#!/bin/bash
# wg-policy-cleanup.sh — Clean removal of all policy artifacts
# Fixed: proper loop, ipset cleanup, IPv6 cleanup

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/wg-policy-lib.sh"

main() {
    log_info "Starting cleanup..."

    # === IPv4 chain cleanup ===
    local removed=0
    while iptables -D FORWARD -i "$WG_IF" -j "$CHAIN" 2>/dev/null; do
        (( removed++ ))
    done

    if (( removed > 0 )); then
        log_info "Removed $removed FORWARD references"
    fi

    iptables -F "$CHAIN" 2>/dev/null || true
    iptables -X "$CHAIN" 2>/dev/null || true

    # Cleanup backup chain too
    iptables -F "$CHAIN_BACKUP" 2>/dev/null || true
    iptables -X "$CHAIN_BACKUP" 2>/dev/null || true

    # === IPv6 chain cleanup ===
    if command -v ip6tables &>/dev/null; then
        while ip6tables -D FORWARD -i "$WG_IF" -j "$CHAIN" 2>/dev/null; do :; done
        ip6tables -F "$CHAIN" 2>/dev/null || true
        ip6tables -X "$CHAIN" 2>/dev/null || true
        ip6tables -F "$CHAIN_BACKUP" 2>/dev/null || true
        ip6tables -X "$CHAIN_BACKUP" 2>/dev/null || true
    fi

    # === ipset cleanup ===
    destroy_ipset "$IPSET_V4" 2>/dev/null || true
    destroy_ipset "$IPSET_V6" 2>/dev/null || true
    destroy_ipset "${IPSET_V4}_bak" 2>/dev/null || true
    destroy_ipset "${IPSET_V6}_bak" 2>/dev/null || true

    # === Lock cleanup ===
    rm -f "$LOCK_FILE" 2>/dev/null || true

    log_info "Cleanup complete"
}

main "$@"