package discriminator

// The heuristic countries. It reads SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.

import (
	"context"
	"slices"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/requestlog"
)

// countries refuses a request when SWW_EXCLUSIVELY_ALLOWED_COUNTRIES is set and
// does not hold the client's country as it was looked up. A client without a
// country, or whose country cannot be found, is refused. Its figures are the
// country and the setting that refused it.
type countries struct{}

func (countries) name() string { return "countries" }

func (countries) check(_ context.Context, rq *request, _ time.Time) *verdict {
	allowed := rq.h.config.ExclusivelyAllowedCountries
	country := rq.line.Country

	if len(allowed) == 0 || slices.Contains(allowed, country) {
		return nil
	}

	return &verdict{
		action: requestlog.ActionCountryDenied,
		figures: map[string]any{
			"country": country, "setting": "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES",
		},
	}
}