#!/usr/bin/env bash
set -euo pipefail

DENYLIST="/etc/edge/asn-denylist.txt"
ALLOWLIST="/etc/edge/asn-allowlist-v4.txt"
TMP="/tmp/asn_prefixes_v4.txt"
SETDENY="inet filter asn_deny_v4"
SETALLOW="inet filter asn_allow_v4"
TTL="7d"

command -v nft >/dev/null
command -v curl >/dev/null
command -v jq >/dev/null

mkdir -p /etc/edge
: > "$TMP"

# Allowlist (static)
if [[ -f "$ALLOWLIST" ]]; then
  nft "flush set $SETALLOW" || true
  while read -r cidr; do
    [[ -z "${cidr}" || "${cidr:0:1}" == "#" ]] && continue
    nft "add element $SETALLOW { $cidr }" || true
  done < "$ALLOWLIST"
fi

# RIPEstat: announced prefixes for an ASN
while read -r asn; do
  [[ -z "${asn}" || "${asn:0:1}" == "#" ]] && continue
  asn="${asn#AS}"

  url="https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS${asn}"
  curl -fsS "$url"     | jq -r '.data.prefixes[]?.prefix'     | awk -F/ '$1 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/ {print $0}'     >> "$TMP"
done < "$DENYLIST"

sort -u -o "$TMP" "$TMP"

# Refresh TTL by re-adding elements
while read -r cidr; do
  nft "add element $SETDENY { $cidr timeout $TTL }" || true
done < "$TMP"

echo "ASN deny refreshed: $(wc -l < "$TMP") IPv4 prefixes (TTL=$TTL)"