Waiting room reference.

<?php
/**
 * FourWay bot gate for PHP. While your site is busy, automated traffic (AI
 * crawlers, SEO tools, scripts) gets "503 Service Unavailable" with Retry-After,
 * so the capacity goes to people. Search engines are allowed unless you choose
 * otherwise in FourWay. People in browsers are never touched by this gate.
 *
 *   require __DIR__ . '/fourway_gate.php';
 *   fourway_bot_gate('site_yourshop');            // first line of your front controller
 *
 * Cost: at most one small HTTP request to FourWay every 5 seconds per server
 * (the status is cached in a temp file); every other request is a string match.
 * Fails open: if FourWay cannot be reached, nothing is blocked.
 */
function fourway_bot_gate(string $siteId, array $opt = []): void {
    $api = rtrim($opt['api'] ?? 'https://fourway.io/api', '/');
    $ttl = (int)($opt['cache_seconds'] ?? 5);
    $st  = fourway_gate_status($api, $siteId, $ttl);
    if (!$st || empty($st['busy'])) return;                       // quiet, or FourWay unreachable: allow

    $ua = (string)($_SERVER['HTTP_USER_AGENT'] ?? '');
    $bots = $st['bots'] ?? [];
    $pause = false;
    if (trim($ua) === '') {
        $pause = ($bots['empty_ua'] ?? 'allow') === 'pause';
    } else {
        foreach ((array)($bots['pause'] ?? []) as $tok) {
            if (is_string($tok) && $tok !== '' && stripos($ua, $tok) !== false) { $pause = true; break; }
        }
    }
    if (!$pause) return;

    $retry = max(60, min(600, (int)($st['retry_after'] ?? 120)));
    http_response_code(503);
    header('Retry-After: ' . $retry);
    header('Cache-Control: no-store');
    header('Content-Type: text/plain; charset=utf-8');
    header('X-FourWay-Gate: bot-paused');
    echo "This site is busy right now. Automated traffic is paused; please retry after {$retry} seconds.\n";
    exit;
}

/** Status from FourWay, cached in a temp file for a few seconds. Returns null on any failure. */
function fourway_gate_status(string $api, string $siteId, int $ttl): ?array {
    if (!preg_match('/^[a-z0-9_]{3,40}$/', $siteId)) return null;
    $file = rtrim(sys_get_temp_dir(), '/\\') . '/fourway_status_' . $siteId . '.json';
    $fresh = is_file($file) && (time() - (int)@filemtime($file)) < $ttl;
    if ($fresh) {
        $j = json_decode((string)@file_get_contents($file), true);
        return is_array($j) && !empty($j['ok']) ? ($j['data'] ?? null) : null;
    }
    $ctx = stream_context_create(['http' => ['timeout' => 1.5, 'ignore_errors' => true, 'header' => "Accept: application/json\r\n"]]);
    $raw = @file_get_contents($api . '/wr/status?site=' . rawurlencode($siteId) . '&b=' . intdiv(time(), 5), false, $ctx);
    $j = is_string($raw) ? json_decode($raw, true) : null;
    // Cache failures too (as {"ok":false}), so a FourWay outage costs one try per few seconds, not one per request.
    @file_put_contents($file . '.tmp', is_array($j) ? $raw : '{"ok":false}');
    @rename($file . '.tmp', $file);
    return is_array($j) && !empty($j['ok']) ? ($j['data'] ?? null) : null;
}

/**
 * FourWay bot gate for Cloudflare Workers (or any fetch-style edge runtime).
 * While your site is busy, automated traffic gets 503 + Retry-After; people and
 * (by default) search engines pass straight through to your origin.
 * The status is cached at the edge for 5 seconds. Fails open.
 */
const SITE = 'site_yourshop';
const STATUS = `https://fourway.io/api/wr/status?site=${SITE}`;

async function fourwayStatus() {
  try {
    const r = await fetch(STATUS + '&b=' + Math.floor(Date.now() / 5000), { cf: { cacheTtl: 5, cacheEverything: true } });
    const j = await r.json();
    return j && j.ok ? j.data : null;
  } catch (e) {
    return null;
  }
}

function paused(ua, bots) {
  if (!bots) return false;
  if (!ua || !ua.trim()) return bots.empty_ua === 'pause';
  const u = ua.toLowerCase();
  return (bots.pause || []).some((t) => typeof t === 'string' && t && u.includes(t.toLowerCase()));
}

export default {
  async fetch(request, env, ctx) {
    const st = await fourwayStatus();
    if (st && st.busy && paused(request.headers.get('user-agent'), st.bots)) {
      const retry = Math.max(60, Math.min(600, st.retry_after || 120));
      return new Response(`This site is busy right now. Automated traffic is paused; please retry after ${retry} seconds.\n`, {
        status: 503,
        headers: { 'Retry-After': String(retry), 'Cache-Control': 'no-store', 'Content-Type': 'text/plain; charset=utf-8', 'X-FourWay-Gate': 'bot-paused' },
      });
    }
    return fetch(request);   // everyone else goes to your origin as usual
  },
};

const crypto = require('crypto');

function fourwayPassOk(pass, siteId, secretHex) {
  if (!pass || pass.split('.').length !== 2) return false;
  const [p, sig] = pass.split('.');
  const want = crypto.createHmac('sha256', Buffer.from(secretHex, 'hex'))
    .update('fwp|' + p).digest('base64url');
  if (want.length !== sig.length || !crypto.timingSafeEqual(Buffer.from(want), Buffer.from(sig))) return false;
  const d = JSON.parse(Buffer.from(p, 'base64url').toString());
  return d.s === siteId && d.x >= Math.floor(Date.now() / 1000);
}