# SPDX-License-Identifier: GPL-3.0-or-later
"""Alert triage — label a detection likely-false-positive vs needs-review.

Applies cheap, explainable heuristics (provenance, loopback binds, allowlists,
drill artifacts) so a human isn't drowned in benign noise. Verdicts are advice,
never auto-deletion. ``is_owned`` is injectable for testing.
"""
from __future__ import annotations

import re
from collections.abc import Callable
from dataclasses import dataclass

from .config import Config
from .provenance import is_package_owned

LIKELY_FP = "likely-fp"
REVIEW = "review"

_LOOPBACK = ("127.", "::1", "[::1]")
_WRITABLE = ("/tmp/", "/dev/shm/", "/var/tmp/", "/run/user/")
# Signatures that provenance can never clear — a network shell or C2 channel is
# worth a look regardless of which binary is involved.
_ALWAYS_REVIEW = {"reverse_shell", "egress"}


@dataclass(frozen=True)
class Verdict:
    label: str           # LIKELY_FP or REVIEW
    reason: str
    suggest: str = ""    # optional config line to suppress future copies


def _exe_for(alert: dict, processes: list[dict]) -> str:
    pids = set(alert.get("pids", []))
    for p in processes:
        if p.get("pid") in pids:
            return p.get("exe", "")
    return ""


def triage_alert(alert: dict, processes: list[dict], cfg: Config,
                 is_owned: Callable[[str], bool] = is_package_owned) -> Verdict:
    sig = alert.get("signature", "")
    detail = alert.get("detail", "")
    exe = _exe_for(alert, processes)

    if sig.startswith("exec_rule.") or sig in _ALWAYS_REVIEW:
        return Verdict(REVIEW, "network/exec signature — provenance can't clear it")

    if sig == "ld_preload":
        m = re.search(r"LD_PRELOAD=\[([^\]]+)\]", detail)
        lib = m.group(1) if m else ""
        if lib.startswith(_WRITABLE):
            return Verdict(REVIEW, f"LD_PRELOAD from writable path: {lib}")
        if lib and is_owned(lib):
            return Verdict(LIKELY_FP, f"preload library is package-owned: {lib}")
        return Verdict(REVIEW, "library injection — verify the .so by hand")

    if sig == "deleted_exe":
        if "memfd:" in detail:
            return Verdict(REVIEW, "memfd-backed (fileless) execution")
        if exe and is_owned(exe):
            return Verdict(LIKELY_FP, "deleted exe is package-owned (post-upgrade daemon)")
        return Verdict(REVIEW, "process running from a deleted binary")

    if sig == "new_listener":
        addr = detail.split("socket ", 1)[-1].split(" by ", 1)[0]
        comm = detail.rsplit("comm=", 1)[-1].strip()
        port = addr.rsplit(":", 1)[-1]
        if addr.startswith(_LOOPBACK):
            return Verdict(LIKELY_FP, "loopback-only listener (not externally reachable)")
        if comm in cfg.listener_allow_comms:
            return Verdict(LIKELY_FP, f"comm '{comm}' is allow-listed")
        if exe and is_owned(exe):
            owner = comm
            return Verdict(LIKELY_FP,
                           f"listener binary is package-owned ({comm})",
                           suggest=f'listener_allow_comms += "{comm}"')
        return Verdict(REVIEW, f"unrecognized listener {addr} ({comm})")

    if sig == "new_suid":
        path = detail.rsplit(": ", 1)[-1]
        if is_owned(path):
            return Verdict(LIKELY_FP, "SUID binary is package-owned")
        return Verdict(REVIEW, f"unowned SUID binary: {path}")

    if sig == "persistence":
        return Verdict(REVIEW, "a persistence-relevant file changed — confirm intent")

    return Verdict(REVIEW, "no triage rule matched")