#!/bin/bash

# File paths
CAGEFS_USERS_FILE="/usr/local/ddos/cageenabled.txt"
SLACK_WEBHOOK_URL="https://hooks.slack.com/services/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"  # Replace with your actual Slack webhook URL

# Ensure the directory exists
mkdir -p /usr/local/ddos

# Fetch current CageFS users and normalize the list (remove non-user lines like counts)
CURRENT_USERS=$(cagefsctl --list-enabled | grep -v -e 'enabled user(s)' | sort | awk '{$1=$1};1')  # Remove leading/trailing spaces

# If no previous users file exists, initialize it
if [[ ! -f $CAGEFS_USERS_FILE ]]; then
    echo "$CURRENT_USERS" > "$CAGEFS_USERS_FILE"
    echo "First run: Initialized user list. No alerts sent."
    exit 0
fi

# Load previous users list
PREVIOUS_USERS=$(cat "$CAGEFS_USERS_FILE")

# Find new users (compare previous and current user lists)
NEW_USERS=$(comm -13 <(echo "$PREVIOUS_USERS") <(echo "$CURRENT_USERS"))

# If new users are found, send alert
if [[ -n "$NEW_USERS" ]]; then
    # Prepare the Slack message payload
    SLACK_PAYLOAD="{
        \"text\": \"New users added to CageFS:\n$NEW_USERS\"
    }"

    # Send Slack notification
    curl -X POST -H 'Content-type: application/json' --data "$SLACK_PAYLOAD" "$SLACK_WEBHOOK_URL"

    # Log the alert message
    echo "Alert sent: New users added to CageFS:"
    echo "$NEW_USERS"

    # Append the new users to the file (ensures the file remains cumulative)
    echo "$NEW_USERS" >> "$CAGEFS_USERS_FILE"
else
    echo "No new users added."
fi