package servewaf

// The heuristic countries. It reads SWWAF_DENIED_COUNTRIES and
// SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES.

import (
	"context"
	"slices"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/requestlog"
)

// countries refuses a request by the client's country as it was looked up. A
// client without a country, or whose country cannot be found, is refused only
// by SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES. Its figures are the country and the
// setting that refused it.
type countries struct{}

func (countries) name() string { return "countries" }

func (countries) check(_ context.Context, rq *request, _ time.Time) *verdict {
	denied := rq.h.config.DeniedCountries
	allowed := rq.h.config.ExclusivelyAllowedCountries
	country := rq.line.Country

	var setting string

	switch {
	case slices.Contains(denied, country):
		setting = "SWWAF_DENIED_COUNTRIES"
	case len(allowed) > 0 && !slices.Contains(allowed, country):
		setting = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
	default:
		return nil
	}

	return &verdict{
		action:  requestlog.ActionCountryDenied,
		figures: map[string]any{"country": country, "setting": setting},
	}
}