// SPDX-License-Identifier: GPL-3.0-or-later

// Package model contains implementation-neutral records shared by the Go
// system snapshot, detector, and event layers.
package model

// Process is the subset of /proc process state needed by the first ported
// poll detectors. Fields are added as more Python detectors move across.
type Process struct {
	PID       int               `json:"pid"`
	Comm      string            `json:"comm"`
	Cmdline   string            `json:"cmdline"`
	Exe       string            `json:"exe"`
	Environ   map[string]string `json:"environ"`
	FDTargets map[string]string `json:"fd_targets"`
}

// State is one injectable detector sweep, equivalent to the Python
// SystemState boundary.
type State struct {
	Processes []Process `json:"processes"`
	Sockets   []Socket  `json:"sockets"`
	LDPreload string    `json:"ld_preload"`
}

// Socket matches the Python SystemState socket view. Nil inode/PID values
// preserve ss records where ownership metadata is unavailable.
type Socket struct {
	State string `json:"state"`
	Local string `json:"local"`
	Peer  string `json:"peer"`
	Inode *int   `json:"inode"`
	Comm  string `json:"comm"`
	PID   *int   `json:"pid"`
	Kind  string `json:"kind"`
}

// Alert matches enodia.alert.v1.
type Alert struct {
	SID       int    `json:"sid"`
	Severity  string `json:"severity"`
	Signature string `json:"signature"`
	Classtype string `json:"classtype"`
	Key       string `json:"key"`
	Detail    string `json:"detail"`
	PIDs      []int  `json:"pids"`
}