//! /debug/* handlers (only routed with --debug-api).

use std::collections::HashSet;

use axum::{body::Bytes, extract::State, http::StatusCode, Json};
use tracing::{info, warn};

use crate::firewall::FirewallRules;
use crate::state::AppState;

pub(crate) async fn get_debug_firewall(State(state): State<AppState>) -> Json<FirewallRules> {
    Json(state.firewall.rules())
}

pub(crate) async fn put_debug_firewall(
    State(state): State<AppState>,
    Json(rules): Json<FirewallRules>,
) -> StatusCode {
    info!(inbound = ?rules.inbound, outbound = ?rules.outbound, "Firewall rules replaced");
    state.firewall.set_rules(rules);
    StatusCode::NO_CONTENT
}

/// Compatibility for the existing harness: block a set of peers in both directions.
/// Parses the body without requiring a Content-Type header, as before.
pub(crate) async fn put_debug_blacklist(State(state): State<AppState>, body: Bytes) -> StatusCode {
    match serde_json::from_slice::<HashSet<String>>(&body) {
        Ok(peers) => {
            info!(peers = ?peers, "Blacklist replaced (both directions)");
            state.firewall.set_rules(FirewallRules {
                inbound: peers.clone(),
                outbound: peers,
            });
            StatusCode::NO_CONTENT
        }
        Err(error) => {
            warn!(error = %error, "Invalid blacklist body");
            StatusCode::BAD_REQUEST
        }
    }
}