#!/usr/bin/env bash
# Open or close a TCP port in UFW (defaults to the app port 4455).
#
# Usage:
#   sudo ./scripts/firewall.sh open  [port]    # allow inbound
#   sudo ./scripts/firewall.sh close [port]    # deny inbound
#   sudo ./scripts/firewall.sh reset [port]    # remove both rules for the port
#   ./scripts/firewall.sh status               # show UFW status
set -euo pipefail

PORT="${2:-4455}"
ACTION="${1:-}"

command -v ufw >/dev/null 2>&1 || { echo "ufw is not installed" >&2; exit 1; }

# Every action except plain 'status' needs root.
if [ "$ACTION" != "status" ] && [ "$(id -u)" -ne 0 ]; then
  echo "This needs root — re-run with sudo." >&2
  exit 1
fi

case "$ACTION" in
  open)
    echo "==> Opening ${PORT}/tcp"
    ufw allow "${PORT}/tcp"
    ;;
  close)
    echo "==> Closing ${PORT}/tcp (deny)"
    ufw deny "${PORT}/tcp"
    ;;
  reset)
    echo "==> Removing allow/deny rules for ${PORT}/tcp"
    ufw delete allow "${PORT}/tcp" 2>/dev/null || true
    ufw delete deny  "${PORT}/tcp" 2>/dev/null || true
    ;;
  status|"")
    ufw status verbose
    exit 0
    ;;
  *)
    echo "Usage: sudo $0 {open|close|reset|status} [port]" >&2
    exit 2
    ;;
esac

echo
ufw status | grep -E "To|${PORT}" || true