<?php
/**
 * Plugin Name: WP2Shell Batch Guard (Must-Use)
 * Description: Blocks anonymous REST batch API (wp2shell mitigation).
 * Version: 1.1.0
 */

if (!defined('ABSPATH')) {
    exit;
}

function wp2shell_fixer_is_batch_route($route) {
    $route = strtolower((string) $route);
    $route = function_exists('untrailingslashit') ? untrailingslashit($route) : rtrim($route, '/');
    if ($route === '/batch/v1' || $route === 'batch/v1') {
        return true;
    }
    return (bool) preg_match('#(^|/)batch/v1$#', $route);
}

function wp2shell_fixer_require_auth_for_rest_batch($result, $server, $request) {
    if (!is_object($request) || !method_exists($request, 'get_route')) {
        return $result;
    }
    if (!wp2shell_fixer_is_batch_route($request->get_route())) {
        return $result;
    }
    if (function_exists('is_user_logged_in') && is_user_logged_in()) {
        return $result;
    }
    return new WP_Error(
        'rest_batch_authentication_required',
        'Authentication is required to use the batch API.',
        array('status' => 401)
    );
}

add_filter('rest_pre_dispatch', 'wp2shell_fixer_require_auth_for_rest_batch', -1000, 3);

add_filter('rest_authentication_errors', function ($result) {
    if (true === $result || is_wp_error($result)) {
        return $result;
    }
    $uri = isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '';
    $rest = isset($_REQUEST['rest_route']) ? (string) $_REQUEST['rest_route'] : '';
    $hit = (stripos($uri, 'batch/v1') !== false)
        || (stripos($rest, 'batch/v1') !== false)
        || (stripos($uri, 'rest_route=/batch') !== false);
    if (!$hit) {
        return $result;
    }
    if (function_exists('is_user_logged_in') && is_user_logged_in()) {
        return $result;
    }
    return new WP_Error(
        'rest_batch_authentication_required',
        'Authentication is required to use the batch API.',
        array('status' => 401)
    );
}, 99);