// SPDX-License-Identifier: GPL-3.0-or-later

package detectors

import (
	"fmt"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)

var inputDevicePrefixes = []string{
	"/dev/input/event", "/dev/uinput", "/dev/hidraw",
}

// InputSnooper ports the Python input_snooper detector (SID 100032).
func InputSnooper(state model.State, cfg config.Config) []model.Alert {
	alerts := make([]model.Alert, 0)
	for _, process := range state.Processes {
		comm := process.Comm
		if comm == "" {
			comm = "?"
		}
		if cfg.InputSnooperAllowComms[comm] {
			continue
		}
		for _, fd := range sortedFDs(process.FDTargets) {
			target := process.FDTargets[fd]
			if !hasAnyPrefix(target, inputDevicePrefixes) {
				continue
			}
			alerts = append(alerts, model.Alert{
				SID:       100032,
				Severity:  "HIGH",
				Signature: "input_snooper",
				Classtype: "credential-keylogging",
				Key:       fmt.Sprintf("input:%d:%s", process.PID, target),
				Detail: fmt.Sprintf(
					"pid=%d comm=%s fd=%s has input device open: %s",
					process.PID, comm, fd, target),
				PIDs: []int{process.PID},
			})
			break
		}
	}
	return alerts
}