#!/bin/bash
# Vérifie les filtres fail2ban custom avec fail2ban-regex et des logs d'exemple.
# Usage: scripts/test-fail2ban-filters.sh

set -euo pipefail

REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
FILTER_DIR="$REPO_DIR/generic/fail2ban/filter.d"
FIXTURE_DIR="$REPO_DIR/tests/fail2ban-filters"

if ! command -v fail2ban-regex >/dev/null 2>&1; then
    echo "fail2ban-regex introuvable (paquet fail2ban) — impossible de lancer les tests." >&2
    exit 1
fi

# filtre:fichier_log:nombre_attendu_de_lignes_bannies
CASES=(
    "coturn:coturn.log:3"
    "mosquitto:mosquitto.log:2"
    "openvpn:openvpn.log:4"
    "recidive-filter:recidive.log:2"
)

failed=0

for case in "${CASES[@]}"; do
    IFS=':' read -r filter logfile expected <<< "$case"
    output="$(fail2ban-regex "$FIXTURE_DIR/$logfile" "$FILTER_DIR/$filter.conf" 2>&1)"
    matched="$(echo "$output" | sed -n 's/.*, \([0-9]\+\) matched,.*/\1/p' | head -n1)"

    if [ "$matched" = "$expected" ]; then
        echo "[OK]   $filter : $matched/$expected lignes bannies"
    else
        echo "[FAIL] $filter : $matched/$expected lignes bannies attendues"
        echo "$output"
        failed=1
    fi
done

exit $failed