<?php
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Arcai_Rate_Limiter {

	/**
	 * Per-IP hourly limit on chat turns. Visitors stay anonymous; this is the
	 * abuse guard for the public endpoint.
	 */
	public function allow( $ip ) {
		$limit = (int) Arcai_Settings::get( 'rate_limit' );
		$key   = 'arcai_rl_' . md5( (string) $ip );
		$count = (int) get_transient( $key );

		if ( $count >= $limit ) {
			return false;
		}

		set_transient( $key, $count + 1, HOUR_IN_SECONDS );
		return true;
	}

	public static function client_ip() {
		return isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '0.0.0.0';
	}
}
