security

var BlocklistCmd = &cobra.Command{
	Use:   "blocklist",
	Short: i18n.T(i18n.CmdBlocklistShort),
	Long:  i18n.T(i18n.CmdBlocklistLong),
}

var CloudflareCmd = &cobra.Command{
	Use:   "cloudflare",
	Short: i18n.T("Update Cloudflare security rules"),
	Long:  i18n.T("Create or update Cloudflare WAF rules with support for IP placeholders"),
	RunE: func(cmd *cobra.Command, args []string) error {
		ctx := context.Background()

		apiToken := os.Getenv("CF_AUTH_TOKEN")
		if apiToken == "" {
			apiToken = os.Getenv("CLOUDFLARE_API_TOKEN")
		}
		if apiToken == "" {
			return fmt.Errorf("CF_AUTH_TOKEN or CLOUDFLARE_API_TOKEN environment variable is required")
		}

		if cfZoneID == "" || cfRulesetID == "" {
			return fmt.Errorf("zone-id and ruleset-id are required")
		}

		if cfAction == "" || cfExpr == "" {
			return fmt.Errorf("action and expression are required")
		}

		usesDynamic := strings.Contains(cfExpr, "{{PUBLIC_")
		requireIPv4 := usesDynamic && (strings.Contains(cfExpr, "{{PUBLIC_IP}}") || strings.Contains(cfExpr, "{{PUBLIC_IPV4"))
		needsIPv6Address := usesDynamic && (strings.Contains(cfExpr, "{{PUBLIC_IPV6}}") || strings.Contains(cfExpr, "{{PUBLIC_IPV6/") || strings.Contains(cfExpr, "{{PUBLIC_IPV6_INTERFACE}}"))
		needsIPv6Network := usesDynamic && strings.Contains(cfExpr, "{{PUBLIC_IPV6_NETWORK")

		var ipv4, ipv6 string
		ipv4 = strings.TrimSpace(cfIP)
		ipv6 = strings.TrimSpace(cfIPv6)

		if usesDynamic {
			if ipv4 != "" || ipv6 != "" {
				log.Info("Using IP data provided via flags; skipping online lookups where possible")
			} else {
				log.Info("Fetching public IP addresses...")
			}

			type ipState struct{ v4, v6 string }
			state, err := utils.Retry[ipState](ctx, utils.RetryOptions{
				Attempts:  6,
				BaseDelay: 1 * time.Second,
				MaxDelay:  8 * time.Second,
				OnRetry: func(attempt int, nextDelay time.Duration, _ error) {
					if log != nil {
						log.Infof("Public IP not ready yet; retrying in %s (%d/%d)", nextDelay, attempt, 6)
					}
				},
				ExceededError: func(attempts int, _ error) error {
					var missing []string
					if requireIPv4 {
						missing = append(missing, "IPv4")
					}
					if needsIPv6Address || needsIPv6Network {
						missing = append(missing, "IPv6")
					}
					return fmt.Errorf("unable to determine required public IP(s) after %d attempt(s): %s", attempts, strings.Join(missing, ", "))
				},
			}, func(ctx context.Context) (ipState, bool, error) {
				cur := ipState{v4: ipv4, v6: ipv6}
				if requireIPv4 && strings.TrimSpace(cur.v4) == "" {
					v4, err := utils.GetPublicIPv4(ctx)
					if err != nil {
						return cur, false, err
					}
					cur.v4 = v4
				}
				if needsIPv6Address && strings.TrimSpace(cur.v6) == "" {
					v6, err := utils.GetPublicIPv6(ctx)
					if err != nil {
						return cur, false, err
					}
					cur.v6 = v6
				}

				if needsIPv6Network && strings.TrimSpace(cur.v6) == "" {
					v6, err := utils.GetPublicIPv6(ctx)
					if err != nil {
						return cur, false, err
					}
					cur.v6 = v6
				}

				missingV4 := requireIPv4 && strings.TrimSpace(cur.v4) == ""
				missingV6 := (needsIPv6Address || needsIPv6Network) && strings.TrimSpace(cur.v6) == ""
				if missingV4 || missingV6 {
					return cur, true, nil
				}
				return cur, false, nil
			})
			if err != nil {
				return err
			}
			ipv4, ipv6 = state.v4, state.v6
		}

		if ipv4 != "" {
			log.Infof("Public IPv4: %s", ipv4)
		}
		if ipv6 != "" {
			log.Infof("Public IPv6: %s", ipv6)
		}

		if cfSkipUnchanged {
			if lastCache, err := readLastCache(); err == nil {

				ipsUnchanged := (!usesDynamic || (ipv4 == lastCache.IPv4 && ipv6 == lastCache.IPv6))
				ruleUnchanged := cfExpr == lastCache.Expression &&
					cfAction == lastCache.Action &&
					cfEnabled == lastCache.Enabled &&
					cfRuleID == lastCache.RuleID

				if ipsUnchanged && ruleUnchanged {
					log.Info("No changes detected (IPs and rule configuration unchanged); skipping Cloudflare API call")
					return nil
				}
			}
		}

		expression, err := ReplacePlaceholders(cfExpr, ipv4, ipv6)
		if err != nil {
			return fmt.Errorf("failed to replace placeholders in expression: %w", err)
		}
		if expression != cfExpr {
			log.Info("Expression after placeholder replacement:")
			log.Info(expression)
		}

		rule := CloudflareRule{
			Action:      cfAction,
			Description: cfDesc,
			Enabled:     cfEnabled,
			Expression:  expression,
		}

		if cfPosition > 0 {
			rule.Position = &CloudflarePosition{
				Index: cfPosition,
			}
		}

		client := NewCloudflareClient(apiToken)

		// Upsert rule
		var result *CloudflareRule
		var created bool

		if cfRuleID != "" {
			result, created, err = client.UpsertRule(ctx, cfZoneID, cfRulesetID, cfRuleID, rule)
		} else {

			result, err = client.CreateRule(ctx, cfZoneID, cfRulesetID, rule)
			created = true
		}

		if err != nil {
			return fmt.Errorf("failed to upsert rule: %w", err)
		}

		if created {
			log.Info("✓ Rule created successfully!")
		} else {
			log.Info("✓ Rule updated successfully!")
		}

		log.Infof("Rule ID: %s", result.ID)
		log.Infof("Description: %s", result.Description)
		log.Infof("Action: %s", result.Action)
		log.Infof("Enabled: %v", result.Enabled)

		if cfSkipUnchanged {
			cache := &cloudflareCache{
				IPv4:       ipv4,
				IPv6:       ipv6,
				Expression: cfExpr,
				Action:     cfAction,
				Enabled:    cfEnabled,
				RuleID:     cfRuleID,
			}
			_ = writeCache(cache)
		}

		return nil
	},
}

var HardenCmd = &cobra.Command{
	Use:   "harden",
	Short: i18n.T(i18n.CmdHardenShort),
	Long:  i18n.T(i18n.CmdHardenLong),
}

var PortscanCmd = &cobra.Command{
	Use:   "portscan",
	Short: i18n.T(i18n.CmdPortscanShort),
	Long:  i18n.T(i18n.CmdPortscanLong),
}

var VulnscanCmd = &cobra.Command{
	Use:   "vulnscan",
	Short: i18n.T(i18n.CmdVulnscanShort),
	Long:  i18n.T(i18n.CmdVulnscanLong),
}

var ZeroTrustPolicyCmd = &cobra.Command{
	Use:   "zerotrust-policy",
	Short: i18n.T("Update Zero Trust Access Application Policy"),
	Long: i18n.T(`Update a Zero Trust Access Application Policy with dynamic IP support.

This command updates an existing Access policy for a Zero Trust application.
It supports both app-specific policies and reusable (account-level) policies.

For app-specific policies, provide both --account-id and --app-id.
For reusable policies, use --reusable flag (no --app-id needed).

Supported placeholders in IP rules:
  {{PUBLIC_IP}}, {{PUBLIC_IPV4}} - Current public IPv4 address
  {{PUBLIC_IPV6}} - Current public IPv6 address
  {{PUBLIC_IPV4/24}}, {{PUBLIC_IPV6/64}} - CIDR notation
  {{PUBLIC_IPV6_NETWORK/64}} - IPv6 network prefix`),
	RunE: func(cmd *cobra.Command, args []string) error {
		ctx := context.Background()

		apiToken := os.Getenv("CF_AUTH_TOKEN")
		if apiToken == "" {
			apiToken = os.Getenv("CLOUDFLARE_API_TOKEN")
		}
		if apiToken == "" {
			return fmt.Errorf("CF_AUTH_TOKEN or CLOUDFLARE_API_TOKEN environment variable is required")
		}

		if ztAccountID == "" {
			return fmt.Errorf("account-id is required")
		}
		if !ztReusable && ztAppID == "" {
			return fmt.Errorf("app-id is required for app-specific policies (or use --reusable for reusable policies)")
		}
		if ztPolicyID == "" {
			return fmt.Errorf("policy-id is required")
		}

		needsIPv4 := false
		needsIPv6 := false
		allIPs := append(append([]string{}, ztIncludeIPs...), ztExcludeIPs...)
		for _, ip := range allIPs {
			if strings.Contains(ip, "{{PUBLIC_IPV4") || strings.Contains(ip, "{{PUBLIC_IP}}") {
				needsIPv4 = true
			}
			if strings.Contains(ip, "{{PUBLIC_IPV6") {
				needsIPv6 = true
			}
		}

		var ipv4, ipv6 string
		ipv4 = strings.TrimSpace(ztIP)
		ipv6 = strings.TrimSpace(ztIPv6)

		if needsIPv4 && ipv4 == "" {
			log.Info("Fetching public IPv4 address...")
			var err error
			ipv4, err = utils.GetPublicIPv4(ctx)
			if err != nil {
				log.Warnf("Could not fetch IPv4: %v", err)
			}
		}
		if needsIPv6 && ipv6 == "" {
			log.Info("Fetching public IPv6 address...")
			var err error
			ipv6, err = utils.GetPublicIPv6(ctx)
			if err != nil {
				log.Warnf("Could not fetch IPv6: %v", err)
			}
		}

		if ipv4 != "" {
			log.Infof("Public IPv4: %s", ipv4)
		}
		if ipv6 != "" {
			log.Infof("Public IPv6: %s", ipv6)
		}

		// Build include rules
		var includeRules []AccessRule
		for _, ip := range ztIncludeIPs {
			resolvedIP, err := ReplacePlaceholders(ip, ipv4, ipv6)
			if err != nil {
				return fmt.Errorf("failed to replace placeholders in include IP %q: %w", ip, err)
			}
			includeRules = append(includeRules, AccessRule{
				IP: &AccessIPRule{IP: resolvedIP},
			})
		}
		for _, email := range ztIncludeEmails {
			includeRules = append(includeRules, AccessRule{
				Email: &AccessEmailRule{Email: email},
			})
		}
		for _, groupID := range ztIncludeGroups {
			includeRules = append(includeRules, AccessRule{
				Group: &AccessGroupRule{ID: groupID},
			})
		}

		// Build exclude rules
		var excludeRules []AccessRule
		for _, ip := range ztExcludeIPs {
			resolvedIP, err := ReplacePlaceholders(ip, ipv4, ipv6)
			if err != nil {
				return fmt.Errorf("failed to replace placeholders in exclude IP %q: %w", ip, err)
			}
			excludeRules = append(excludeRules, AccessRule{
				IP: &AccessIPRule{IP: resolvedIP},
			})
		}

		client := NewCloudflareClient(apiToken)

		var existingPolicy *AccessPolicy
		var err error

		if ztReusable {
			log.Info("Using reusable policy endpoint...")
			existingPolicy, err = client.GetReusablePolicy(ctx, ztAccountID, ztPolicyID)
		} else {
			existingPolicy, err = client.GetAccessPolicy(ctx, ztAccountID, ztAppID, ztPolicyID)
		}
		if err != nil {
			return fmt.Errorf("failed to get existing policy: %w", err)
		}

		policy := AccessPolicy{
			ID:              ztPolicyID,
			Name:            existingPolicy.Name,
			Decision:        existingPolicy.Decision,
			Include:         existingPolicy.Include,
			Exclude:         existingPolicy.Exclude,
			Require:         existingPolicy.Require,
			SessionDuration: existingPolicy.SessionDuration,
			Precedence:      existingPolicy.Precedence,
		}

		if ztPolicyName != "" {
			policy.Name = ztPolicyName
		}
		if ztDecision != "" {
			policy.Decision = ztDecision
		}
		if len(includeRules) > 0 {
			policy.Include = includeRules
		}
		if len(excludeRules) > 0 {
			policy.Exclude = excludeRules
		}
		if ztSessionDur != "" {
			policy.SessionDuration = ztSessionDur
		}
		if ztPrecedence > 0 {
			policy.Precedence = ztPrecedence
		}

		log.Infof("Updating Zero Trust Access Policy: %s", policy.Name)

		var updatedPolicy *AccessPolicy
		if ztReusable {
			updatedPolicy, err = client.UpdateReusablePolicy(ctx, ztAccountID, ztPolicyID, policy)
		} else {
			updatedPolicy, err = client.UpdateAccessPolicy(ctx, ztAccountID, ztAppID, ztPolicyID, policy)
		}
		if err != nil {
			return fmt.Errorf("failed to update policy: %w", err)
		}

		log.Info("✓ Policy updated successfully!")
		log.Infof("Policy ID: %s", updatedPolicy.ID)
		log.Infof("Name: %s", updatedPolicy.Name)
		log.Infof("Decision: %s", updatedPolicy.Decision)
		log.Infof("Include rules: %d", len(updatedPolicy.Include))
		if len(updatedPolicy.Exclude) > 0 {
			log.Infof("Exclude rules: %d", len(updatedPolicy.Exclude))
		}

		return nil
	},
}