package servewaf

// The heuristic blocklists. It reads SWWAF_BLOCKLIST_ACTION, and the blocklists
// through the reputation lists.

import (
	"context"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/requestlog"
)

// blocklists notes the blocklists that list the client, as noteListed does,
// and refuses the request when SWWAF_BLOCKLIST_ACTION is deny. Being limit, it
// lowers the client's limits instead (see limitPercentages), and being log, it
// does nothing more. Its figure is the blocklists that list the client.
type blocklists struct{}

func (blocklists) name() string { return "blocklists" }

func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
	listedBy := rq.h.lists.ListedBy(rq.client)
	rq.blocklisted = len(listedBy) > 0
	rq.noteListed(listedBy, "listed by a blocklist")

	if !rq.refusedByBlocklists(listedBy) {
		return nil
	}

	return &verdict{
		action:  requestlog.ActionDenied,
		figures: map[string]any{"lists": listedBy},
	}
}

// refusedByBlocklists reports whether the heuristic blocklists refuses a
// client, given listedBy, the blocklists that list it: it does when one lists
// it and SWWAF_BLOCKLIST_ACTION is deny.
func (rq *request) refusedByBlocklists(listedBy []string) bool {
	return len(listedBy) > 0 && rq.h.config.BlocklistAction == deny
}