import Foundation

public struct FirewallRule: Codable, Hashable, Sendable {
    public let port: UInt16
    public let source: MeshAddress?
    public init(port: UInt16, source: MeshAddress?) { self.port = port; self.source = source }
}

public final class MeshFirewall: @unchecked Sendable {
    private var rules: Set<FirewallRule>
    private let lock = NSLock()
    public init(rules: Set<FirewallRule> = []) { self.rules = rules }

    public func allows(port: UInt16, source: MeshAddress) -> Bool {
        lock.lock(); defer { lock.unlock() }
        return rules.contains(FirewallRule(port: port, source: nil)) || rules.contains(FirewallRule(port: port, source: source))
    }
    public func allow(port: UInt16, source: MeshAddress?) { lock.lock(); rules.insert(.init(port: port, source: source)); lock.unlock() }
    public func revoke(port: UInt16, source: MeshAddress?) { lock.lock(); rules.remove(.init(port: port, source: source)); lock.unlock() }
    public func allRules() -> [FirewallRule] { lock.lock(); defer { lock.unlock() }; return rules.sorted { $0.port < $1.port } }
}