// SPDX-License-Identifier: GPL-3.0-or-later

package events

import "encoding/json"

// SyscallEvent is the transport-neutral security telemetry consumed by the
// syscall rules. Unsupplied arguments decode as zero, matching Python's
// dataclass defaults and the partial fixtures accepted by rule operations.
type SyscallEvent struct {
	PID     int       `json:"pid"`
	PPID    int       `json:"ppid"`
	UID     int       `json:"uid"`
	Comm    string    `json:"comm"`
	Syscall string    `json:"syscall"`
	Args    [6]uint64 `json:"args"`
	Text    string    `json:"text"`
}

func (e *SyscallEvent) UnmarshalJSON(raw []byte) error {
	var values map[string]any
	if err := json.Unmarshal(raw, &values); err != nil {
		return err
	}
	e.PID = integerValue(values["pid"], 0)
	e.PPID = integerValue(values["ppid"], 0)
	e.UID = integerValue(values["uid"], 0)
	e.Comm = stringValue(values["comm"])
	e.Syscall = stringValue(values["syscall"])
	e.Text = stringValue(values["text"])
	if args, ok := values["args"].([]any); ok {
		for index := 0; index < len(args) && index < len(e.Args); index++ {
			e.Args[index] = uint64(integerValue(args[index], 0))
		}
	}
	for index, key := range []string{"arg0", "arg1", "arg2", "arg3", "arg4", "arg5"} {
		if value, ok := values[key]; ok {
			e.Args[index] = uint64(integerValue(value, int(e.Args[index])))
		}
	}
	return nil
}