package main

import (
	"log"
	"net/http"
	"sync/atomic"

	"zoraxy-firewall/zoraxy_plugin"
)

var breaker = newCircuitBreaker()

var (
	requestsTotal    uint64
	requestsAllowed  uint64
	requestsBlocked  uint64
	requestsBypassed uint64
)

func metricsSnapshot() map[string]interface{} {
	return map[string]interface{}{
		"total":    atomic.LoadUint64(&requestsTotal),
		"allowed":  atomic.LoadUint64(&requestsAllowed),
		"blocked":  atomic.LoadUint64(&requestsBlocked),
		"bypassed": atomic.LoadUint64(&requestsBypassed),
		"circuit":  circuitStateStr(breaker.State()),
		"enabled":  getConfig().Enabled,
	}
}

func circuitStateStr(s CircuitState) string {
	switch s {
	case StateClosed:
		return "closed"
	case StateOpen:
		return "open"
	case StateHalfOpen:
		return "half-open"
	}
	return "unknown"
}

func handleInspect(w http.ResponseWriter, r *http.Request) {
	atomic.AddUint64(&requestsTotal, 1)
	cfg := getConfig()

	if !cfg.Enabled {
		atomic.AddUint64(&requestsBypassed, 1)
		w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED))
		return
	}

	if breaker.State() == StateOpen {
		atomic.AddUint64(&requestsBypassed, 1)
		log.Printf("Firewall: breaker OPEN — fail-open, passing %s %s", r.Method, r.URL.Path)
		w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED))
		return
	}

	status, err := inspect(r)
	if err != nil {
		atomic.AddUint64(&requestsBypassed, 1)
		log.Printf("Firewall: inspection error — fail-open: %v", err)
		breaker.RecordFailure()
		w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED))
		return
	}

	breaker.RecordSuccess()

	if status == 403 {
		atomic.AddUint64(&requestsBlocked, 1)
		log.Printf("Firewall: BLOCKED %s %s", r.Method, r.URL.Path)
		w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_CAPTURED))
		return
	}

	atomic.AddUint64(&requestsAllowed, 1)
	w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED))
}