import type { Context } from 'hono'
import { ipRestriction } from 'hono/ip-restriction'

/** Returns whether a value is an IPv4/IPv6 address or CIDR range. */
export function isRule(value: string): boolean {
  if (value === '*' || value.trim() !== value || value.split('/').length > 2) return false
  try {
    ipRestriction(() => '', { allowList: [value] })
    return true
  } catch {
    return false
  }
}

/** Returns whether the client address matches at least one allowlist rule. */
export async function allows(c: Context, options: allows.Options): Promise<boolean> {
  const { address, rules } = options
  if (!address) return false
  try {
    const denied = await ipRestriction(
      () => address,
      { allowList: [...rules] },
      () => new Response(null, { status: 403 }),
    )(c, async () => {})
    return denied === undefined
  } catch {
    return false
  }
}

export declare namespace allows {
  /** Inputs used to check a client address. */
  type Options = {
    /** Trusted client IP address. */
    address?: string | undefined
    /** Exact IP and CIDR rules to match. */
    rules: readonly string[]
  }
}