#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck source=/dev/null
source "$SCRIPT_DIR/libenv.sh"

ENV_FILE=$(limristem_mail_resolve_main_env_file)

usage() {
  cat <<'EOF'
Usage:
  manage-rbl.sh show [--json]
  manage-rbl.sh set <yes|no> [zones...]

Configures optional inbound DNSBL helpers for Rspamd (limristem_rbl.conf).
EOF
}

require_root() {
  if [[ $EUID -ne 0 ]]; then
    echo "Run as root." >&2
    exit 1
  fi
}

load_env() {
  limristem_mail_load_env_file "$ENV_FILE"
}

show() {
  local enabled=${LIMRISTEM_MAIL_RSPAMD_DNSBL_ENABLED:-no}
  local zones=${LIMRISTEM_MAIL_RSPAMD_DNSBL_ZONES:-zen.spamhaus.org bl.spamcop.net}
  if [[ ${1:-} == "--json" ]]; then
    python3 - "$enabled" "$zones" <<'PY'
import json, sys
print(json.dumps({"enabled": sys.argv[1].lower() in {"1","true","yes","on"}, "zones": sys.argv[2].split()}))
PY
    return
  fi
  printf 'enabled=%s\n' "$enabled"
  printf 'zones=%s\n' "$zones"
}

write_conf() {
  local enabled=$1
  shift
  local zones=("$@")
  local conf=/etc/rspamd/local.d/limristem_rbl.conf
  mkdir -p /etc/rspamd/local.d
  {
    echo "# Generated by limristem-mail manage-rbl.sh"
    if [[ "$enabled" == "yes" ]]; then
      local zone symbol
      for zone in "${zones[@]}"; do
        [[ -z "$zone" ]] && continue
        symbol=$(printf 'RBL_%s' "$zone" | tr '[:lower:].-' '[:upper:]__' | cut -c1-48)
        cat <<EOF
${symbol} {
  rbl = "${zone}";
  symbol = "${symbol}";
  score = 3.0;
}
EOF
      done
    else
      echo "# inbound DNSBL disabled"
    fi
  } > "$conf"
  local user
  if id _rspamd >/dev/null 2>&1; then user=_rspamd
  elif id rspamd >/dev/null 2>&1; then user=rspamd
  else user=""
  fi
  if [[ -n "$user" ]]; then
    chown root:"$user" "$conf"
    chmod 640 "$conf"
  fi
  systemctl reload rspamd >/dev/null 2>&1 || systemctl restart rspamd >/dev/null 2>&1 || true
}

require_root
load_env
cmd=${1:-}
case "$cmd" in
  show)
    show "${2:-}"
    ;;
  set)
    enabled=${2:-}
    case "${enabled,,}" in
      yes|true|1|on) enabled=yes ;;
      no|false|0|off) enabled=no ;;
      *) echo "enabled must be yes or no" >&2; exit 1 ;;
    esac
    shift 2 || true
    zones=("$@")
    if (( ${#zones[@]} == 0 )); then
      zones=(zen.spamhaus.org bl.spamcop.net)
    fi
    limristem_mail_upsert_env_value "$ENV_FILE" LIMRISTEM_MAIL_RSPAMD_DNSBL_ENABLED "$enabled"
    limristem_mail_upsert_env_value "$ENV_FILE" LIMRISTEM_MAIL_RSPAMD_DNSBL_ZONES "${zones[*]}"
    load_env
    write_conf "$enabled" "${zones[@]}"
    show --json
    ;;
  *)
    usage >&2
    exit 1
    ;;
esac