// SPDX-License-Identifier: GPL-3.0-or-later

// Package schema implements the Go side of Sentinel's stable JSON contracts.
package schema

import (
	"fmt"
	"os"
	"time"
)

const (
	EventV1  = "enodia.event.v1"
	AlertV1  = "enodia.alert.v1"
	StatusV1 = "enodia.status.v1"
)

var eventTypes = map[string]bool{
	"alert": true, "incident": true, "status": true,
}

// Status matches the required enodia.status.v1 fields. The prototype sidecar
// has no retained snapshots yet, so those counts remain empty/zero.
type Status struct {
	Schema         string         `json:"schema"`
	Version        string         `json:"version"`
	Running        bool           `json:"running"`
	TotalAlerts    int            `json:"total_alerts"`
	Counts         map[string]int `json:"counts"`
	LastAlert      *string        `json:"last_alert"`
	EBPF           string         `json:"ebpf"`
	EBPFExec       string         `json:"ebpf_exec"`
	EBPFSyscall    string         `json:"ebpf_syscall"`
	Host           string         `json:"host"`
	HeartbeatAge   *float64       `json:"heartbeat_age"`
	HeartbeatStale bool           `json:"heartbeat_stale"`
}

// Build returns the EVE-style enodia.event.v1 envelope used by Python.
func Build(eventType string, payload any, host, timestamp string) (map[string]any, error) {
	if !eventTypes[eventType] {
		return nil, fmt.Errorf("unknown event_type: %q", eventType)
	}
	if host == "" {
		var err error
		host, err = os.Hostname()
		if err != nil {
			return nil, err
		}
	}
	if timestamp == "" {
		timestamp = time.Now().Local().Format(time.RFC3339Nano)
	}
	return map[string]any{
		"schema":     EventV1,
		"event_type": eventType,
		"timestamp":  timestamp,
		"host":       host,
		eventType:    payload,
	}, nil
}