package firewall

// FilterRule represents a MikroTik-style /ip firewall filter rule
type FilterRule struct {
	ID              string   `json:"id"`
	Order           int      `json:"order"`
	Chain           string   `json:"chain"` // input, forward, output, or custom
	Action          string   `json:"action"` // accept, drop, reject, return, jump, log, passthrough
	RejectWith      string   `json:"reject_with,omitempty"` // icmp-network-unreachable, icmp-host-unreachable, tcp-reset, etc.
	JumpTarget      string   `json:"jump_target,omitempty"`
	SrcAddress      string   `json:"src_address,omitempty"` // e.g. 192.168.1.0/24, !10.0.0.1
	DstAddress      string   `json:"dst_address,omitempty"`
	Protocol        string   `json:"protocol,omitempty"` // all, tcp, udp, icmp, etc.
	SrcPort         string   `json:"src_port,omitempty"` // e.g. 80, 80-443, 80,443
	DstPort         string   `json:"dst_port,omitempty"`
	InInterface     string   `json:"in_interface,omitempty"` // e.g. eth0, !eth0, wg0
	OutInterface    string   `json:"out_interface,omitempty"`
	ConnectionState []string `json:"connection_state,omitempty"` // new, established, related, invalid, untracked
	ConnectionMark  string   `json:"connection_mark,omitempty"`
	RoutingMark     string   `json:"routing_mark,omitempty"`
	SrcAddressList  string   `json:"src_address_list,omitempty"`
	DstAddressList  string   `json:"dst_address_list,omitempty"`
	Log             bool     `json:"log"`
	LogPrefix       string   `json:"log_prefix,omitempty"`
	Comment         string   `json:"comment,omitempty"`
	Disabled        bool     `json:"disabled"`
	Packets         uint64   `json:"packets"`
	Bytes           uint64   `json:"bytes"`
}

// NATRule represents a MikroTik-style /ip firewall nat rule
type NATRule struct {
	ID             string `json:"id"`
	Order          int    `json:"order"`
	Chain          string `json:"chain"` // srcnat, dstnat
	Action         string `json:"action"` // masquerade, src-nat, dst-nat, redirect, accept, return
	ToAddresses    string `json:"to_addresses,omitempty"` // for src-nat or dst-nat
	ToPorts        string `json:"to_ports,omitempty"` // for dst-nat, redirect, src-nat
	SrcAddress     string `json:"src_address,omitempty"`
	DstAddress     string `json:"dst_address,omitempty"`
	Protocol       string `json:"protocol,omitempty"`
	SrcPort        string `json:"src_port,omitempty"`
	DstPort        string `json:"dst_port,omitempty"`
	InInterface    string `json:"in_interface,omitempty"`
	OutInterface   string `json:"out_interface,omitempty"`
	SrcAddressList string `json:"src_address_list,omitempty"`
	DstAddressList string `json:"dst_address_list,omitempty"`
	Comment        string `json:"comment,omitempty"`
	Disabled       bool   `json:"disabled"`
	Packets        uint64 `json:"packets"`
	Bytes          uint64 `json:"bytes"`
}

// MangleRule represents a MikroTik-style /ip firewall mangle rule
type MangleRule struct {
	ID                 string   `json:"id"`
	Order              int      `json:"order"`
	Chain              string   `json:"chain"` // prerouting, postrouting, input, output, forward
	Action             string   `json:"action"` // mark-connection, mark-routing, mark-packet, change-mss, set-dscp, accept, return
	NewConnectionMark  string   `json:"new_connection_mark,omitempty"`
	NewRoutingMark     string   `json:"new_routing_mark,omitempty"`
	NewPacketMark      string   `json:"new_packet_mark,omitempty"`
	NewMSS             string   `json:"new_mss,omitempty"` // e.g. "1440" or "clamp-to-pmtu"
	NewDSCP            int      `json:"new_dscp,omitempty"`
	Passthrough        bool     `json:"passthrough"` // default true in MikroTik
	SrcAddress         string   `json:"src_address,omitempty"`
	DstAddress         string   `json:"dst_address,omitempty"`
	Protocol           string   `json:"protocol,omitempty"`
	SrcPort            string   `json:"src_port,omitempty"`
	DstPort            string   `json:"dst_port,omitempty"`
	InInterface        string   `json:"in_interface,omitempty"`
	OutInterface       string   `json:"out_interface,omitempty"`
	ConnectionState    []string `json:"connection_state,omitempty"`
	ConnectionMark     string   `json:"connection_mark,omitempty"`
	RoutingMark        string   `json:"routing_mark,omitempty"`
	SrcAddressList     string   `json:"src_address_list,omitempty"`
	DstAddressList     string   `json:"dst_address_list,omitempty"`
	Comment            string   `json:"comment,omitempty"`
	Disabled           bool     `json:"disabled"`
	Packets            uint64   `json:"packets"`
	Bytes              uint64   `json:"bytes"`
}

// AddressListEntry represents a MikroTik /ip firewall address-list entry
type AddressListEntry struct {
	ID       string `json:"id"`
	Name     string `json:"name"`    // list name, e.g. "LAN_Subnets", "Blocked"
	Address  string `json:"address"` // IP or CIDR, e.g. "192.168.1.0/24"
	Comment  string `json:"comment,omitempty"`
	Disabled bool   `json:"disabled"`
}

// ActiveConnection represents an active flow from /proc/net/nf_conntrack / conntrack table
type ActiveConnection struct {
	ID               string `json:"id"`
	Protocol         string `json:"protocol"`
	SrcAddress       string `json:"src_address"`
	SrcPort          int    `json:"src_port"`
	DstAddress       string `json:"dst_address"`
	DstPort          int    `json:"dst_port"`
	ReplySrcAddress  string `json:"reply_src_address"`
	ReplySrcPort     int    `json:"reply_src_port"`
	ReplyDstAddress  string `json:"reply_dst_address"`
	ReplyDstPort     int    `json:"reply_dst_port"`
	TCPState         string `json:"tcp_state"`
	Timeout          int    `json:"timeout"`
	ConnectionMark   string `json:"connection_mark,omitempty"`
	Assured          bool   `json:"assured"`
	Bytes            uint64 `json:"bytes,omitempty"`
	Packets          uint64 `json:"packets,omitempty"`
}

// FirewallSummary contains total rule and connection counts
type FirewallSummary struct {
	FilterRulesCount   int `json:"filter_rules_count"`
	NATRulesCount      int `json:"nat_rules_count"`
	MangleRulesCount   int `json:"mangle_rules_count"`
	AddressListsCount  int `json:"address_lists_count"`
	ActiveConnections  int `json:"active_connections"`
}