#!/usr/bin/env bash
# Intentional denylist of the existing production product. This file is read by
# the Learnitive installer only to refuse collisions; it must never mutate any
# target declared here.
set -euo pipefail

readonly PROTECTED_INTERACTIVE_SHELL_SITE_ROOT='/var/www/interactiveshell.com'
readonly PROTECTED_INTERACTIVE_SHELL_CONFIG_ROOT='/etc/interactiveshell'
readonly PROTECTED_INTERACTIVE_SHELL_DATABASE='interactiveshell_os'
readonly -a PROTECTED_INTERACTIVE_SHELL_PORTS=(3210 3211 6387 8887 8890 8892)
readonly -a PROTECTED_INTERACTIVE_SHELL_SUBNETS=(
  '172.31.250.0/24'
  '172.31.251.0/24'
  '172.31.252.0/24'
  '172.31.253.0/24'
)

learnitive_assert_interactive_shell_isolation() {
  local app_root="$1" site_root="$2" config_root="$3" database="$4"
  [[ "$app_root" != "$PROTECTED_INTERACTIVE_SHELL_SITE_ROOT"* ]] || return 1
  [[ "$site_root" != "$PROTECTED_INTERACTIVE_SHELL_SITE_ROOT"* ]] || return 1
  [[ "$config_root" != "$PROTECTED_INTERACTIVE_SHELL_CONFIG_ROOT"* ]] || return 1
  [[ "$database" != "$PROTECTED_INTERACTIVE_SHELL_DATABASE" ]] || return 1
  return 0
}

learnitive_port_is_protected() {
  local requested="$1" port
  for port in "${PROTECTED_INTERACTIVE_SHELL_PORTS[@]}"; do
    [[ "$requested" == "$port" ]] && return 0
  done
  return 1
}

learnitive_subnet_is_protected() {
  local requested="$1" subnet
  for subnet in "${PROTECTED_INTERACTIVE_SHELL_SUBNETS[@]}"; do
    [[ "$requested" == "$subnet" ]] && return 0
  done
  return 1
}