//go:build linux

package deploy

import (
	"fmt"
	"os/exec"
	"strings"
)

func OpenFirewallPort(port int, name string) (string, error) {
	if port <= 0 || port > 65535 {
		return "", fmt.Errorf("invalid port %d", port)
	}
	if ufw, err := exec.LookPath("ufw"); err == nil {
		rule := fmt.Sprintf("%d/tcp", port)
		out, runErr := exec.Command(ufw, "allow", rule, "comment", name).CombinedOutput()
		if runErr != nil {
			return "", fmt.Errorf("ufw allow: %v (%s)", runErr, strings.TrimSpace(string(out)))
		}
		return fmt.Sprintf("ufw allow %s (%s)", rule, name), nil
	}
	if ipt, err := exec.LookPath("iptables"); err == nil {
		out, runErr := exec.Command(ipt, "-I", "INPUT", "-p", "tcp", "--dport", fmt.Sprintf("%d", port), "-j", "ACCEPT").CombinedOutput()
		if runErr != nil {
			return "", fmt.Errorf("iptables: %v (%s)", runErr, strings.TrimSpace(string(out)))
		}
		return fmt.Sprintf("iptables INPUT accept tcp/%d", port), nil
	}
	return "", fmt.Errorf("no ufw or iptables found on host")
}

func SetWindowsFirewallProfiles(enable bool, profiles string) (string, error) {
	_ = profiles
	if ufw, err := exec.LookPath("ufw"); err == nil {
		arg := "disable"
		if enable {
			arg = "enable"
		}
		out, runErr := exec.Command(ufw, arg).CombinedOutput()
		if runErr != nil {
			return "", fmt.Errorf("ufw %s: %v (%s)", arg, runErr, strings.TrimSpace(string(out)))
		}
		return fmt.Sprintf("ufw %s", arg), nil
	}
	return "", fmt.Errorf("firewall profile control requires ufw on Linux")
}

func DisableWindowsFirewall() (string, error) {
	return SetWindowsFirewallProfiles(false, "all")
}

func EnableWindowsFirewall() (string, error) {
	return SetWindowsFirewallProfiles(true, "all")
}

func RemoveFirewallRuleByName(name string) (string, error) {
	name = strings.TrimSpace(name)
	if name == "" {
		return "", fmt.Errorf("rule name required")
	}
	if ufw, err := exec.LookPath("ufw"); err == nil {
		out, runErr := exec.Command(ufw, "status", "numbered").CombinedOutput()
		if runErr != nil {
			return "", fmt.Errorf("ufw status: %v", runErr)
		}
		for _, line := range strings.Split(string(out), "\n") {
			if strings.Contains(line, name) {
				fields := strings.Fields(line)
				if len(fields) > 0 {
					num := strings.Trim(fields[0], "[]")
					delOut, delErr := exec.Command(ufw, "delete", num).CombinedOutput()
					if delErr != nil {
						return "", fmt.Errorf("ufw delete: %v (%s)", delErr, strings.TrimSpace(string(delOut)))
					}
					return fmt.Sprintf("removed ufw rule %s matching %q", num, name), nil
				}
			}
		}
		return "", fmt.Errorf("no ufw rule matching %q", name)
	}
	return "", fmt.Errorf("firewall rule removal requires ufw on Linux")
}