<?php

declare(strict_types=1);

namespace KTXC\Service;

use KTXC\Context\IdentityContextInterface;
use KTXC\Context\TenantContextInterface;
use KTXC\Models\Firewall\FirewallRuleObject;

final class TenantFirewallRuleService
{
    public const PERMISSION_READ = 'firewall.tenant.rules.read';
    public const PERMISSION_MANAGE = 'firewall.tenant.rules.manage';

    public function __construct(
        private readonly FirewallRuleManager $rules,
        private readonly TenantContextInterface $tenant,
        private readonly IdentityContextInterface $identity,
    ) {
    }

    public function listRules(bool $activeOnly = true): array
    {
        $this->requirePermission(self::PERMISSION_READ);
        return $this->rules->list($this->scope(), $activeOnly);
    }

    public function queryRules(
        string $status = 'active',
        ?string $type = null,
        ?string $action = null,
        int $limit = 50,
        int $offset = 0
    ): array {
        $this->requirePermission(self::PERMISSION_READ);
        return $this->rules->query($this->scope(), $status, $type, $action, $limit, $offset);
    }

    public function fetchRule(string $ruleId): ?FirewallRuleObject
    {
        $this->requirePermission(self::PERMISSION_READ);
        return $this->rules->fetch($this->scope(), $ruleId);
    }

    public function createRule(
        string $type,
        string $action,
        string $value,
        string $reason,
        ?int $durationSeconds = null,
        ?string $currentIp = null,
        bool $confirmCurrentIp = false
    ): FirewallRuleObject {
        $this->requirePermission(self::PERMISSION_MANAGE);
        return $this->rules->createManualRule(
            $this->scope(),
            $type,
            $action,
            $value,
            $reason,
            $this->identity->identifier(),
            $durationSeconds,
            $currentIp,
            $confirmCurrentIp
        );
    }

    public function effectivePolicy(): array
    {
        $this->requirePermission(self::PERMISSION_READ);
        return $this->rules->effectivePolicy($this->tenant->requireIdentifier());
    }

    public function blockIp(string $ip, ?string $reason = null, ?int $durationSeconds = null): FirewallRuleObject
    {
        $this->requirePermission(self::PERMISSION_MANAGE);
        return $this->rules->blockIp(
            $this->scope(), $ip, $reason, $this->identity->identifier(), $durationSeconds
        );
    }

    public function allowIp(string $ip, ?string $reason = null): FirewallRuleObject
    {
        $this->requirePermission(self::PERMISSION_MANAGE);
        return $this->rules->allowIp($this->scope(), $ip, $reason, $this->identity->identifier());
    }

    public function blockIpRange(string $cidr, ?string $reason = null): FirewallRuleObject
    {
        $this->requirePermission(self::PERMISSION_MANAGE);
        return $this->rules->blockIpRange($this->scope(), $cidr, $reason, $this->identity->identifier());
    }

    public function blockDevice(
        string $fingerprint,
        ?string $reason = null,
        ?int $durationSeconds = null
    ): FirewallRuleObject {
        $this->requirePermission(self::PERMISSION_MANAGE);
        return $this->rules->blockDevice(
            $this->scope(), $fingerprint, $reason, $this->identity->identifier(), $durationSeconds
        );
    }

    public function disableRule(string $ruleId): bool
    {
        $this->requirePermission(self::PERMISSION_MANAGE);
        return $this->rules->disable($this->scope(), $ruleId, $this->identity->identifier());
    }

    public function removeRule(string $ruleId): bool
    {
        $this->requirePermission(self::PERMISSION_MANAGE);
        return $this->rules->remove($this->scope(), $ruleId, $this->identity->identifier());
    }

    private function scope(): FirewallRuleScope
    {
        return FirewallRuleScope::tenant($this->tenant->requireIdentifier());
    }

    private function requirePermission(string $permission): void
    {
        if (!$this->identity->hasPermission($permission)) {
            throw new \RuntimeException("Missing required permission: {$permission}");
        }
    }
}