# SPDX-License-Identifier: GPL-3.0-or-later
"""persistence — modification of a watched persistence-relevant file.

Persistence has to land somewhere that survives a reboot: cron, systemd units,
``authorized_keys``, shell rc files. We watch a configurable set and alert on
anything modified since the previous scan (``state.persist_since``).
"""
from __future__ import annotations

import os
from collections.abc import Iterator

from ..alert import Alert, Severity
from ..config import Config
from ..system import SystemState


def _iter_files(roots) -> Iterator[str]:
    for root in roots:
        if os.path.isdir(root):
            for dirpath, _dirs, files in os.walk(root, onerror=lambda e: None):
                for f in files:
                    yield os.path.join(dirpath, f)
        elif os.path.lexists(root):
            yield root


def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
    since = state.persist_since
    if since is None:
        return
    for path in _iter_files(cfg.watch_persistence):
        try:
            mtime = os.lstat(path).st_mtime
        except OSError:
            continue
        if mtime > since:
            yield Alert(
                severity=Severity.HIGH,
                signature="persistence",
                key=f"persist:{path}",
                detail=f"persistence file modified: {path}",
                sid=100015,
                classtype="persistence",
            )