package main

import (
	"io"
	"log"
	"net/http"
	"sync/atomic"
	"time"
)

var breaker = newCircuitBreaker()

var (
	requestsTotal    uint64
	requestsAllowed  uint64
	requestsBlocked  uint64
	requestsBypassed uint64
)

func metricsSnapshot() map[string]interface{} {
	return map[string]interface{}{
		"total":    atomic.LoadUint64(&requestsTotal),
		"allowed":  atomic.LoadUint64(&requestsAllowed),
		"blocked":  atomic.LoadUint64(&requestsBlocked),
		"bypassed": atomic.LoadUint64(&requestsBypassed),
		"circuit":  circuitStateStr(breaker.State()),
		"enabled":  getConfig().Enabled,
	}
}

func circuitStateStr(s CircuitState) string {
	switch s {
	case StateClosed:   return "closed"
	case StateOpen:     return "open"
	case StateHalfOpen: return "half-open"
	}
	return "unknown"
}

func handleInspect(w http.ResponseWriter, r *http.Request) {
	atomic.AddUint64(&requestsTotal, 1)
	cfg := getConfig()

	if !cfg.Enabled || breaker.State() == StateOpen {
		atomic.AddUint64(&requestsBypassed, 1)
		if breaker.State() == StateOpen {
			log.Printf("Firewall: breaker OPEN — bypass %s %s", r.Method, r.URL.Path)
		}
		// Bypass: forward to WAF (WAF sends back to Zoraxy for routing).
		forwardToWAF(w, r)
		return
	}

	resp, err := forwardToWAF(w, r)
	if err != nil {
		atomic.AddUint64(&requestsBypassed, 1)
		breaker.RecordFailure()
		return
	}

	if resp.StatusCode == 403 {
		breaker.RecordSuccess()
		atomic.AddUint64(&requestsBlocked, 1)
		log.Printf("Firewall: BLOCKED %s %s", r.Method, r.URL.Path)
		return
	}

	breaker.RecordSuccess()
	atomic.AddUint64(&requestsAllowed, 1)
}

// forwardToWAF proxies the request to the WAF and copies the response back.
func forwardToWAF(w http.ResponseWriter, r *http.Request) (*http.Response, error) {
	cfg := getConfig()

	originalPath := r.Header.Get("X-Zoraxy-Uri")
	if originalPath == "" {
		originalPath = r.URL.Path
	}

	proxyReq, err := http.NewRequestWithContext(r.Context(), r.Method, cfg.WAFURL+originalPath, r.Body)
	if err != nil {
		http.Error(w, "proxy error", http.StatusInternalServerError)
		return nil, err
	}

	for key, vals := range r.Header {
		for _, v := range vals {
			proxyReq.Header.Add(key, v)
		}
	}

	client := &http.Client{Timeout: time.Duration(cfg.TimeoutMs) * time.Millisecond}
	resp, err := client.Do(proxyReq)
	if err != nil {
		http.Error(w, "WAF unreachable", http.StatusBadGateway)
		return nil, err
	}
	defer resp.Body.Close()

	for key, vals := range resp.Header {
		for _, v := range vals {
			w.Header().Add(key, v)
		}
	}
	w.WriteHeader(resp.StatusCode)
	io.Copy(w, resp.Body)

	return resp, nil
}