#!/bin/bash

# Apply Pangolin security rules to your instance
# Requires PANGOLIN_KEY environment variable

set -e

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

RULES_FILE="pangolin-security-rules.toml"
PANGOLIN_API="https://api.pangolin.net/v1"

if [ -z "$PANGOLIN_KEY" ]; then
    echo -e "${RED}Error: PANGOLIN_KEY environment variable not set${NC}"
    echo "Export your Pangolin API key first:"
    echo "  export PANGOLIN_KEY=<your-api-key>"
    exit 1
fi

if [ ! -f "$RULES_FILE" ]; then
    echo -e "${RED}Error: $RULES_FILE not found${NC}"
    echo "Run this script from the towerops project root"
    exit 1
fi

echo -e "${BLUE}Uploading Pangolin security rules...${NC}"
echo ""

# Upload rules
response=$(curl -s -X POST \
    -H "Authorization: Bearer $PANGOLIN_KEY" \
    -H "Content-Type: application/toml" \
    --data-binary "@$RULES_FILE" \
    "$PANGOLIN_API/rules/upload")

# Check response
if echo "$response" | grep -q '"success":true'; then
    echo -e "${GREEN}✓ Rules uploaded successfully!${NC}"
    echo ""

    # Extract rule count if available
    rule_count=$(echo "$response" | grep -o '"rule_count":[0-9]*' | grep -o '[0-9]*' || echo "unknown")
    echo -e "${BLUE}Rules deployed:${NC} $rule_count"

    echo ""
    echo -e "${BLUE}Next steps:${NC}"
    echo "1. Verify rules: curl -H \"Authorization: Bearer \$PANGOLIN_KEY\" $PANGOLIN_API/rules"
    echo "2. Monitor blocks: curl -H \"Authorization: Bearer \$PANGOLIN_KEY\" $PANGOLIN_API/logs?action=block"
    echo "3. View dashboard: https://app.pangolin.net/rules"
else
    echo -e "${RED}✗ Failed to upload rules${NC}"
    echo ""
    echo -e "${YELLOW}Response:${NC}"
    echo "$response" | jq . 2>/dev/null || echo "$response"
    exit 1
fi