IP API

<?php
/* Look up a visitor with the Calenzy IP API, cache the answer for an hour,
   and never hold a page or block a visitor when the API cannot answer. */
function calenzy_ip(string $ip, string $api_key): ?array {
    /* One cache per key, so sites with different keys on one server never share
       answers, usage or a pause */
    $dir  = sys_get_temp_dir() . '/calenzy-ip-' . substr(hash('sha256', $api_key), 0, 16);
    $file = $dir . '/' . hash('sha256', $ip) . '.json';
    $down = $dir . '/.down';

    if (is_file($file) && filemtime($file) > time() - 3600) {
        $cached = json_decode((string) file_get_contents($file), true);
        if (is_array($cached)) { return $cached; }
    }
    /* The API failed less than 30 seconds ago: do not wait on it again */
    if (is_file($down) && filemtime($down) > time() - 30) { return null; }

    $ch = curl_init('https://api.calenzy.app/v1/ip/' . rawurlencode($ip));
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CONNECTTIMEOUT => 2,
        CURLOPT_TIMEOUT        => 3,
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $api_key],
    ]);
    $body = curl_exec($ch);
    $data = curl_getinfo($ch, CURLINFO_HTTP_CODE) === 200 ? json_decode((string) $body, true) : null;

    @mkdir($dir, 0700, true);
    if (!is_array($data) || ($data['status'] ?? '') !== 'ok') { @touch($down); return null; }

    $tmp = $file . '.' . getmypid();
    if (@file_put_contents($tmp, json_encode($data)) !== false) { @rename($tmp, $file); }
    return $data;
}

/* Your CAPTCHA said a refused visitor is a person: tell the API (allowed for your key
   for 30 days) and drop the cached refusal so their next page lets them in. */
function calenzy_ip_pass(string $ip, string $api_key): bool {
    $ch = curl_init('https://api.calenzy.app/v1/ip/' . rawurlencode($ip) . '/pass');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => '',
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CONNECTTIMEOUT => 2,
        CURLOPT_TIMEOUT        => 3,
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $api_key],
    ]);
    $ok = curl_exec($ch) !== false && curl_getinfo($ch, CURLINFO_HTTP_CODE) === 200;

    $dir = sys_get_temp_dir() . '/calenzy-ip-' . substr(hash('sha256', $api_key), 0, 16);
    @unlink($dir . '/' . hash('sha256', $ip) . '.json');
    return $ok;
}

$visitor = calenzy_ip($_SERVER['REMOTE_ADDR'], 'YOUR_API_KEY');

/* No answer (timeout, error, quota) means: let the visitor in */
if ($visitor !== null && $visitor['allowed'] === false) {
    http_response_code(403);
    exit('Access denied');   /* or your own check page, with a CAPTCHA that ends in calenzy_ip_pass() */
}

$language = $visitor['language'] ?? 'en';
$currency = $visitor['currency_code'] ?? 'EUR';
?>