#!/usr/bin/env python3
"""Open (or close) UFW for every live team's port block.

The panel opens a team's ports at create time, but teams created out-of-band
(scripts, git checkout, a half-finished create_team) never got rules, and this
host's UFW defaults to deny(incoming) — so those teams are blackholed. Run
after any bulk team creation:

    python3 panel/sync_all_team_ufw.py          # open
    python3 panel/sync_all_team_ufw.py --remove # close
"""
import sys
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parent))
import teams as orch

def main():
    remove = "--remove" in sys.argv
    live = orch.list_teams()
    if not live:
        print("no teams")
        return
    for t in live:
        idx = t["index"]
        r = orch.sync_team_ufw(idx, remove=remove)
        verb = "closed" if remove else "opened"
        bad = f"  FAILED={r['failed']}" if r.get("failed") else ""
        print(f"team{idx} ({t.get('label')}): {verb} {len(r.get('closed' if remove else 'opened', []))}"
              f"/{r['ports']} ports{bad}")

if __name__ == "__main__":
    main()