ReviewEngine.php

<?php

if (!defined('__TYPECHO_ROOT_DIR__')) {
	exit;
}

class TSpamReview_ReviewEngine
{
	private static $tokenCacheFile = __DIR__ . DIRECTORY_SEPARATOR . '.baidu_token.json';
	private static $logDir = __DIR__ . DIRECTORY_SEPARATOR . 'logs';
	private static $lastHttpError = '';
	private static $caBundleFile = __DIR__ . DIRECTORY_SEPARATOR . 'cacert.pem';
	private static $defaultModuleWhitelist = [
		'memos',
		'memo',
		'shuoshuo',
		'shuo',
		'moment',
		'moments',
		'dynamic',
		'dynamics',
		'tweet',
		'status',
		'talk',
	];

	public static function ensureRuntimeFiles()
	{
		if (!is_writable(__DIR__)) {
			throw new Typecho_Plugin_Exception(_t('插件目录不可写，请检查权限：%s', __DIR__));
		}

		if (!file_exists(self::$tokenCacheFile)) {
			$payload = json_encode([
				'token' => '',
				'expire' => 0,
				'last_refresh_time' => 0,
				'last_refresh_status' => 'idle',
				'last_error' => '',
			], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
			if (@file_put_contents(self::$tokenCacheFile, $payload) === false) {
				throw new Typecho_Plugin_Exception(_t('无法创建 Token 缓存文件，请检查权限'));
			}
		}

		if (!is_dir(self::$logDir) && !@mkdir(self::$logDir, 0755, true) && !is_dir(self::$logDir)) {
			throw new Typecho_Plugin_Exception(_t('无法创建日志目录，请检查权限'));
		}

		$gitignorePath = self::$logDir . DIRECTORY_SEPARATOR . '.gitignore';
		if (!file_exists($gitignorePath)) {
			@file_put_contents($gitignorePath, "*.log\n*.txt\n");
		}
	}

	public static function optionEnabled($opts, $key)
	{
		if (!isset($opts->$key)) {
			return false;
		}

		$value = $opts->$key;
		if (is_array($value)) {
			return in_array('enable', $value, true);
		}

		if (is_string($value)) {
			return $value === 'enable' || $value === '1';
		}

		return !empty($value);
	}

	public static function parseLines($raw, $caseInsensitive = false)
	{
		$items = preg_split('/\r?\n/', (string) $raw);
		$clean = [];
		foreach ($items as $item) {
			$value = trim((string) $item);
			if ($value === '') {
				continue;
			}
			$key = $caseInsensitive ? self::toLower($value) : $value;
			$clean[$key] = $value;
		}

		return array_values($clean);
	}

	public static function evaluate(array $comment, $opts, array $context = [])
	{
		$comment = array_merge([
			'text' => '',
			'author' => '',
			'mail' => '',
			'ip' => '',
		], $comment);

		if (self::isWhitelistedModule($opts, $context)) {
			return self::result('allow', ['module_whitelist']);
		}

		if (self::optionEnabled($opts, 'skipAdminReview') && self::isAdmin()) {
			return self::result('allow');
		}

		$text = trim((string) $comment['text']);
		$author = trim((string) $comment['author']);
		$mail = trim((string) $comment['mail']);
		$ip = trim((string) $comment['ip']);

		$ipBlacklist = self::parseLines(isset($opts->ipBlacklist) ? $opts->ipBlacklist : '');
		if ($ip !== '' && in_array($ip, $ipBlacklist, true)) {
			return self::result('deny', ['ip_blacklist']);
		}

		$emailBlacklist = self::parseLines(isset($opts->emailBlacklist) ? $opts->emailBlacklist : '', true);
		if ($mail !== '' && in_array(self::toLower($mail), array_map([__CLASS__, 'toLower'], $emailBlacklist), true)) {
			return self::result('deny', ['email_blacklist']);
		}

		$sensitiveList = self::parseLines(isset($opts->sensitiveWords) ? $opts->sensitiveWords : '');
		if (!empty($sensitiveList) && self::hasSensitiveWord([$text, $author, $mail], $sensitiveList)) {
			return self::result('deny', ['sensitive']);
		}

		if (self::optionEnabled($opts, 'strictEmailCheck') && self::isInvalidEmail($mail)) {
			return self::result('deny', ['invalid_email']);
		}

		if (self::optionEnabled($opts, 'blockSpam')) {
			$spamType = self::detectSpamType($text, $author);
			if ($spamType !== null) {
				return self::result('deny', ['spam_' . $spamType]);
			}
		}

		$authorMaxLength = isset($opts->authorMaxLength) ? (int) $opts->authorMaxLength : 30;
		if ($authorMaxLength > 0 && mb_strlen($author, 'UTF-8') > $authorMaxLength) {
			return self::result('deny', ['author_too_long']);
		}

		if (self::optionEnabled($opts, 'blockGarbledAuthor') && self::hasGarbledContent($author, $mail, $text)) {
			return self::result('deny', ['garbled_content']);
		}

		$holdReasons = [];

		$contentAction = isset($opts->contentChineseAction) ? (string) $opts->contentChineseAction : 'A';
		if (!self::stringHasChinese($text)) {
			if ($contentAction === 'C') {
				return self::result('deny', ['content_no_cn']);
			}
			if ($contentAction === 'B') {
				$holdReasons[] = 'content_no_cn';
			}
		}

		$authorAction = isset($opts->authorChineseAction) ? (string) $opts->authorChineseAction : 'A';
		if (!self::stringHasChinese($author)) {
			if ($authorAction === 'C') {
				return self::result('deny', ['author_no_cn']);
			}
			if ($authorAction === 'B') {
				$holdReasons[] = 'author_no_cn';
			}
		}

		if (self::optionEnabled($opts, 'blockForeignLanguage') && self::isPureForeignLanguage($text)) {
			return self::result('deny', ['foreign_language']);
		}

		$runBaidu = !isset($context['runBaidu']) || $context['runBaidu'];
		if ($runBaidu && self::optionEnabled($opts, 'baiduEnable')) {
			$apiKey = isset($opts->baiduApiKey) ? trim((string) $opts->baiduApiKey) : '';
			$secretKey = isset($opts->baiduSecretKey) ? trim((string) $opts->baiduSecretKey) : '';
			if ($apiKey !== '' && $secretKey !== '') {
				$audit = self::baiduTextAudit($text, $apiKey, $secretKey, $opts);
				if ($audit === 'block') {
					return self::result('deny', ['baidu_block']);
				}
				if ($audit === 'review') {
					$reviewAction = isset($opts->baiduReviewAction) ? (string) $opts->baiduReviewAction : 'B';
					if ($reviewAction === 'C') {
						return self::result('deny', ['baidu_review_deny']);
					}
					$holdReasons[] = 'baidu_review';
				}
				if ($audit === 'error') {
					$failPolicy = isset($opts->baiduFailPolicy) ? (string) $opts->baiduFailPolicy : 'review';
					if ($failPolicy === 'review') {
						$holdReasons[] = 'baidu_error';
					}
				}
			}
		}

		if (!empty($holdReasons)) {
			return self::result('hold', $holdReasons);
		}

		return self::result('allow');
	}

	public static function result($decision, array $reasons = [])
	{
		$primary = isset($reasons[0]) ? $reasons[0] : null;
		return [
			'decision' => $decision,
			'reasons' => $reasons,
			'reason' => $primary,
			'message' => $primary ? self::reasonLabel($primary) : '',
			'ok' => $decision !== 'deny',
		];
	}

	public static function reasonLabel($reason)
	{
		$map = [
			'module_whitelist' => '当前模块已加入白名单，跳过审核',
			'ip_blacklist' => 'IP 已在黑名单中',
			'email_blacklist' => '邮箱已在黑名单中',
			'sensitive' => '包含敏感词',
			'invalid_email' => '邮箱格式不正确',
			'spam_phone' => '疑似广告，包含电话号码',
			'spam_wechat' => '疑似广告，包含微信号',
			'spam_url' => '疑似广告，包含链接',
			'spam_repeat' => '疑似广告，包含重复内容',
			'author_too_long' => '昵称长度超出限制',
			'garbled_content' => '内容存在乱码或异常字符',
			'content_no_cn' => '评论内容需包含中文',
			'author_no_cn' => '昵称需包含中文',
			'foreign_language' => '纯外语评论已被拦截',
			'baidu_block' => '评论内容未通过百度审核',
			'baidu_review' => '评论将进入人工审核',
			'baidu_review_deny' => '评论内容需要审核，当前策略为直接拦截',
			'baidu_error' => '审核服务暂时不可用，评论将进入待审核',
		];

		return isset($map[$reason]) ? $map[$reason] : (string) $reason;
	}

	public static function reasonType($reason)
	{
		if ($reason === 'module_whitelist') {
			return 'default';
		}
		if (strpos((string) $reason, 'spam_') === 0) {
			return 'spam';
		}
		if (strpos((string) $reason, 'baidu_') === 0) {
			return 'baidu';
		}
		if (in_array($reason, ['sensitive'], true)) {
			return 'sensitive';
		}

		return 'default';
	}

	public static function debug($opts, $message)
	{
		if (self::optionEnabled($opts, 'debugLog')) {
			@error_log('[TSpamReview] ' . $message);
		}
	}

	public static function getTokenStatus()
	{
		$data = self::readTokenCache();
		$expire = isset($data['expire']) ? (int) $data['expire'] : 0;
		$lastRefreshTime = isset($data['last_refresh_time']) ? (int) $data['last_refresh_time'] : 0;
		$remaining = max(0, $expire - time());

		return [
			'cached' => !empty($data['token']) && $expire > time(),
			'expire' => $expire,
			'last_refresh_time' => $lastRefreshTime,
			'last_refresh_status' => isset($data['last_refresh_status']) ? (string) $data['last_refresh_status'] : 'idle',
			'last_error' => isset($data['last_error']) ? (string) $data['last_error'] : '',
			'remaining' => $remaining,
			'remaining_text' => self::formatDuration($remaining),
			'expire_text' => $expire > 0 ? date('Y-m-d H:i:s', $expire) : '-',
			'last_refresh_text' => $lastRefreshTime > 0 ? date('Y-m-d H:i:s', $lastRefreshTime) : '-',
		];
	}

	public static function refreshToken($opts)
	{
		$apiKey = isset($opts->baiduApiKey) ? trim((string) $opts->baiduApiKey) : '';
		$secretKey = isset($opts->baiduSecretKey) ? trim((string) $opts->baiduSecretKey) : '';

		if ($apiKey === '' || $secretKey === '') {
			self::updateTokenCache([
				'token' => '',
				'expire' => 0,
				'last_refresh_time' => time(),
				'last_refresh_status' => 'failed',
				'last_error' => 'missing_api_credentials',
			]);
			return [
				'ok' => false,
				'message' => '请先填写百度 API Key 和 Secret Key',
				'status' => self::getTokenStatus(),
			];
		}

		$tokenData = self::fetchBaiduAccessToken($apiKey, $secretKey);
		if (!$tokenData) {
			$status = self::getTokenStatus();
			$reason = $status['last_error'] !== '' ? $status['last_error'] : 'token_request_failed';
			return [
				'ok' => false,
				'message' => 'Token 刷新失败：' . $reason,
				'status' => $status,
			];
		}

		self::storeCachedToken($tokenData['token'], $tokenData['expire']);
		return [
			'ok' => true,
			'message' => 'Token 已刷新',
			'status' => self::getTokenStatus(),
		];
	}

	public static function logBlockedComment(array $comment, $reason, $opts, array $context = [])
	{
		if (!self::optionEnabled($opts, 'blockLog')) {
			return false;
		}

		if (!is_dir(self::$logDir) && !@mkdir(self::$logDir, 0755, true) && !is_dir(self::$logDir)) {
			self::debug($opts, '无法创建日志目录');
			return false;
		}

		if (!is_writable(self::$logDir)) {
			self::debug($opts, '日志目录不可写: ' . self::$logDir);
			return false;
		}

		$logFile = self::$logDir . DIRECTORY_SEPARATOR . 'blocked_' . date('Y-m-d') . '.log';
		$text = trim((string) self::getFieldValue($comment, 'text'));
		if (mb_strlen($text, 'UTF-8') > 200) {
			$text = mb_substr($text, 0, 200, 'UTF-8') . '...';
		}

		$entry = [
			'time' => date('Y-m-d H:i:s'),
			'author' => self::singleLine(self::getFieldValue($comment, 'author'), '未知'),
			'mail' => self::singleLine(self::getFieldValue($comment, 'mail'), '未知'),
			'ip' => self::singleLine(self::getFieldValue($comment, 'ip'), '未知'),
			'text' => self::singleLine($text, ''),
			'reason' => (string) $reason,
			'stage' => isset($context['stage']) ? (string) $context['stage'] : 'unknown',
			'module' => isset($context['module']) ? (string) $context['module'] : self::guessModuleHint($context),
			'request_uri' => isset($context['requestUri']) ? self::singleLine($context['requestUri'], '') : '',
			'referer' => isset($context['referer']) ? self::singleLine($context['referer'], '') : '',
		];

		$payload = json_encode($entry, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) . "\n";
		return @file_put_contents($logFile, $payload, FILE_APPEND | LOCK_EX) !== false;
	}

	public static function buildRequestContext()
	{
		$context = [
			'requestUri' => isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '',
			'pathInfo' => isset($_SERVER['PATH_INFO']) ? (string) $_SERVER['PATH_INFO'] : '',
			'referer' => isset($_SERVER['HTTP_REFERER']) ? (string) $_SERVER['HTTP_REFERER'] : '',
			'postKeys' => [],
			'postValues' => [],
		];

		foreach ($_POST as $key => $value) {
			$context['postKeys'][] = (string) $key;
			if (is_scalar($value)) {
				$context['postValues'][] = (string) $value;
			}
		}

		$context['module'] = self::guessModuleHint($context);

		return $context;
	}

	private static function guessModuleHint(array $context)
	{
		$haystacks = [];
		foreach (['requestUri', 'pathInfo', 'referer'] as $key) {
			if (!empty($context[$key])) {
				$haystacks[] = self::toLower((string) $context[$key]);
			}
		}
		if (!empty($context['postKeys']) && is_array($context['postKeys'])) {
			foreach ($context['postKeys'] as $item) {
				$haystacks[] = self::toLower((string) $item);
			}
		}
		if (!empty($context['postValues']) && is_array($context['postValues'])) {
			foreach ($context['postValues'] as $item) {
				$haystacks[] = self::toLower((string) $item);
			}
		}

		$keywords = self::$defaultModuleWhitelist;
		foreach ($haystacks as $haystack) {
			if ($haystack === '') {
				continue;
			}
			foreach ($keywords as $keyword) {
				if (strpos($haystack, $keyword) !== false) {
					return $keyword;
				}
			}
		}

		return 'comment';
	}

	public static function getFieldValue($source, $key)
	{
		if (is_array($source)) {
			return isset($source[$key]) ? $source[$key] : null;
		}

		if (is_object($source)) {
			if (isset($source->$key)) {
				return $source->$key;
			}
			if ($source instanceof ArrayAccess) {
				try {
					return $source[$key];
				} catch (Exception $e) {
				}
			}
			$cast = (array) $source;
			if (isset($cast[$key])) {
				return $cast[$key];
			}
			foreach ($cast as $name => $value) {
				if (substr((string) $name, -strlen($key)) === $key) {
					return $value;
				}
			}
		}

		return null;
	}

	public static function isAdmin()
	{
		try {
			$user = Typecho_Widget::widget('Widget_User');
			if (method_exists($user, 'hasLogin') && !$user->hasLogin()) {
				return false;
			}
			if (isset($user->group) && $user->group === 'administrator') {
				return true;
			}
			return method_exists($user, 'pass') ? $user->pass('administrator', true) : false;
		} catch (Exception $e) {
			return false;
		}
	}

	private static function isWhitelistedModule($opts, array $context)
	{
		$keywords = self::getModuleWhitelistKeywords($opts);
		if (empty($keywords)) {
			return false;
		}

		$fields = [];
		foreach (['requestUri', 'pathInfo', 'referer'] as $key) {
			if (!empty($context[$key])) {
				$fields[] = (string) $context[$key];
			}
		}
		if (!empty($context['postKeys']) && is_array($context['postKeys'])) {
			$fields = array_merge($fields, $context['postKeys']);
		}
		if (!empty($context['postValues']) && is_array($context['postValues'])) {
			$fields = array_merge($fields, $context['postValues']);
		}

		foreach ($fields as $field) {
			$haystack = self::toLower((string) $field);
			if ($haystack === '') {
				continue;
			}
			foreach ($keywords as $keyword) {
				if (strpos($haystack, $keyword) !== false) {
					return true;
				}
			}
		}

		return false;
	}

	private static function getModuleWhitelistKeywords($opts)
	{
		$custom = self::parseLines(isset($opts->moduleWhitelistKeywords) ? $opts->moduleWhitelistKeywords : '', true);
		$list = array_merge(self::$defaultModuleWhitelist, $custom);
		$clean = [];
		foreach ($list as $item) {
			$value = trim(self::toLower($item));
			if ($value !== '') {
				$clean[$value] = true;
			}
		}

		return array_keys($clean);
	}

	private static function singleLine($value, $fallback)
	{
		$text = trim((string) $value);
		if ($text === '') {
			$text = $fallback;
		}
		return str_replace(["\r\n", "\r", "\n"], ' ', $text);
	}

	private static function toLower($value)
	{
		$text = (string) $value;
		return function_exists('mb_strtolower') ? mb_strtolower($text, 'UTF-8') : strtolower($text);
	}

	private static function hasSensitiveWord(array $fields, array $words)
	{
		foreach ($fields as $field) {
			$haystack = self::toLower((string) $field);
			if ($haystack === '') {
				continue;
			}
			foreach ($words as $word) {
				$needle = self::toLower(trim((string) $word));
				if ($needle !== '' && strpos($haystack, $needle) !== false) {
					return true;
				}
			}
		}

		return false;
	}

	private static function detectSpamType($text, $author)
	{
		$combined = trim($text . ' ' . $author);
		if (self::hasPhoneNumber($combined)) {
			return 'phone';
		}
		if (self::hasWechatId($combined)) {
			return 'wechat';
		}
		if (self::hasUrl($text)) {
			return 'url';
		}
		if (self::hasRepetitiveContent($text)) {
			return 'repeat';
		}

		return null;
	}

	private static function stringHasChinese($text)
	{
		return $text !== '' && preg_match('/[\x{4e00}-\x{9fa5}]/u', $text) > 0;
	}

	private static function hasPhoneNumber($text)
	{
		return $text !== '' && (
			preg_match('/1[3-9]\d{9}/', $text)
			|| preg_match('/0\d{2,3}[-\s]?\d{7,8}/', $text)
			|| preg_match('/[48]00[-\s]?\d{3}[-\s]?\d{4}/', $text)
		);
	}

	private static function hasWechatId($text)
	{
		if ($text === '') {
			return false;
		}

		$lower = self::toLower($text);
		return preg_match('/(wx|weixin|微信)\s*[：:]\s*[a-z0-9_-]{5,}/ui', $lower)
			|| preg_match('/(微信号|微信|vx|VX)\s*[：:\s]*[a-z0-9_-]{5,}/ui', $text)
			|| preg_match('/\b(wx|weixin)_[a-z0-9_-]{4,}\b/i', $lower);
	}

	private static function hasUrl($text)
	{
		if ($text === '') {
			return false;
		}

		return preg_match('/(https?:\/\/|ftp:\/\/)/i', $text)
			|| preg_match('/\bwww\.[a-z0-9][a-z0-9-]*\.[a-z]{2,}/i', $text)
			|| preg_match('/\b[a-z0-9][-a-z0-9]{0,62}\.(com|cn|net|org|info|biz|cc|tv|me|io|co|top|xyz|site|online|tech|store|club|fun|icu|vip|shop|wang|ink|ltd|group|link|pro|kim|red|pet|art|design|wiki|pub|live|news|video|email|chat|zone|world|city|center|life|team|work|space|today|uno)\b/i', $text);
	}

	private static function hasRepetitiveContent($text)
	{
		if ($text === '' || mb_strlen($text, 'UTF-8') < 15) {
			return false;
		}

		return preg_match('/(.)\1{5,}/u', $text)
			|| preg_match('/(.{3,8})\1{3,}/u', $text)
			|| preg_match('/(.{10,})\1{2,}/u', $text);
	}

	private static function hasGarbledContent($author, $mail, $text)
	{
		if ($author !== '') {
			$len = mb_strlen($author, 'UTF-8');
			$specialCount = preg_match_all('/[^\x{4e00}-\x{9fa5}a-zA-Z0-9\s\-_]/u', $author, $matches);
			if ($len > 0 && $specialCount > $len * 0.5) {
				return true;
			}
			if (preg_match('/[\x00-\x08\x0B-\x0C\x0E-\x1F]+/', $author)) {
				return true;
			}
			if ($len > 3 && preg_match('/^[^\x{4e00}-\x{9fa5}a-zA-Z0-9]+$/u', $author)) {
				return true;
			}
		}

		if ($mail !== '' && strpos($mail, '@') !== false) {
			$localPart = substr($mail, 0, strpos($mail, '@'));
			$len = mb_strlen($localPart, 'UTF-8');
			$specialCount = preg_match_all('/[^a-zA-Z0-9.\-_+]/', $localPart, $matches);
			if ($len > 0 && $specialCount > $len * 0.6) {
				return true;
			}
			if (preg_match('/[\x00-\x08\x0B-\x0C\x0E-\x1F]/', $localPart)) {
				return true;
			}
		}

		if ($text !== '') {
			$controlCharCount = preg_match_all('/[\x00-\x08\x0B-\x0C\x0E-\x1F]/', $text, $matches);
			$textLen = mb_strlen($text, 'UTF-8');
			if ($textLen > 0 && $controlCharCount > $textLen * 0.5) {
				return true;
			}
			if (preg_match('/[^\x{4e00}-\x{9fa5}a-zA-Z0-9\s]{15,}/u', $text)) {
				return true;
			}
		}

		return false;
	}

	private static function isInvalidEmail($email)
	{
		if ($email === '') {
			return false;
		}

		if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
			return true;
		}

		$parts = explode('@', $email, 2);
		if (count($parts) !== 2) {
			return true;
		}

		$local = (string) $parts[0];
		$domain = strtolower((string) $parts[1]);
		if ($local === '' || $domain === '') {
			return true;
		}
		if (strlen($local) > 64 || strlen($domain) > 253) {
			return true;
		}

		// Avoid aggressive heuristics: only block obvious placeholder/test domains.
		$blockedDomains = [
			'example.com', 'example.org', 'example.net',
			'test.com', 'test.org', 'invalid', 'localhost',
		];
		if (in_array($domain, $blockedDomains, true)) {
			return true;
		}

		$tld = (string) substr(strrchr($domain, '.'), 1);
		if (in_array($tld, ['example', 'invalid', 'local', 'localhost', 'test'], true)) {
			return true;
		}

		return false;
	}

	private static function isPureForeignLanguage($text)
	{
		if ($text === '' || mb_strlen($text, 'UTF-8') < 3) {
			return false;
		}

		$totalForeignChars = 0;
		$totalForeignChars += preg_match_all('/[\x{0400}-\x{04FF}]/u', $text, $matches);
		$totalForeignChars += preg_match_all('/[\x{AC00}-\x{D7AF}\x{1100}-\x{11FF}]/u', $text, $matches);
		$totalForeignChars += preg_match_all('/[\x{3040}-\x{309F}\x{30A0}-\x{30FF}]/u', $text, $matches);
		$totalForeignChars += preg_match_all('/[\x{0600}-\x{06FF}]/u', $text, $matches);
		$totalForeignChars += preg_match_all('/[\x{0E00}-\x{0E7F}]/u', $text, $matches);

		$totalLength = mb_strlen($text, 'UTF-8');
		return $totalForeignChars > $totalLength * 0.6 && !self::stringHasChinese($text);
	}

	private static function baiduTextAudit($text, $apiKey, $secretKey, $opts)
	{
		if ($text === '') {
			return 'pass';
		}

		$accessToken = self::loadCachedToken();
		if (!$accessToken) {
			$tokenData = self::fetchBaiduAccessToken($apiKey, $secretKey);
			if ($tokenData) {
				$accessToken = $tokenData['token'];
				self::storeCachedToken($tokenData['token'], $tokenData['expire']);
			} else {
				self::debug($opts, '百度 Token 获取失败');
				return 'error';
			}
		}

		$url = 'https://aip.baidubce.com/rest/2.0/solution/v1/text_censor/v2/user_defined?access_token=' . rawurlencode($accessToken);
		$data = self::requestBaiduAudit($url, $text);
		if ($data === false) {
			self::debug($opts, '百度审核请求失败');
			return 'error';
		}
		self::debug($opts, '百度审核返回: ' . json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));

		if (isset($data['error_code']) && in_array((int) $data['error_code'], [18, 100, 110, 111], true)) {
			$tokenData = self::fetchBaiduAccessToken($apiKey, $secretKey);
			if (!$tokenData) {
				return 'error';
			}
			$accessToken = $tokenData['token'];
			self::storeCachedToken($tokenData['token'], $tokenData['expire']);
			$url = 'https://aip.baidubce.com/rest/2.0/solution/v1/text_censor/v2/user_defined?access_token=' . rawurlencode($accessToken);
			$data = self::requestBaiduAudit($url, $text);
			if ($data === false) {
				return 'error';
			}
		}

		$conclusionType = null;
		if (isset($data['conclusionType'])) {
			$conclusionType = (int) $data['conclusionType'];
		} elseif (isset($data['result']['conclusionType'])) {
			$conclusionType = (int) $data['result']['conclusionType'];
		} elseif (isset($data['data'][0]['conclusionType'])) {
			$conclusionType = (int) $data['data'][0]['conclusionType'];
		} elseif (isset($data['conclusion'])) {
			$conclusion = self::toLower((string) $data['conclusion']);
			if (strpos($conclusion, '不合规') !== false || strpos($conclusion, '违规') !== false) {
				$conclusionType = 3;
			} elseif (strpos($conclusion, '疑似') !== false || strpos($conclusion, '审核') !== false) {
				$conclusionType = 2;
			} elseif (strpos($conclusion, '合规') !== false) {
				$conclusionType = 1;
			}
		}

		if ($conclusionType === 1) {
			return 'pass';
		}
		if ($conclusionType === 2) {
			if (self::hasBaiduBlockHint($data)) {
				return 'block';
			}
			return 'review';
		}
		if ($conclusionType === 3) {
			return 'block';
		}

		self::debug($opts, '百度审核返回异常: ' . json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
		return 'error';
	}

	private static function hasBaiduBlockHint(array $data)
	{
		$items = [];
		if (isset($data['data']) && is_array($data['data'])) {
			$items = $data['data'];
		} elseif (isset($data['results']) && is_array($data['results'])) {
			$items = $data['results'];
		}

		foreach ($items as $item) {
			if (!is_array($item)) {
				continue;
			}

			$msg = self::toLower(
				(isset($item['msg']) ? $item['msg'] : '') . ' ' .
				(isset($item['conclusion']) ? $item['conclusion'] : '') . ' ' .
				(isset($item['label']) ? $item['label'] : '') . ' ' .
				(isset($item['subLabel']) ? $item['subLabel'] : '')
			);

			if ($msg !== '' && (
				strpos($msg, '不合规') !== false
				|| strpos($msg, '违规') !== false
				|| strpos($msg, '违禁') !== false
				|| strpos($msg, '敏感') !== false
				|| strpos($msg, '色情') !== false
				|| strpos($msg, '政治') !== false
				|| strpos($msg, '广告') !== false
			)) {
				return true;
			}
		}

		return false;
	}

	private static function requestBaiduAudit($url, $text)
	{
		$response = self::httpPostForm($url, ['text' => $text, 'riskWarning' => 'true'], 8);
		if ($response === false) {
			return false;
		}

		$data = json_decode($response, true);
		return is_array($data) ? $data : false;
	}

	private static function fetchBaiduAccessToken($apiKey, $secretKey)
	{
		$url = 'https://aip.baidubce.com/oauth/2.0/token';
		$fields = [
			'grant_type' => 'client_credentials',
			'client_id' => $apiKey,
			'client_secret' => $secretKey,
		];

		$response = self::httpPostForm($url, $fields, 6);
		if ($response === false) {
			// Fallback to GET for restricted environments
			$response = self::httpGet($url, $fields, 6);
		}

		if ($response === false) {
			self::updateTokenCache([
				'last_refresh_time' => time(),
				'last_refresh_status' => 'failed',
				'last_error' => self::$lastHttpError !== '' ? self::$lastHttpError : 'token_request_failed',
			]);
			return false;
		}

		$data = json_decode($response, true);
		if (!isset($data['access_token']) || !is_string($data['access_token'])) {
			$error = '';
			if (isset($data['error']) && is_string($data['error'])) {
				$error = $data['error'];
			}
			$desc = '';
			if (isset($data['error_description']) && is_string($data['error_description'])) {
				$desc = $data['error_description'];
			}
			$errMsg = '';
			if (isset($data['error_msg']) && is_string($data['error_msg'])) {
				$errMsg = $data['error_msg'];
			}
			$merged = trim($error . ($desc !== '' ? (':' . $desc) : '') . ($errMsg !== '' ? (':' . $errMsg) : ''));
			if ($merged === '') {
				$merged = 'invalid_token_response:' . substr(json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES), 0, 180);
			}
			self::updateTokenCache([
				'last_refresh_time' => time(),
				'last_refresh_status' => 'failed',
				'last_error' => $merged,
			]);
			return false;
		}

		$expiresIn = isset($data['expires_in']) ? (int) $data['expires_in'] : 2592000;
		if ($expiresIn <= 0) {
			$expiresIn = 2592000;
		}

		$refreshBuffer = min(86400, max(600, (int) floor($expiresIn * 0.1)));
		return [
			'token' => $data['access_token'],
			'expire' => time() + max(300, $expiresIn - $refreshBuffer),
			'last_refresh_time' => time(),
			'last_refresh_status' => 'success',
			'last_error' => '',
		];
	}

	private static function httpPostForm($url, array $fields, $timeout)
	{
		self::$lastHttpError = '';
		$postFields = http_build_query($fields, '', '&');
		if (function_exists('curl_init')) {
			$ch = curl_init();
			curl_setopt($ch, CURLOPT_URL, $url);
			curl_setopt($ch, CURLOPT_POST, true);
			curl_setopt($ch, CURLOPT_POSTFIELDS, $postFields);
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
			curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
			curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
			curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);
			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
			curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
			$caFile = self::resolveCaBundle();
			if ($caFile) {
				curl_setopt($ch, CURLOPT_CAINFO, $caFile);
			}
			$result = curl_exec($ch);
			$httpCode = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
			$curlError = curl_error($ch);
			curl_close($ch);
			if ($result === false) {
				self::$lastHttpError = $curlError ? ('curl_error:' . $curlError) : 'curl_exec_failed';
				return false;
			}
			if ($httpCode >= 400) {
				self::$lastHttpError = 'http_' . $httpCode . ':' . substr((string) $result, 0, 200);
				return false;
			}
			return $result;
		}

		$context = stream_context_create([
			'http' => [
				'method' => 'POST',
				'header' => "Content-Type: application/x-www-form-urlencoded\r\n",
				'content' => $postFields,
				'timeout' => $timeout,
			],
		]);

		$result = @file_get_contents($url, false, $context);
		if ($result === false) {
			$err = error_get_last();
			self::$lastHttpError = isset($err['message']) ? ('fopen_error:' . $err['message']) : 'fopen_failed';
			return false;
		}
		return $result;
	}

	private static function resolveCaBundle()
	{
		$ini = ini_get('curl.cainfo');
		if (is_string($ini) && $ini !== '' && is_file($ini)) {
			return $ini;
		}
		$ini = ini_get('openssl.cafile');
		if (is_string($ini) && $ini !== '' && is_file($ini)) {
			return $ini;
		}
		if (is_file(self::$caBundleFile)) {
			return self::$caBundleFile;
		}
		return false;
	}

	private static function httpGet($url, array $query, $timeout)
	{
		self::$lastHttpError = '';
		$fullUrl = $url;
		$q = http_build_query($query, '', '&');
		if ($q !== '') {
			$fullUrl .= (strpos($fullUrl, '?') === false ? '?' : '&') . $q;
		}

		if (function_exists('curl_init')) {
			$ch = curl_init();
			curl_setopt($ch, CURLOPT_URL, $fullUrl);
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
			curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
			curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
			curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
			curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
			$caFile = self::resolveCaBundle();
			if ($caFile) {
				curl_setopt($ch, CURLOPT_CAINFO, $caFile);
			}
			$result = curl_exec($ch);
			$httpCode = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
			$curlError = curl_error($ch);
			curl_close($ch);
			if ($result === false) {
				self::$lastHttpError = $curlError ? ('curl_error:' . $curlError) : 'curl_exec_failed';
				return false;
			}
			if ($httpCode >= 400) {
				self::$lastHttpError = 'http_' . $httpCode . ':' . substr((string) $result, 0, 200);
				return false;
			}
			return $result;
		}

		$context = stream_context_create([
			'http' => [
				'method' => 'GET',
				'timeout' => $timeout,
			],
		]);

		$result = @file_get_contents($fullUrl, false, $context);
		if ($result === false) {
			$err = error_get_last();
			self::$lastHttpError = isset($err['message']) ? ('fopen_error:' . $err['message']) : 'fopen_failed';
			return false;
		}
		return $result;
	}

	private static function loadCachedToken()
	{
		$data = self::readTokenCache();
		if (!is_array($data) || empty($data['token']) || empty($data['expire'])) {
			return false;
		}

		return (int) $data['expire'] > time() ? (string) $data['token'] : false;
	}

	private static function storeCachedToken($token, $expire)
	{
		self::updateTokenCache([
			'token' => (string) $token,
			'expire' => (int) $expire,
			'last_refresh_time' => time(),
			'last_refresh_status' => 'success',
			'last_error' => '',
		]);
	}

	private static function readTokenCache()
	{
		if (!is_file(self::$tokenCacheFile)) {
			return [];
		}

		$raw = @file_get_contents(self::$tokenCacheFile);
		if ($raw === false) {
			return [];
		}

		$data = json_decode($raw, true);
		return is_array($data) ? $data : [];
	}

	private static function updateTokenCache(array $data)
	{
		$current = self::readTokenCache();
		$payload = json_encode(array_merge([
			'token' => '',
			'expire' => 0,
			'last_refresh_time' => 0,
			'last_refresh_status' => 'idle',
			'last_error' => '',
		], $current, $data), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
		@file_put_contents(self::$tokenCacheFile, $payload);
	}

	private static function formatDuration($seconds)
	{
		$seconds = (int) $seconds;
		if ($seconds <= 0) {
			return '已过期';
		}
		$days = (int) floor($seconds / 86400);
		$hours = (int) floor(($seconds % 86400) / 3600);
		$minutes = (int) floor(($seconds % 3600) / 60);
		if ($days > 0) {
			return $days . '天' . $hours . '小时';
		}
		if ($hours > 0) {
			return $hours . '小时' . $minutes . '分钟';
		}
		return max(1, $minutes) . '分钟';
	}
}