package config

import "fmt"

type BlruleAction string

const (
	BlruleAccept    BlruleAction = "accept"
	BlruleWhitelist BlruleAction = "whitelist"
	BlruleDrop      BlruleAction = "drop"
	BlruleReject    BlruleAction = "reject"
	BlruleLog       BlruleAction = "log"
	BlruleContinue  BlruleAction = "continue"
	BlruleNFQueue   BlruleAction = "nfqueue"
)

// BlruleRule defines a blacklist/whitelist rule.
// Processed before normal rules; ACCEPT/WHITELIST/CONTINUE exempt matching
// traffic from remaining blacklist rules.
type BlruleRule struct {
	Action BlruleAction `yaml:"action"`

	Source string `yaml:"source"`
	Dest   string `yaml:"dest"`

	Proto string   `yaml:"proto,omitempty"`
	DPort PortSpec `yaml:"dport,omitempty"`
	SPort PortSpec `yaml:"sport,omitempty"`

	Log string `yaml:"log,omitempty"`

	// NFQUEUE number (only for nfqueue action).
	NFQueue int `yaml:"nfqueue,omitempty"`

	Comment string `yaml:"comment,omitempty"`
}

var validBlruleActions = map[BlruleAction]bool{
	BlruleAccept: true, BlruleWhitelist: true,
	BlruleDrop: true, BlruleReject: true,
	BlruleLog: true, BlruleContinue: true,
	BlruleNFQueue: true,
}

func (c *Config) validateBlrules() error {
	for i, r := range c.Blrules {
		if !validBlruleActions[r.Action] {
			return fmt.Errorf("blrules[%d]: unknown action %q", i, r.Action)
		}

		if r.Source == "" {
			return fmt.Errorf("blrules[%d]: source required", i)
		}
		if r.Dest == "" {
			return fmt.Errorf("blrules[%d]: dest required", i)
		}

		if err := c.validateZoneRef(r.Source); err != nil {
			return fmt.Errorf("blrules[%d]: source %w", i, err)
		}
		if err := c.validateZoneRef(r.Dest); err != nil {
			return fmt.Errorf("blrules[%d]: dest %w", i, err)
		}
	}
	return nil
}