#!/bin/bash
# alpha-settings — system-level settings the panel can change (root-owned,
# NOPASSWD sudoers). Validated fixed actions only.
#   timezone <Area/City>        set system timezone (validated against tzdb)
#   f2b-maxretry <1-50>         set the alpha-panel login-attempt limit
#   f2b-bantime <secs|-1>       set the alpha-panel lockout duration (-1=permanent)
set -euo pipefail
ACTION="${1:-}"; ARG="${2:-}"

# Rewrite one `key = value` line inside the [alpha-panel] section of the jail,
# adding it if the section has no such line yet. Shared by maxretry + bantime.
f2b_set() {
  local key="$1" val="$2" f=/etc/fail2ban/jail.d/alpha.local
  [ -f "$f" ] || { echo "NO_JAIL"; exit 3; }
  awk -v k="$key" -v v="$val" '
    /^\[/ { if (sec=="[alpha-panel]" && !done) print "  " k " = " v; sec=$0; done=0 }
    sec=="[alpha-panel]" && $0 ~ "^[[:space:]]*" k "[[:space:]]*=" { print "  " k " = " v; done=1; next }
    { print }
    END { if (sec=="[alpha-panel]" && !done) print "  " k " = " v }
  ' "$f" > "$f.tmp" && mv "$f.tmp" "$f"
  systemctl reload fail2ban 2>/dev/null || systemctl restart fail2ban 2>/dev/null || true
}

case "$ACTION" in
  timezone)
    timedatectl list-timezones 2>/dev/null | grep -qxF "$ARG" || { echo "BAD_TZ"; exit 2; }
    timedatectl set-timezone "$ARG" && echo "OK"
    ;;
  f2b-maxretry)
    [[ "$ARG" =~ ^[0-9]{1,2}$ ]] && [ "$ARG" -ge 1 ] && [ "$ARG" -le 50 ] || { echo "BAD_N"; exit 2; }
    f2b_set maxretry "$ARG"
    echo "OK"
    ;;
  f2b-bantime)
    # seconds (60..604800) or -1 for permanent
    [[ "$ARG" =~ ^-?[0-9]+$ ]] || { echo "BAD_N"; exit 2; }
    if [ "$ARG" != "-1" ]; then [ "$ARG" -ge 60 ] && [ "$ARG" -le 604800 ] || { echo "BAD_N"; exit 2; }; fi
    f2b_set bantime "$ARG"
    echo "OK"
    ;;
  *) echo "BAD_ACTION"; exit 1 ;;
esac
