#!/bin/sh
set -eu

STATE_DIR=/var/lib/lan-ssh
RULE_FILE=/run/lan-ssh.rule

require_root() {
    if [ "$(id -u)" -ne 0 ]; then
        echo "Execute com sudo: sudo lan-ssh $*" >&2
        exit 1
    fi
}

default_interface() {
    ip -4 route show default | awk 'NR == 1 {print $5}'
}

interface_from_args() {
    requested=""
    while [ "$#" -gt 0 ]; do
        case "$1" in
            --interface) requested=${2:-}; shift 2 ;;
            *) echo "Argumento inválido: $1" >&2; exit 2 ;;
        esac
    done
    if [ -n "$requested" ]; then
        printf '%s\n' "$requested"
    elif [ -f "$STATE_DIR/interface" ]; then
        sed -n '1p' "$STATE_DIR/interface"
    else
        default_interface
    fi
}

subnet_for() {
    ip -o -4 route show dev "$1" proto kernel scope link | awk 'NR == 1 {print $1}'
}

remove_previous_rule() {
    if [ -f "$RULE_FILE" ]; then
        rule=$(sed -n '1p' "$RULE_FILE")
        iface=${rule%% *}
        subnet=${rule#* }
        if [ -n "$iface" ] && [ "$subnet" != "$rule" ]; then
            ufw --force delete allow in on "$iface" from "$subnet" \
                to any port 22 proto tcp >/dev/null 2>&1 || true
        fi
        rm -f "$RULE_FILE"
    fi
}

activate() {
    iface=$(interface_from_args "$@")
    subnet=$(subnet_for "$iface")
    if [ -z "$iface" ] || [ -z "$subnet" ]; then
        echo "Não foi possível determinar a LAN da rota padrão." >&2
        exit 1
    fi
    remove_previous_rule
    ufw allow in on "$iface" from "$subnet" to any port 22 proto tcp comment lan-ssh
    printf '%s %s\n' "$iface" "$subnet" >"$RULE_FILE"
    if ! systemctl start ssh.socket; then
        remove_previous_rule
        systemctl stop ssh.service >/dev/null 2>&1 || true
        echo "Não foi possível abrir o socket SSH; regra LAN removida." >&2
        exit 1
    fi
    echo "SSH aberto somente em $subnet pela interface $iface."
}

case "${1:-}" in
    up)
        require_root "$@"; shift
        mkdir -p "$STATE_DIR"
        iface=$(interface_from_args "$@")
        printf '%s\n' "$iface" >"$STATE_DIR/interface"
        systemctl enable lan-ssh.service >/dev/null
        systemctl restart lan-ssh.service
        ;;
    activate)
        require_root "$@"; shift; activate "$@"
        ;;
    down)
        require_root "$@"
        systemctl disable lan-ssh.service >/dev/null 2>&1 || true
        systemctl stop lan-ssh.service >/dev/null 2>&1 || true
        remove_previous_rule
        systemctl disable --now ssh.socket >/dev/null 2>&1 || true
        systemctl stop ssh.service >/dev/null 2>&1 || true
        rm -rf "$STATE_DIR"
        echo "SSH fechado."
        ;;
    status)
        systemctl --no-pager status lan-ssh.service || true
        if [ -f "$RULE_FILE" ]; then
            echo "Regra ativa: $(sed -n '1p' "$RULE_FILE")"
        else
            echo "Nenhuma regra LAN ativa."
        fi
        ;;
    *)
        echo "Uso: sudo lan-ssh up [--interface IFACE] | down | status" >&2
        exit 2
        ;;
esac
