1 files changed, 41 insertions, 0 deletions
diff --git a/src/api/debug.rs b/src/api/debug.rs
new file mode 100644
index 0000000..3c24f62
--- /dev/null
+++ b/src/api/debug.rs
@@ -0,0 +1,41 @@
+//! /debug/* handlers (only routed with --debug-api).
+
+use std::collections::HashSet;
+
+use axum::{body::Bytes, extract::State, http::StatusCode, Json};
+use tracing::{info, warn};
+
+use crate::firewall::FirewallRules;
+use crate::state::AppState;
+
+pub(crate) async fn get_debug_firewall(State(state): State<AppState>) -> Json<FirewallRules> {
+    Json(state.firewall.rules())
+}
+
+pub(crate) async fn put_debug_firewall(
+    State(state): State<AppState>,
+    Json(rules): Json<FirewallRules>,
+) -> StatusCode {
+    info!(inbound = ?rules.inbound, outbound = ?rules.outbound, "Firewall rules replaced");
+    state.firewall.set_rules(rules);
+    StatusCode::NO_CONTENT
+}
+
+/// Compatibility for the existing harness: block a set of peers in both directions.
+/// Parses the body without requiring a Content-Type header, as before.
+pub(crate) async fn put_debug_blacklist(State(state): State<AppState>, body: Bytes) -> StatusCode {
+    match serde_json::from_slice::<HashSet<String>>(&body) {
+        Ok(peers) => {
+            info!(peers = ?peers, "Blacklist replaced (both directions)");
+            state.firewall.set_rules(FirewallRules {
+                inbound: peers.clone(),
+                outbound: peers,
+            });
+            StatusCode::NO_CONTENT
+        }
+        Err(error) => {
+            warn!(error = %error, "Invalid blacklist body");
+            StatusCode::BAD_REQUEST
+        }
+    }
+}