# SPDX-License-Identifier: GPL-3.0-or-later
"""Canonical registry of every built-in SID.

Aggregates the constants where they are defined; nothing is renumbered or
moved. The core poll detectors carry some SIDs inline in the Alert they build,
so those rows are tabulated here and cross-checked by tests.
"""
from __future__ import annotations

from dataclasses import dataclass

from . import fim, pkgdb, posture, rootcheck
from .detectors import (
    credential_access,
    input_snooper,
    memory_obfuscation,
    stealth_network,
)
from .events.rules import DEFAULT_EXEC_RULES
from .events.syscall_rules import DEFAULT_SYSCALL_RULES


@dataclass(frozen=True)
class SidInfo:
    sid: int
    name: str
    engine: str
    module: str


def _rule_rows(rules, engine: str, module: str) -> tuple[SidInfo, ...]:
    return tuple(
        SidInfo(r.sid, f"{engine}.{r.classtype}", engine, module)
        for r in rules
    )


_DETECTORS = "enodia_sentinel.detectors"

BUILTIN_SIDS: tuple[SidInfo, ...] = (
    *_rule_rows(DEFAULT_EXEC_RULES, "exec_rule",
                "enodia_sentinel.events.rules"),
    *_rule_rows(DEFAULT_SYSCALL_RULES, "syscall_rule",
                "enodia_sentinel.events.syscall_rules"),
    SidInfo(100010, "reverse_shell", "detector", f"{_DETECTORS}.reverse_shell"),
    SidInfo(100011, "ld_preload", "detector", f"{_DETECTORS}.ld_preload"),
    SidInfo(100012, "deleted_exe", "detector", f"{_DETECTORS}.deleted_exe"),
    SidInfo(100013, "new_listener", "detector", f"{_DETECTORS}.new_listener"),
    SidInfo(100014, "new_suid", "detector", f"{_DETECTORS}.new_suid"),
    SidInfo(100015, "persistence", "detector", f"{_DETECTORS}.persistence"),
    SidInfo(100016, "egress", "detector", f"{_DETECTORS}.egress"),
    SidInfo(input_snooper.SID_INPUT_SNOOPER, "input_snooper", "detector",
            f"{_DETECTORS}.input_snooper"),
    SidInfo(credential_access.SID_CREDENTIAL_ACCESS, "credential_access",
            "detector", f"{_DETECTORS}.credential_access"),
    SidInfo(stealth_network.SID_STEALTH_NETWORK, "stealth_network",
            "detector", f"{_DETECTORS}.stealth_network"),
    SidInfo(memory_obfuscation.SID_MEMORY_OBFUSCATION, "memory_obfuscation",
            "detector", f"{_DETECTORS}.memory_obfuscation"),
    SidInfo(memory_obfuscation.SID_PROCESS_HIDING_LIBRARY,
            "process_hiding_library", "detector",
            f"{_DETECTORS}.memory_obfuscation"),
    SidInfo(fim.SID_MODIFIED, "fim_modified", "fim", "enodia_sentinel.fim"),
    SidInfo(fim.SID_ADDED, "fim_added", "fim", "enodia_sentinel.fim"),
    SidInfo(fim.SID_REMOVED, "fim_removed", "fim", "enodia_sentinel.fim"),
    SidInfo(fim.SID_PKG, "pkg_verify_mismatch", "fim", "enodia_sentinel.fim"),
    SidInfo(pkgdb.SID_PKGDB, "pkgdb_tamper", "pkgdb", "enodia_sentinel.pkgdb"),
    SidInfo(pkgdb.SID_SIGLEVEL, "pacman_siglevel_disabled", "pkgdb",
            "enodia_sentinel.pkgdb"),
    SidInfo(pkgdb.SID_PKGVERIFY, "pkg_signature_mismatch", "pkgdb",
            "enodia_sentinel.pkgdb"),
    SidInfo(rootcheck.SID_HIDDEN_PROC, "rootkit_hidden_process", "rootcheck",
            "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_HIDDEN_MODULE, "rootkit_hidden_module", "rootcheck",
            "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_HIDDEN_PORT, "rootkit_hidden_port", "rootcheck",
            "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_PROMISC, "promiscuous_interface", "rootcheck",
            "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_KNOWN_ROOTKIT_MODULE, "rootkit_known_module",
            "rootcheck", "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_TAINTED_MODULE, "rootkit_tainted_module",
            "rootcheck", "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_KERNEL_TAINTED, "kernel_tainted", "rootcheck",
            "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_HIDDEN_UDP_PORT, "rootkit_hidden_udp_port",
            "rootcheck", "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_HIDDEN_RAW_SOCKET, "rootkit_hidden_raw_socket",
            "rootcheck", "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_RAW_ICMP_SOCKET, "raw_icmp_socket", "rootcheck",
            "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_HIDDEN_PROTOCOL_SOCKET,
            "rootkit_hidden_protocol_socket", "rootcheck",
            "enodia_sentinel.rootcheck"),
    SidInfo(rootcheck.SID_PS_HIDDEN_PROCESS, "rootkit_ps_hidden_process",
            "rootcheck", "enodia_sentinel.rootcheck"),
    SidInfo(posture.SID_SSH_ROOT_LOGIN, "ssh_root_login", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_SSH_PASSWORD_AUTH, "ssh_password_auth", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_SSH_EMPTY_PASSWORD, "ssh_empty_password", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_SUDO_NOPASSWD, "sudo_nopasswd", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_SUDO_NOAUTH, "sudo_no_authenticate", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_SUDOERS_WRITABLE, "sudoers_writable", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_PATH_WRITABLE, "path_writable", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_SENSITIVE_FILE_PERM, "sensitive_file_perm", "posture",
            "enodia_sentinel.posture"),
    SidInfo(posture.SID_SYSTEMD_UNIT_WRITABLE, "systemd_unit_writable",
            "posture", "enodia_sentinel.posture"),
    SidInfo(posture.SID_SYSTEMD_EXEC_UNSAFE, "systemd_exec_unsafe", "posture",
            "enodia_sentinel.posture"),
)


def all_sids() -> frozenset[int]:
    return frozenset(s.sid for s in BUILTIN_SIDS)


def engine_sids(engine: str) -> frozenset[int]:
    return frozenset(s.sid for s in BUILTIN_SIDS if s.engine == engine)