import re

from fastapi import Request, status
from fastapi.responses import Response

BLOCKED_PATHS = {
    "/",
    "/metrics",
    "/security.txt",
    "/.env",
    "/wp-admin",
    "/wp-login.php",
    "/admin",
    "/config",
    "/actuator",
    "/nice%20ports%2C/Trinity.txt.bak",
}

BLOCKED_UA_PATTERNS = re.compile(
    r"(nmap|nikto|masscan|zgrab|censys|shodan|nuclei|httpx|gobuster|dirbuster)",
    re.IGNORECASE,
)


async def block_scanners(request: Request, call_next):
    path = request.url.path
    ua = request.headers.get("user-agent", "")

    if (
        path.startswith("/v1/")
        or path.startswith("/v2/")
        or path in ("/health", "/dados_retorno", "/token")
    ):
        return await call_next(request)

    if path in BLOCKED_PATHS or path.endswith((".bak", ".env", ".git", ".php")):
        return Response(status_code=status.HTTP_403_FORBIDDEN)

    if BLOCKED_UA_PATTERNS.search(ua):
        return Response(status_code=status.HTTP_403_FORBIDDEN)

    if not ua:
        return Response(status_code=status.HTTP_403_FORBIDDEN)

    return await call_next(request)