package router

import (
	"log"
	"net/http"
	"net/netip"
	"strings"
)

// IpBlockList denies any request whose client IP falls within one of the given
// CIDRs or bare IPs, responding 403; all others pass. Entries are parsed once
// at construction — a malformed entry panics, a boot-time programming error
// caught before the server starts.
//
//	router.IpBlockList("203.0.113.0/24", "198.51.100.7")
func IpBlockList(entries ...string) Handler {
	set := parsePrefixes(entries)
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if set.contains(clientAddr(r)) {
				http.Error(w, "Forbidden", http.StatusForbidden)
				return
			}
			next.ServeHTTP(w, r)
		})
	}
}

// IpAllowList is the inverse of IpBlockList: only requests whose client IP falls
// within one of the given CIDRs or bare IPs pass; all others get 403.
//
//	router.IpAllowList("10.0.0.0/8")
func IpAllowList(entries ...string) Handler {
	set := parsePrefixes(entries)
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if !set.contains(clientAddr(r)) {
				http.Error(w, "Forbidden", http.StatusForbidden)
				return
			}
			next.ServeHTTP(w, r)
		})
	}
}

// prefixSet is a parsed list of CIDRs. A bare IP becomes a host-length prefix.
type prefixSet []netip.Prefix

func parsePrefixes(entries []string) prefixSet {
	set := make(prefixSet, 0, len(entries))
	for _, e := range entries {
		e = strings.TrimSpace(e)
		if strings.Contains(e, "/") {
			p, err := netip.ParsePrefix(e)
			if err != nil {
				log.Panicf("router: invalid CIDR %q: %v", e, err)
			}
			set = append(set, p.Masked())
			continue
		}
		addr, err := netip.ParseAddr(e)
		if err != nil {
			log.Panicf("router: invalid IP %q: %v", e, err)
		}
		addr = addr.Unmap()
		set = append(set, netip.PrefixFrom(addr, addr.BitLen()))
	}
	return set
}

func (s prefixSet) contains(addr netip.Addr) bool {
	if !addr.IsValid() {
		return false
	}
	for _, p := range s {
		if p.Contains(addr) {
			return true
		}
	}
	return false
}