#!/usr/bin/env bash
set -Eeuo pipefail
IFS=$'\n\t'

fail() { printf '%s\n' "policy helper: $*" >&2; exit 78; }

[[ ${EUID:-$(id -u)} -eq 0 ]] || fail "root is required"
action="${1:-}"
case "$action" in
    link-connect)
        [[ $# -eq 6 ]] || fail "invalid link-connect argument count"
        ;;
    link-disconnect)
        [[ $# -eq 5 ]] || fail "invalid link-disconnect argument count"
        ;;
    *) fail "unsupported action" ;;
esac

node_pattern='^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$'
[[ "$2" =~ $node_pattern && "$3" =~ $node_pattern ]] || fail "invalid node id"
[[ "$4" == "tcp" || "$4" == "udp" ]] || fail "invalid protocol"
[[ "$5" =~ ^[0-9]+$ ]] && (( 10#$5 >= 1 && 10#$5 <= 65535 )) || fail "invalid port"
if [[ "$action" == "link-connect" ]]; then
    [[ "$6" =~ ^[0-9]+$ ]] && (( 10#$6 >= 1 && 10#$6 <= 10080 )) || fail "invalid TTL"
fi

fail "WireGuard/nftables data-plane configuration is not installed yet"