#!/bin/bash
# SecuBox Ad Guard CLI
# Usage: adguardctl <command> [args]

set -e

API_SOCKET="/run/secubox/ad-guard.sock"
API_BASE="http://localhost"

# Helper to call API via Unix socket
api_call() {
    local method="$1"
    local endpoint="$2"
    shift 2
    curl -s --unix-socket "$API_SOCKET" -X "$method" "${API_BASE}${endpoint}" "$@"
}

case "${1:-help}" in
    status)
        api_call GET /status | python3 -m json.tool
        ;;

    stats)
        api_call GET /stats -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    stats-by-type)
        api_call GET /stats/by-device-type -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    devices)
        api_call GET /devices -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    check)
        if [ -z "$2" ]; then
            echo "Usage: adguardctl check <domain>"
            exit 1
        fi
        api_call GET "/check/$2" | python3 -m json.tool
        ;;

    top)
        limit="${2:-50}"
        api_call GET "/blocklist/top?limit=$limit" -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    update)
        echo "Updating blocklists..."
        api_call POST /blocklist/update -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    block)
        if [ -z "$2" ]; then
            echo "Usage: adguardctl block <domain> [category]"
            exit 1
        fi
        domain="$2"
        category="${3:-advertising}"
        api_call POST "/blocklist/add?domain=$domain&category=$category" -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    unblock)
        if [ -z "$2" ]; then
            echo "Usage: adguardctl unblock <domain>"
            exit 1
        fi
        api_call DELETE "/blocklist/$2" -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    delay)
        if [ -z "$2" ] || [ -z "$3" ]; then
            echo "Usage: adguardctl delay <domain> <reason> [hours]"
            exit 1
        fi
        domain="$2"
        reason="$3"
        hours="${4:-24}"
        api_call POST "/delayed?domain=$domain&reason=$reason&delay_hours=$hours" -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    delayed)
        api_call GET /delayed -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    approve)
        if [ -z "$2" ]; then
            echo "Usage: adguardctl approve <domain>"
            exit 1
        fi
        api_call POST "/delayed/$2/approve" -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    process)
        api_call POST /delayed/process -H "Authorization: Bearer $(cat /run/secubox/jwt 2>/dev/null || echo '')" | python3 -m json.tool
        ;;

    help|--help|-h|*)
        cat <<EOF
SecuBox Ad Guard CLI

Usage: adguardctl <command> [args]

Commands:
  status              Show service status
  stats               Show overall statistics
  stats-by-type       Show statistics by device type
  devices             List all tracked devices
  check <domain>      Check if domain is blocked
  top [limit]         Show top blocked domains (default: 50)
  update              Update blocklists from sources
  block <domain>      Add domain to blocklist immediately
  unblock <domain>    Remove domain from blocklist
  delay <domain> <reason> [hours]
                      Queue domain for delayed blocking
  delayed             List pending delayed blocks
  approve <domain>    Approve a delayed block
  process             Process due delayed blocks

Examples:
  adguardctl check doubleclick.net
  adguardctl block ads.example.com tracking
  adguardctl delay suspicious.com "High traffic to unknown service" 48
  adguardctl stats-by-type
EOF
        ;;
esac
