Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
100.00%
122 / 122
100.00%
5 / 5
 CRAP
100.00%
1 / 1
DemoMockSecurityProvider
100.00%
121 / 121
100.00%
5 / 5
 18
100.00%
1 / 1
 getDriver
100.00%
1 / 1
100.00%
1 / 1
 1
 checkIp
100.00%
40 / 40
100.00%
1 / 1
 5
 checkDomain
100.00%
37 / 37
100.00%
1 / 1
 4
 checkUrl
100.00%
38 / 38
100.00%
1 / 1
 6
 isKnownThreatIp
100.00%
5 / 5
100.00%
1 / 1
 2
1<?php
2
3declare(strict_types=1);
4
5/** @license For full copyright and license information, please see the LICENSE.md file. */
6
7namespace App\Modules\Integrations\Infrastructure\Provider;
8
9defined('AMMONLY_APP') || exit('Direct script access is forbidden.');
10
11use App\Modules\Integrations\Domain\Contract\IntegrationProviderInterface;
12use App\Modules\Integrations\Domain\Contract\SecurityCheckResult;
13
14/**
15 * High-fidelity Mock/Sandbox Provider for Demo mode and safe testing without external API key leaks.
16 */
17final class DemoMockSecurityProvider implements IntegrationProviderInterface
18{
19    private const array KNOWN_THREAT_OCTETS = [
20        [185, 220, 101, 5],
21        [198, 51, 100, 1],
22        [203, 0, 113, 199],
23    ];
24
25    private const array KNOWN_THREAT_DOMAINS = [
26        'phishing-test.com',
27        'malware-domain.org',
28        'spam-sender.net',
29        'fake-bank-login.xyz',
30    ];
31
32    public function getDriver(): string
33    {
34        return 'demo_mock';
35    }
36
37    public function checkIp(string $ip, ?string $apiKey, array $config = []): SecurityCheckResult
38    {
39        $isThreat = $this->isKnownThreatIp($ip)
40            || str_contains($ip, 'malicious')
41            || (str_ends_with($ip, '.66') && !str_starts_with($ip, '127.'));
42
43        if ($isThreat) {
44            return new SecurityCheckResult(
45                type: 'ip',
46                target: $ip,
47                isSafe: false,
48                status: 'dangerous',
49                summary: "AbuseIPDB (Demo): Malicious sender server detected (Abuse score: 92%)",
50                provider: 'AbuseIPDB [Demo Mock]',
51                details: [
52                    'abuse_confidence_score' => 92,
53                    'total_reports'          => 147,
54                    'country_code'           => 'RU',
55                    'usage_type'             => 'Data Center / Web Hosting / Transit',
56                    'is_tor_exit_node'       => true,
57                    'sandbox_mode'           => true,
58                ],
59                cachedTtl: 86400,
60                threatScore: 92
61            );
62        }
63
64        return new SecurityCheckResult(
65            type: 'ip',
66            target: $ip,
67            isSafe: true,
68            status: 'safe',
69            summary: "AbuseIPDB (Demo): Sender server is verified and clean (Abuse score: 0%)",
70            provider: 'AbuseIPDB [Demo Mock]',
71            details: [
72                'abuse_confidence_score' => 0,
73                'total_reports'          => 0,
74                'country_code'           => 'PL',
75                'usage_type'             => 'Commercial / Clean Hosting',
76                'is_tor_exit_node'       => false,
77                'sandbox_mode'           => true,
78            ],
79            cachedTtl: 86400,
80            threatScore: 0
81        );
82    }
83
84    public function checkDomain(string $domain, ?string $apiKey, array $config = []): SecurityCheckResult
85    {
86        $normDomain = strtolower(trim($domain));
87        $isThreat = in_array($normDomain, self::KNOWN_THREAT_DOMAINS, true)
88            || str_contains($normDomain, 'phish')
89            || str_contains($normDomain, 'malware');
90
91        if ($isThreat) {
92            return new SecurityCheckResult(
93                type: 'domain',
94                target: $normDomain,
95                isSafe: false,
96                status: 'dangerous',
97                summary: "SecurityTrails (Demo): Domain is blacklisted for phishing (Age: 2 days)",
98                provider: 'SecurityTrails [Demo Mock]',
99                details: [
100                    'domain_age_days' => 2,
101                    'blacklist_hits'  => 5,
102                    'reputation'      => 'malicious',
103                    'sandbox_mode'    => true,
104                ],
105                cachedTtl: 43200,
106                threatScore: 100
107            );
108        }
109
110        return new SecurityCheckResult(
111            type: 'domain',
112            target: $normDomain,
113            isSafe: true,
114            status: 'safe',
115            summary: "SecurityTrails (Demo): Sender domain has a positive reputation",
116            provider: 'SecurityTrails [Demo Mock]',
117            details: [
118                'domain_age_days' => 1825,
119                'blacklist_hits'  => 0,
120                'reputation'      => 'clean',
121                'sandbox_mode'    => true,
122            ],
123            cachedTtl: 43200,
124            threatScore: 0
125        );
126    }
127
128    public function checkUrl(string $url, ?string $apiKey, array $config = []): SecurityCheckResult
129    {
130        $lowerUrl = strtolower($url);
131        $isThreat = str_contains($lowerUrl, 'phishing')
132            || str_contains($lowerUrl, 'malware')
133            || str_contains($lowerUrl, 'testsafebrowsing')
134            || str_contains($lowerUrl, 'login-verify')
135            || str_contains($lowerUrl, 'suspicious-download');
136
137        if ($isThreat) {
138            return new SecurityCheckResult(
139                type: 'url',
140                target: $url,
141                isSafe: false,
142                status: 'dangerous',
143                summary: "Google Safe Browsing & URLhaus (Demo): Malicious link detected (Phishing / Malware)",
144                provider: 'Google Safe Browsing [Demo Mock]',
145                details: [
146                    'threat_type'     => 'SOCIAL_ENGINEERING',
147                    'platform_type'   => 'ANY_PLATFORM',
148                    'urlhaus_status'  => 'malware_url',
149                    'sandbox_mode'    => true,
150                ],
151                cachedTtl: 86400,
152                threatScore: 100
153            );
154        }
155
156        return new SecurityCheckResult(
157            type: 'url',
158            target: $url,
159            isSafe: true,
160            status: 'safe',
161            summary: "Google Safe Browsing & URLhaus (Demo): Link is verified and safe",
162            provider: 'Google Safe Browsing [Demo Mock]',
163            details: [
164                'threat_type'     => 'NONE',
165                'threats_found'   => 0,
166                'sandbox_mode'    => true,
167            ],
168            cachedTtl: 86400,
169            threatScore: 0
170        );
171    }
172
173    /**
174     * Checks if IP matches known threat octet signatures.
175     *
176     * @param string $ip IPv4 address to evaluate.
177     * @return bool True if address matches simulated threat list.
178     */
179    private function isKnownThreatIp(string $ip): bool
180    {
181        $parts = explode('.', $ip);
182        if (count($parts) !== 4) {
183            return false;
184        }
185
186        $octets = array_map('intval', $parts);
187
188        return in_array($octets, self::KNOWN_THREAT_OCTETS, true);
189    }
190}