package proxy

import (
	"net/netip"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/bans"
	"sneak.berlin/go/smallwebwaf/internal/requestlog"
)

// banResponse is a refusal answered with SWWAF_BAN_RESPONSE, and logged
// with action.
func (rq *request) banResponse(action string) *refusal {
	return &refusal{status: rq.h.config.BanResponse, action: action}
}

// banned reports whether a ban on a netblock the client is in covers the
// request at now, and notes for the log line when that ban ends.
func (rq *request) banned(now time.Time) bool {
	check := rq.h.ledger.Check
	if rq.h.config.Observe {
		check = rq.h.ledger.Find // in observe mode the ban refuses nothing
	}

	ban, banned := check(rq.client, now)
	if banned {
		rq.line.BanExpires = banExpires(ban)
	}

	return banned
}

// limitBroken counts the request for the rate limits at now, notes the
// client's counts for the log line, and reports whether the request takes
// the client over a limit. In enforce mode such a request bans the
// client's netblock, and sets the client's counters back to zero; in
// observe mode it does neither.
func (rq *request) limitBroken(now time.Time) bool {
	group := clientGroup(rq.client)

	counts, hit, over := rq.h.limiter.Count(group, now)
	rq.line.Counts = counts

	if !over {
		return false
	}

	rq.line.LimitHit = hit.Window
	rq.line.Offence = requestlog.OffenceLimit

	if rq.h.config.Observe {
		return true
	}

	netblock := rq.netblock()
	ban := rq.h.ledger.BanForLimit(netblock, now, bans.Notes{
		Country: rq.line.Country,
		Limit:   hit.Limit,
		Window:  hit.Window,
		Count:   hit.Requests,
		Request: bans.Request{
			Time:      now,
			Method:    rq.in.Method,
			Host:      rq.in.Host,
			Path:      rq.in.URL.RequestURI(),
			Status:    rq.h.config.BanResponse,
			UserAgent: rq.in.UserAgent(),
		},
		// The histories count this request only once it has ended.
		Requests: rq.h.limiter.Requests(netblock) + 1,
	})
	rq.h.limiter.Reset(group)
	rq.line.BanExpires = banExpires(ban)

	return true
}

// netblock is the netblock a ban on the client covers: its IPv4 address,
// widened to SWWAF_BAN_SCOPE_V4_PREFIX, or the IPv6 group clientGroup
// counts it in.
func (rq *request) netblock() netip.Prefix {
	addr := rq.client.Unmap()
	if addr.Is4() {
		return netip.PrefixFrom(addr, rq.h.config.BanScopeV4Prefix).Masked()
	}

	return clientGroup(addr)
}

// banExpires is when ban ends, as the log line gives it: a time, or
// permanent.
func banExpires(ban bans.Ban) string {
	if ban.Permanent() {
		return "permanent"
	}

	return requestlog.FormatTime(ban.Expires)
}