#!/usr/bin/env bash
# perf/nuisance/nuisance-detect.sh — HOST-side nuisance candidate detection [#796]
#
# Runs on the Cloudron host (systemd timer, 07:15 CDT daily + at boot).
# No secrets, no API: scans the mail container's Haraka log for sources
# DENIED via zen.spamhaus.org in the last 24h and writes a ranked
# candidates file the daily automation cross-checks. Detection is
# independent of the LLM automation; enforcement stays in
# nuisance-sweep.sh (Cloudron blocklist API).
#
# Output: /home/yellowtent/platformdata/nuisance/candidates.txt
#   lines: <hits24h> <ip> <BLOCKED|seen>   (BLOCKED = already in ipset)

set -u

OUT_DIR=/home/yellowtent/platformdata/nuisance
OUT="$OUT_DIR/candidates.txt"
SET_NAME=cloudron_blocklist

mkdir -p "$OUT_DIR"
TMP=$(mktemp) || exit 1
trap 'rm -f "$TMP"' EXIT

docker logs mail --since 24h 2>&1 \
    | grep -a "plugin=dns-list" \
    | grep -a "retval=DENY" \
    | grep -aoE "host \[[0-9.]+\]" \
    | sed "s/^host \[//; s/\]$//" | sort | uniq -c | sort -rn > "$TMP"

{
    printf '# nuisance candidates — Haraka spamhaus-DENY sources, 24h, generated %s\n' \
        "$(date '+%F %T %Z')"
    printf '# format: <hits24h> <ip> <BLOCKED|seen>  (BLOCKED = covered by %s)\n' "$SET_NAME"
    while read -r hits ip; do
        [ -n "$ip" ] || continue
        if ipset test "$SET_NAME" "$ip" > /dev/null 2>&1; then
            state=BLOCKED
        else
            state=seen
        fi
        printf '%s %s %s\n' "$hits" "$ip" "$state"
    done < "$TMP"
} > "$OUT"