package waf

// The heuristic tag_deny. It reads SWW_TAG_DENY.

import (
	"context"
	"slices"
	"time"

	"sneak.berlin/go/smallwebwaf/internal/requestlog"
)

// tagDeny refuses a request that carries a tag in SWW_TAG_DENY. Its figure is
// the first such tag, in sorted order.
type tagDeny struct{}

func (tagDeny) name() string { return "tag_deny" }

func (tagDeny) check(_ context.Context, rq *request, _ time.Time) *verdict {
	for _, tag := range rq.line.Tags {
		if slices.Contains(rq.h.config.TagDeny, tag) {
			return &verdict{
				action:  requestlog.ActionClientDenied,
				figures: map[string]any{"tag": tag},
			}
		}
	}

	return nil
}