#!/usr/bin/env php
<?php
declare(strict_types=1);

require_once __DIR__ . '/../src/Database.php';
require_once __DIR__ . '/../src/FirewallManager.php';

use App\Database;
use App\FirewallManager;

$cmd = strtolower($argv[1] ?? 'status');

switch ($cmd) {
    case 'status':
        $st = FirewallManager::getStatus(true);
        $settings = $st['settings'];
        echo "=== Statut Pare-feu & Sécurité NexusPBX ===\n";
        echo "• Service Fail2ban       : " . ($st['is_running'] ? "\033[32mACTIF (En ligne)\033[0m" : "\033[31mARRÊTÉ\033[0m") . "\n";
        echo "• Pare-feu & Filtrage    : " . ($settings['firewall_enabled'] ? "\033[32mACTIF\033[0m" : "\033[33mINACTIF\033[0m") . "\n";
        echo "• Mode Strict Certbot 80 : " . ($settings['certbot_strict_port80'] ? "OUI (Port 80 ACME seul)" : "NON (Port 80 ouvert)") . "\n";
        echo "• Port HTTPS Admin       : " . ($settings['admin_https_port'] ?? 8443) . "\n";
        echo "• Total IPs Bannies      : " . $st['total_banned'] . "\n";
        if (!empty($st['banned_ips'])) {
            echo "\nListe des IPs bannies :\n";
            foreach ($st['banned_ips'] as $b) {
                echo "  - {$b['ip']} (Prison: {$b['jail']} - {$b['jail_label']})\n";
            }
        }
        echo "===========================================\n";
        break;

    case 'on':
    case 'enable':
        $db = Database::getConnection();
        $db->exec("UPDATE settings SET firewall_enabled = 1, certbot_strict_port80 = 1 WHERE id = 1");
        shell_exec('systemctl start fail2ban 2>&1');
        $settings = FirewallManager::getSettings();
        FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 1);
        @unlink('/tmp/nexus_fw_status_cache.json');
        echo "\033[32m[OK] Pare-feu NexusPBX activé avec succès (Mode Strict + Fail2ban démarré).\033[0m\n";
        break;

    case 'off':
    case 'disable':
        $db = Database::getConnection();
        $db->exec("UPDATE settings SET firewall_enabled = 0, certbot_strict_port80 = 0 WHERE id = 1");
        shell_exec('systemctl stop fail2ban 2>&1');
        $settings = FirewallManager::getSettings();
        FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 0);
        @unlink('/tmp/nexus_fw_status_cache.json');
        echo "\033[33m[OK] Pare-feu NexusPBX désactivé (Mode normal + Fail2ban arrêté).\033[0m\n";
        break;

    case 'unban':
        $ip = $argv[2] ?? '';
        if (!$ip) {
            echo "Usage: nexus-firewall unban <ip>\n";
            exit(1);
        }
        $res = FirewallManager::unbanIp($ip, 'all');
        echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
        break;

    case 'ban':
        $ip = $argv[2] ?? '';
        $jail = $argv[3] ?? 'asterisk';
        if (!$ip) {
            echo "Usage: nexus-firewall ban <ip> [jail]\n";
            exit(1);
        }
        $res = FirewallManager::banIp($ip, $jail);
        echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
        break;

    default:
        echo "Usage: nexus-firewall [status|on|off|ban <ip>|unban <ip>]\n";
        exit(1);
}