package servewaf

// The heuristic deny_nets. It reads SWWAF_DENY_NETS.

import (
	"context"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/requestlog"
)

// denyNets refuses a client in SWWAF_DENY_NETS. Its figure is the netblock of
// the setting the client is in.
type denyNets struct{}

func (denyNets) name() string { return "deny_nets" }

func (denyNets) check(_ context.Context, rq *request, _ time.Time) *verdict {
	for _, netblock := range rq.h.config.DenyNets {
		if netblock.Contains(rq.client) {
			return &verdict{
				action:  requestlog.ActionDenied,
				figures: map[string]any{figureNetblock: netblock.String()},
			}
		}
	}

	return nil
}