# SPDX-License-Identifier: GPL-3.0-or-later
"""Alert and severity types shared by all detectors."""
from __future__ import annotations

import enum
from dataclasses import dataclass, field


class Severity(enum.IntEnum):
    MEDIUM = 1
    HIGH = 2
    CRITICAL = 3

    def __str__(self) -> str:  # pragma: no cover - trivial
        return self.name


@dataclass(frozen=True)
class Alert:
    """A single detection.

    `key` is a stable dedup identity (e.g. ``rsh:1234``) used by the daemon's
    cooldown so the same condition doesn't re-fire every sweep. `pids` lists
    processes the snapshot should deep-dive.
    """

    severity: Severity
    signature: str
    key: str
    detail: str
    pids: tuple[int, ...] = field(default_factory=tuple)

    def to_dict(self) -> dict:
        return {
            "severity": str(self.severity),
            "signature": self.signature,
            "key": self.key,
            "detail": self.detail,
            "pids": list(self.pids),
        }