// SPDX-License-Identifier: GPL-3.0-or-later

// Package model contains implementation-neutral records shared by the Go
// system snapshot, detector, and event layers.
package model

// Process is the subset of /proc process state needed by the first ported
// poll detectors. Fields are added as more Python detectors move across.
type Process struct {
	PID        int               `json:"pid"`
	Comm       string            `json:"comm"`
	Cmdline    string            `json:"cmdline"`
	Exe        string            `json:"exe"`
	Environ    map[string]string `json:"environ"`
	FDTargets  map[string]string `json:"fd_targets"`
	MemoryMaps []MemoryMap       `json:"memory_maps"`
}

// MemoryMap is one parsed /proc/<pid>/maps row. The detector only needs the
// address range, permission bits, and optional pathname; retaining those raw
// fields keeps fixture input and alert explanations close to Python.
type MemoryMap struct {
	Start uint64 `json:"start"`
	End   uint64 `json:"end"`
	Perms string `json:"perms"`
	Path  string `json:"path"`
}

// State is one injectable detector sweep, equivalent to the Python
// SystemState boundary.
type State struct {
	Processes                   []Process           `json:"processes"`
	Sockets                     []Socket            `json:"sockets"`
	LDPreload                   string              `json:"ld_preload"`
	ListenerBaseline            []string            `json:"listener_baseline"`
	SUIDBaseline                []string            `json:"suid_baseline"`
	SUIDBinaries                []string            `json:"suid_binaries"`
	PersistSince                *float64            `json:"persist_since"`
	PersistenceFiles            map[string]float64  `json:"persistence_files"`
	FirstSeenInitialized        bool                `json:"first_seen_initialized"`
	FirstSeenPublicDestinations map[string][]string `json:"first_seen_public_destinations"`
	FirstSeenListenerPorts      map[string][]string `json:"first_seen_listener_ports"`
}

// Socket matches the Python SystemState socket view. Nil inode/PID values
// preserve ss records where ownership metadata is unavailable.
type Socket struct {
	State string `json:"state"`
	Local string `json:"local"`
	Peer  string `json:"peer"`
	Inode *int   `json:"inode"`
	Comm  string `json:"comm"`
	PID   *int   `json:"pid"`
	Kind  string `json:"kind"`
}

// Alert matches enodia.alert.v1.
type Alert struct {
	SID       int    `json:"sid"`
	Severity  string `json:"severity"`
	Signature string `json:"signature"`
	Classtype string `json:"classtype"`
	Key       string `json:"key"`
	Detail    string `json:"detail"`
	PIDs      []int  `json:"pids"`
}