin Salman', 'khalid.bs@gmail.com'),
    // East / South-East Asian
    array('Wai', 'Ng', 'wai.ng@gmail.com'),
    array('Wei', 'Zhang', 'wei.zhang@163.com'),
    array('Xiaoming', 'Zhu', 'xiaoming.zhu@qq.com'),
    array('Qing', 'Ye', 'qing.ye@gmail.com'),
    array('Thanh', 'Nguyen', 'thanh.nguyen@gmail.com'),
    array('Phuong', 'Tran', 'phuong.tran@gmail.com'),
    array('Jae-Sung', 'Pak', 'jaesung.pak@naver.com'),
    // African
    array('Chukwuemeka', 'Nwosu', 'chukwuemeka@gmail.com'),
    array('Ngozi', 'Okonkwo', 'ngozi.okonkwo@gmail.com'),
    array('Kwabena', 'Mensah', 'kwabena@gmail.com'),
    // Short and awkward but real
    array('Al', 'Fry', 'al.fry@gmail.com'),
    array('Bo', 'Yu', 'bo.yu@gmail.com'),
    array('Jo', 'Pym', 'jo.pym@gmail.com'),
    array('Ted', 'Krupp', 'ted.krupp@gmail.com'),
    array('Ivy', 'Szczesny', 'ivy@gmail.com'),
    array('Magda', 'Hodgson', 'magda.hodgson@gmail.com'),
    array('Abdul', 'Mcbride', 'abdul.mcbride@gmail.com'),
    array('Ruaraidh', 'Macgregor', 'ruaraidh@gmail.com'),
    array('Vojtech', 'Bajramovic', 'vojtech.b@seznam.cz'),
    array('Hjalmar', 'Ashkenazy', 'hjalmar.a@gmail.com'),
);

function af_run($set, $label, $expectBlocked) {
    $wrong = array();
    foreach ($set as $row) {
        list($first, $last, $email) = $row;
        $res = auctionforge_botshield_assess(array(
            'first_name'   => $first,
            'last_name'    => $last,
            'email'        => $email,
            'user_agent'   => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36',
            'form_fill_ms' => 15000,
        ));
        $ok = ($res['blocked'] === $expectBlocked);
        if (!$ok) {
            $wrong[] = sprintf("    %-14s %-16s %-34s score=%d  %s",
                $first, $last, $email, $res['score'], $res['details']);
        }
    }
    $total = count($set);
    $pass  = $total - count($wrong);
    printf("%s: %d/%d (%.0f%%)\n", $label, $pass, $total, $total ? $pass / $total * 100 : 0);
    if ($wrong) {
        echo ($expectBlocked ? "  MISSED (bot allowed through):\n" : "  FALSE POSITIVE (real person blocked):\n");
        echo implode("\n", $wrong) . "\n";
    }
    return count($wrong);
}

echo "AuctionForge Bot Shield — threshold " . AUCTIONFORGE_BOTSHIELD_THRESHOLD . "\n";
echo str_repeat('=', 72) . "\n";
$missed = af_run($BOTS, 'Bot detection  ', true);
echo "\n";
$falsePos = af_run($HUMANS, 'Real-name pass ', false);
echo str_repeat('=', 72) . "\n";
echo $falsePos === 0 ? "No false positives.\n" : "FAIL: $falsePos real names blocked.\n";
exit($falsePos > 0 ? 1 : 0);
