<?php
namespace Modules\Security\Services;
use Modules\Security\Models\IpRule;
final class IpRuleService
{
    public function isBlocked(string $ip, string $scope='admin'): bool
    {
        $column=$scope==='login'?'applies_to_login':'applies_to_admin';
        $rules=IpRule::query()->where('is_active',true)->where($column,true)->get();
        $allow=$rules->where('type','allow');
        if ($allow->isNotEmpty() && !$allow->contains(fn(IpRule $rule)=>$this->matches($ip,$rule->address))) return true;
        return $rules->where('type','deny')->contains(fn(IpRule $rule)=>$this->matches($ip,$rule->address));
    }
    private function matches(string $ip,string $rule): bool
    {
        if ($ip===$rule) return true;
        if (!str_contains($rule,'/')) return false;
        [$subnet,$bits]=explode('/',$rule,2); $bits=(int)$bits;
        if (filter_var($ip,FILTER_VALIDATE_IP,FILTER_FLAG_IPV4) && filter_var($subnet,FILTER_VALIDATE_IP,FILTER_FLAG_IPV4)) {
            $mask=-1 << (32-$bits); return (ip2long($ip)&$mask)===(ip2long($subnet)&$mask);
        }
        return false;
    }
}