#!/system/bin/sh
# CellGuard WebUI backend. Emits one JSON line per command. Two independent
# toggles, each a flag file honored by its daemon:
#   block  -> $CG/enabled         (ratlock.sh: force LTE+5G, block 2G/3G)
#   detect -> $CG/detect_enabled  (cgdetect.sh: IMSI-catcher detection)
CG=/data/adb/cellguard
BLOCK="$CG/enabled"
DETECT="$CG/detect_enabled"
STATUS="$CG/status"
ALERTS="$CG/alerts"
mkdir -p "$CG"

esc() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/[[:cntrl:]]//g'; }
kv()  { grep -m1 "^$1=" "$STATUS" 2>/dev/null | cut -d= -f2-; }

case "$1" in
  block)  [ "$2" = on ] && echo 1 > "$BLOCK"  || echo 0 > "$BLOCK";  printf '{"ok":true}\n' ;;
  detect) [ "$2" = on ] && echo 1 > "$DETECT" || echo 0 > "$DETECT"; printf '{"ok":true}\n' ;;
  status)
    b=1; [ "$(cat "$BLOCK"  2>/dev/null)" = 0 ] && b=0
    d=1; [ "$(cat "$DETECT" 2>/dev/null)" = 0 ] && d=0
    allow=""
    for s in 0 1; do v=$(cmd phone get-allowed-network-types-for-users -s "$s" 2>/dev/null); [ -n "$v" ] && allow="$v"; done
    lock=false; case "$allow" in *GSM*|*WCDMA*|*UMTS*|*CDMA*) lock=false;; *LTE*|*NR*) lock=true;; esac
    printf '{"ok":true,"block":%s,"detect":%s,"lock":%s,"rat":"%s","plmn":"%s","operator":"%s","ci":"%s","pci":"%s","tac":"%s","earfcn":"%s","frames":"%s","suspect":"%s","allowed":"%s"}\n' \
      "$b" "$d" "$lock" "$(esc "$(kv rat)")" "$(esc "$(kv plmn)")" "$(esc "$(kv operator)")" \
      "$(esc "$(kv ci)")" "$(esc "$(kv pci)")" "$(esc "$(kv tac)")" "$(esc "$(kv earfcn)")" \
      "$(esc "$(kv frames)")" "$(esc "$(kv suspect)")" "$(esc "$allow")"
    ;;
  alerts)
    printf '{"ok":true,"lines":['
    first=1
    tail -n 25 "$ALERTS" 2>/dev/null | while IFS= read -r l; do
      [ "$first" = 1 ] || printf ','; first=0
      printf '"%s"' "$(esc "$l")"
    done
    printf ']}\n'
    ;;
  *) printf '{"ok":false,"error":"usage: block on|off | detect on|off | status | alerts"}\n' ;;
esac