vpn.go

package fortimgr

import (
	"context"
	"fmt"
)

type apiIPSecPhase1 struct {
	Name      string `json:"name"`
	Interface any    `json:"interface"`
	RemoteGW  string `json:"remote-gw"`
	Proposal  any    `json:"proposal"`
	DHGroup   any    `json:"dhgrp"`
	Mode      any    `json:"mode"`
	Type      any    `json:"type"`
	Comments  string `json:"comments"`
}

type apiIPSecPhase2 struct {
	Name       string `json:"name"`
	Phase1Name any    `json:"phase1name"`
	Proposal   any    `json:"proposal"`
	SrcSubnet  any    `json:"src-subnet"`
	DstSubnet  any    `json:"dst-subnet"`
	Comments   string `json:"comments"`
}

// ListIPSecPhase1 retrieves IPSec Phase 1 interface configurations from an ADOM.
// Pagination is applied transparently; see WithPageSize / WithPageCallback.
func (c *Client) ListIPSecPhase1(ctx context.Context, adom string, opts ...ListOption) ([]IPSecPhase1, error) {
	if !c.LoggedIn() {
		return nil, ErrNotLoggedIn
	}
	if !validName(adom) {
		return nil, fmt.Errorf("%w: %q", ErrInvalidName, adom)
	}

	apiURL := fmt.Sprintf("/pm/config/adom/%s/obj/vpn/ipsec/phase1-interface", adom)
	items, err := getPaged[apiIPSecPhase1](ctx, c, apiURL, nil, buildListConfig(opts))
	if err != nil {
		return nil, err
	}

	tunnels := make([]IPSecPhase1, len(items))
	for i, p := range items {
		tunnels[i] = IPSecPhase1{
			Name:      p.Name,
			Interface: toString(p.Interface),
			RemoteGW:  p.RemoteGW,
			Proposal:  toString(p.Proposal),
			DHGroup:   toString(p.DHGroup),
			Mode:      mapEnum(toString(p.Mode), ipsecModes),
			Type:      mapEnum(toString(p.Type), ipsecTypes),
			Comments:  p.Comments,
		}
	}

	return tunnels, nil
}

// IPSecTunnel is a type alias for IPSecPhase1 matching FortiGate GUI
// terminology (phase1-interface → "VPN tunnel"). The field set is
// identical; use ListIPSecTunnels as the preferred entry point.
type IPSecTunnel = IPSecPhase1

// ListIPSecTunnels is a friendlier alias for ListIPSecPhase1. It returns
// IPSec Phase 1 interface configurations (tunnels, in FortiGate GUI terms).
// Shares all logic with ListIPSecPhase1 — IPSecTunnel is a type alias.
// Pagination options pass through to ListIPSecPhase1.
func (c *Client) ListIPSecTunnels(ctx context.Context, adom string, opts ...ListOption) ([]IPSecTunnel, error) {
	return c.ListIPSecPhase1(ctx, adom, opts...)
}

// ListIPSecSelectors returns IPSec quick-mode selectors (Phase 2 entries,
// called "VPN selectors" in the FortiGate GUI), each bound to a parent
// tunnel via the Tunnel field. IPSecSelector is a distinct type from
// IPSecPhase2 so the Phase1Name -> Tunnel rename does not break existing
// ListIPSecPhase2 callers. Both share the same API fetch and transformation
// — this function delegates to ListIPSecPhase2 and re-labels the result.
// Pagination options pass through to ListIPSecPhase2.
func (c *Client) ListIPSecSelectors(ctx context.Context, adom string, opts ...ListOption) ([]IPSecSelector, error) {
	phases, err := c.ListIPSecPhase2(ctx, adom, opts...)
	if err != nil {
		return nil, err
	}
	selectors := make([]IPSecSelector, len(phases))
	for i, p := range phases {
		selectors[i] = IPSecSelector{
			Name:      p.Name,
			Tunnel:    p.Phase1Name,
			Proposal:  p.Proposal,
			SrcSubnet: p.SrcSubnet,
			DstSubnet: p.DstSubnet,
			Comments:  p.Comments,
		}
	}
	return selectors, nil
}

// ListIPSecPhase2 retrieves IPSec Phase 2 interface configurations from an ADOM.
// Pagination is applied transparently; see WithPageSize / WithPageCallback.
func (c *Client) ListIPSecPhase2(ctx context.Context, adom string, opts ...ListOption) ([]IPSecPhase2, error) {
	if !c.LoggedIn() {
		return nil, ErrNotLoggedIn
	}
	if !validName(adom) {
		return nil, fmt.Errorf("%w: %q", ErrInvalidName, adom)
	}

	apiURL := fmt.Sprintf("/pm/config/adom/%s/obj/vpn/ipsec/phase2-interface", adom)
	items, err := getPaged[apiIPSecPhase2](ctx, c, apiURL, nil, buildListConfig(opts))
	if err != nil {
		return nil, err
	}

	tunnels := make([]IPSecPhase2, len(items))
	for i, p := range items {
		tunnels[i] = IPSecPhase2{
			Name:       p.Name,
			Phase1Name: toString(p.Phase1Name),
			Proposal:   toString(p.Proposal),
			SrcSubnet:  formatSubnet(p.SrcSubnet),
			DstSubnet:  formatSubnet(p.DstSubnet),
			Comments:   p.Comments,
		}
	}

	return tunnels, nil
}