#!/bin/bash
set -e

LOG_DIR="/var/log/BastionGuard"
LOG_FILE="$LOG_DIR/phishing_updater.log"
DATE=$(date '+%Y-%m-%d %H:%M:%S')
PHISH_SYS="/usr/share/BastionGuard/data/phishing"
DNSMASQ_CONF="/etc/dnsmasq.d/BastionGuard-blacklist.conf"

mkdir -p "$LOG_DIR" "$PHISH_SYS"
echo "[$DATE] Avvio aggiornamento blacklist..." >> "$LOG_FILE"

# 1. Installa blacklist da /tmp (preparate dal backend user-space)
if [[ -f "/tmp/bastionguard-blacklist.txt" ]]; then
    install -m 0644 /tmp/bastionguard-blacklist.txt \
        "$PHISH_SYS/blacklist.txt"
    echo "[$DATE] blacklist.txt installata" >> "$LOG_FILE"
fi

if [[ -f "/tmp/bastionguard-blacklist-reduce.txt" ]]; then
    install -m 0644 /tmp/bastionguard-blacklist-reduce.txt \
        "$PHISH_SYS/blacklist-reduce.txt"
fi

# 2. Merge whitelist utente → copia in sys se esiste
REAL_USER="${SUDO_USER:-$(logname 2>/dev/null || echo '')}"
if [[ -n "$REAL_USER" ]]; then
    USER_HOME=$(getent passwd "$REAL_USER" | cut -d: -f6)
    WL_TXT="$USER_HOME/.local/share/BastionGuard/phishing/whitelist.txt"
    if [[ -f "$WL_TXT" ]]; then
        install -m 0644 "$WL_TXT" "$PHISH_SYS/whitelist.txt"
        echo "[$DATE] whitelist utente copiata in sys ($WL_TXT)" >> "$LOG_FILE"
    fi
fi

# 3. Installa config dnsmasq se preparata dal backend
DNSMASQ_OK=0
if [[ -f "/tmp/BastionGuard-dnsmasq-blacklist.conf" ]]; then
    install -m 0644 /tmp/BastionGuard-dnsmasq-blacklist.conf \
        "$DNSMASQ_CONF"
    echo "[$DATE] dnsmasq conf installata" >> "$LOG_FILE"

    if dnsmasq --test > /tmp/BastionGuard-dnsmasq.log 2>&1; then
        DNSMASQ_OK=1
    else
        echo "[$DATE] ⚠ dnsmasq --test fallito, skip reload" >> "$LOG_FILE"
    fi
fi

# 4. Riavvia dnsmasq e BastionGuard-phishing-scanner in parallelo
SCANNER_ACTIVE=0
systemctl is-active --quiet BastionGuard-phishing-scanner.service && SCANNER_ACTIVE=1

if [[ "$DNSMASQ_OK" -eq 1 || "$SCANNER_ACTIVE" -eq 1 ]]; then
    [[ "$DNSMASQ_OK"      -eq 1 ]] && systemctl restart  dnsmasq                              2>/dev/null &
    [[ "$SCANNER_ACTIVE"  -eq 1 ]] && systemctl restart BastionGuard-phishing-scanner.service 2>/dev/null &
    wait

    [[ "$DNSMASQ_OK"     -eq 1 ]] && echo "[$DATE] dnsmasq ricaricato"   >> "$LOG_FILE"
    [[ "$SCANNER_ACTIVE" -eq 1 ]] && echo "[$DATE] Scanner riavviato"    >> "$LOG_FILE"
fi

echo "[$DATE] Aggiornamento completato" >> "$LOG_FILE"
exit 0