// The intrusion prevention's tools: the node-intrusion-prevention seat's four verbs — who is banned,
// the jails' state, ban one, let one go — and the module's own reading of a jail's settings
// (novox/hq to-be 31, ADR 0179). The jails themselves are composed by the mesh from the modules a
// machine runs and written as declared resources; these touch only what the running daemon holds.

import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
import { Fail2banClient } from "../client.js";

export function getSeatVerbs(fail2ban: Fail2banClient): ToolDefinition[] {
  return [
    {
      name: "status",
      description:
        "Every jail on this machine with what it watches, how many addresses it is counting failures against and holding now, and the totals since it started; one jail's detail when named.",
      input: { jail: { type: "string", description: "one jail (optional)" } },
      run: async (args) => fail2ban.status(args.jail ? String(args.jail) : undefined),
    },
    {
      name: "banned",
      description: "Every address banned on this machine right now, with the jail that holds it, when it was banned and when the ban ends.",
      input: { jail: { type: "string", description: "one jail (optional)" } },
      run: async (args) => fail2ban.banned(args.jail ? String(args.jail) : undefined),
    },
    {
      name: "ban",
      description:
        "Ban one address in one jail now, for the jail's ban time — an operator's act on the live ban list, which the mesh never writes itself.",
      input: {
        ip: { type: "string", description: "the address" },
        jail: { type: "string", description: "the jail to hold it (recidive for the long ban)" },
      },
      run: async (args) => fail2ban.ban(String(args.ip ?? ""), String(args.jail ?? "")),
    },
    {
      name: "unban",
      description: "Let one address go, from one jail or from every jail when none is named.",
      input: {
        ip: { type: "string", description: "the address" },
        jail: { type: "string", description: "one jail (optional)" },
      },
      run: async (args) => fail2ban.unban(String(args.ip ?? ""), args.jail ? String(args.jail) : undefined),
    },
  ];
}

export function getFail2banTools(fail2ban: Fail2banClient): ToolDefinition[] {
  return [
    {
      name: "fail2ban_settings",
      description:
        "One jail's effective settings on this machine: ban time, window, tries, the addresses it never bans, its actions and what it reads.",
      input: { jail: { type: "string", description: "the jail" } },
      run: async (args) => fail2ban.settings(String(args.jail ?? "")),
    },
  ];
}

const fail2ban = Fail2banClient.fromEnv();
// The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
// module holds it (ADR 0159, 0160). The module's own under its own.
registerModuleTools("node-intrusion-prevention", () => getSeatVerbs(fail2ban));
registerModuleTools("fail2ban", () => getFail2banTools(fail2ban));