use anyhow::{Context, Result};

use crate::opkg::PkgManager;
use crate::tollgate::TollGateConfig;
use crate::Router;

/// Install and configure NoDogSplash — the captive-portal engine that
/// `tollgate-wrt` delegates all MAC authorization and gate open/close to via
/// `ndsctl`. `tollgate-wrt` contains no firewall/netfilter code of its own
/// (confirmed: its binary has no `nft`/`ipset`/`iptables` calls at all); the
/// upstream package therefore hard-depends on `+nodogsplash` and its postinst
/// restarts it. Without NoDogSplash actually running, nothing blocks
/// unauthenticated clients from reaching the internet, regardless of what
/// TollGate itself is configured to charge.
///
/// Gates the dedicated `br-tollgate` bridge (see `wifi::provision_network`),
/// not `br-lan` — the paid SSID here lives on its own isolated network/subnet
/// rather than the canonical upstream layout where it's bridged into `lan`.
pub fn provision(router: &Router, pkg_mgr: PkgManager, cfg: &TollGateConfig) -> Result<()> {
    router
        .install_package(pkg_mgr, "nodogsplash")
        .context("install nodogsplash — required by tollgate-wrt for client gating")?;

    router.run_ok("touch /etc/config/nodogsplash")?;
    router.uci_set("nodogsplash.main", "nodogsplash")?;
    router.uci_set("nodogsplash.main.enabled", "1")?;
    router.uci_set("nodogsplash.main.gatewayinterface", "br-tollgate")?;
    router.uci_set("nodogsplash.main.gatewayname", &format!("{} Portal", cfg.ssid))?;
    router.uci_set("nodogsplash.main.gatewaydomainname", "TollGate.lan")?;
    router.uci_set("nodogsplash.main.gatewayport", "2050")?;

    // Pre-auth "walled garden": unauthenticated clients must still be able to
    // reach the TollGate payment endpoint (2121) and the splash portal itself
    // (2050) — everything else is blocked by NoDogSplash until ndsctl
    // authorizes their MAC. Rebuild the list each run rather than trying to
    // dedupe, so repeated provisioning stays idempotent.
    let _ = router.uci_delete("nodogsplash.main.users_to_router");
    router.uci_add_list("nodogsplash.main.users_to_router", "allow tcp port 2121")?;
    router.uci_add_list("nodogsplash.main.users_to_router", "allow tcp port 2050")?;

    router.uci_commit(Some("nodogsplash"))?;
    Ok(())
}

/// (Re)start the nodogsplash service so config changes and gate state take effect.
pub fn restart(router: &Router) -> Result<()> {
    router.run_ok("/etc/init.d/nodogsplash enable")?;
    router.run_ok("/etc/init.d/nodogsplash restart || /etc/init.d/nodogsplash start")?;
    Ok(())
}