package config

import (
	"fmt"
	"net/netip"
	"strings"
)

// FirewallAllow reads firewall_networks: networks, or single addresses.
func (s Server) FirewallAllow() ([]netip.Prefix, error) {
	var out []netip.Prefix
	for i, n := range s.FirewallNetworks {
		n = strings.TrimSpace(n)
		if p, err := netip.ParsePrefix(n); err == nil {
			out = append(out, p.Masked())
			continue
		}
		a, err := netip.ParseAddr(n)
		if err != nil {
			return nil, fmt.Errorf("firewall_networks[%d] is %q: a network (10.0.1.0/24) or an address", i, n)
		}
		out = append(out, netip.PrefixFrom(a, a.BitLen()))
	}
	return out, nil
}

// EnginePorts is the range engines listen in on every node.
func (s Server) EnginePorts() (int, int) {
	if len(s.Control.PortRange) == 2 {
		return s.Control.PortRange[0], s.Control.PortRange[1]
	}
	d := Default().Control.PortRange
	return d[0], d[1]
}

// FirewallSettings is whether llmgw keeps a firewall on the cluster's
// machines.
type FirewallSettings struct {
	// Enabled keeps llmgw's internal ports — engines, node exporter, the
	// agents' stream, the mirror, the store — to the cluster's networks on
	// every machine. False removes llmgw's nftables table everywhere, for a
	// site whose own firewall does that job; the rules are kept, and true
	// puts them back. Changed in the cluster's settings, it is in force on
	// every node and control plane within seconds.
	Enabled bool `koanf:"enabled"`
}