// SPDX-License-Identifier: GPL-3.0-or-later

package detectors

import (
	"strings"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)

// NewSUID ports the Python new_suid detector (SID 100014).
// The filesystem scan and baseline are supplied by the caller; absent values
// remain fail-open until the sidecar gains its own slow-scan persistence.
func NewSUID(state model.State, cfg config.Config) []model.Alert {
	if state.SUIDBinaries == nil || state.SUIDBaseline == nil {
		return []model.Alert{}
	}
	baseline := make(map[string]bool, len(state.SUIDBaseline))
	for _, path := range state.SUIDBaseline {
		baseline[path] = true
	}
	alerts := make([]model.Alert, 0)
	for _, path := range state.SUIDBinaries {
		if baseline[path] {
			continue
		}
		hot := false
		for _, directory := range cfg.SUIDHotDirs {
			directory = strings.TrimRight(directory, "/")
			if directory != "" && strings.HasPrefix(path, directory+"/") {
				hot = true
				break
			}
		}
		severity := "HIGH"
		detail := "new SUID/SGID binary: " + path
		if hot {
			severity = "CRITICAL"
			detail = "SUID/SGID binary in writable dir: " + path
		}
		alerts = append(alerts, model.Alert{
			SID: 100014, Severity: severity, Signature: "new_suid",
			Classtype: "privilege-escalation", Key: "suid:" + path,
			Detail: detail, PIDs: []int{},
		})
	}
	return alerts
}