package contracts

import "time"

type EventMetadataPayload struct {
	Computer              string `json:"computer,omitempty"`
	ProviderName          string `json:"provider,omitempty"`
	TargetUser            string `json:"target_user,omitempty"`
	TargetDomain          string `json:"target_domain,omitempty"`
	SubjectUser           string `json:"subject_user,omitempty"`
	SubjectDomain         string `json:"subject_domain,omitempty"`
	Workstation           string `json:"workstation,omitempty"`
	Device                string `json:"device,omitempty"`
	SrcIP                 string `json:"src_ip,omitempty"`
	SrcPort               string `json:"src_port,omitempty"`
	DstIP                 string `json:"dst_ip,omitempty"`
	DstPort               string `json:"dst_port,omitempty"`
	LogonType             string `json:"logon_type,omitempty"`
	ProcessName           string `json:"process_name,omitempty"`
	ParentProcessName     string `json:"parent_process_name,omitempty"`
	CommandLine           string `json:"command_line,omitempty"`
	AuthenticationPackage string `json:"authentication_package,omitempty"`
	LogonProcess          string `json:"logon_process,omitempty"`
	StatusText            string `json:"status,omitempty"`
	SubStatusText         string `json:"sub_status,omitempty"`
	FailureReason         string `json:"failure_reason,omitempty"`
}

type LogPayload struct {
	Hostname string                `json:"host"`
	Channel  string                `json:"channel"`
	EventID  uint32                `json:"id"`
	Source   string                `json:"source"`
	Time     time.Time             `json:"ts"`
	Message  string                `json:"msg,omitempty"`
	Metadata *EventMetadataPayload `json:"meta,omitempty"`
}

type IngestEnvelope struct {
	Version    int          `json:"version"`
	TenantID   string       `json:"tenant_id"`
	AgentID    string       `json:"agent_id"`
	BatchUID   string       `json:"batch_uid"`
	RemoteIP   string       `json:"remote_ip"`
	ReceivedAt time.Time    `json:"received_at"`
	Events     []LogPayload `json:"events"`
}

type CanonicalEvent struct {
	EventUID              string            `json:"event_uid"`
	QueuePartition        int32             `json:"queue_partition"`
	QueueOffset           int64             `json:"queue_offset"`
	TenantID              string            `json:"tenant_id"`
	EventTime             string            `json:"event_time"`
	IngestTime            string            `json:"ingest_time"`
	AgentID               string            `json:"agent_id"`
	HostName              string            `json:"host_name"`
	SourceType            string            `json:"source_type"`
	Channel               string            `json:"channel"`
	Provider              string            `json:"provider"`
	EventCode             uint32            `json:"event_code"`
	Category              string            `json:"category"`
	Action                string            `json:"action"`
	Outcome               string            `json:"outcome"`
	Severity              uint8             `json:"severity"`
	UserName              string            `json:"user_name"`
	UserDomain            string            `json:"user_domain"`
	SubjectUser           string            `json:"subject_user"`
	SubjectDomain         string            `json:"subject_domain"`
	TargetUser            string            `json:"target_user"`
	TargetDomain          string            `json:"target_domain"`
	SourceIP              string            `json:"source_ip"`
	SourcePort            uint16            `json:"source_port"`
	DestinationIP         string            `json:"destination_ip"`
	DestinationPort       uint16            `json:"destination_port"`
	Workstation           string            `json:"workstation"`
	LogonType             string            `json:"logon_type"`
	AuthenticationPackage string            `json:"authentication_package"`
	LogonProcess          string            `json:"logon_process"`
	StatusCode            string            `json:"status_code"`
	SubStatusCode         string            `json:"sub_status_code"`
	FailureReason         string            `json:"failure_reason"`
	ProcessPath           string            `json:"process_path"`
	ParentProcessPath     string            `json:"parent_process_path"`
	CommandLine           string            `json:"command_line"`
	Message               string            `json:"message"`
	Attributes            map[string]string `json:"attributes"`
	RawObjectKey          string            `json:"raw_object_key"`
	RawIndex              uint32            `json:"raw_index"`
	PayloadHash           string            `json:"payload_hash"`
	SchemaVersion         uint16            `json:"schema_version"`
	ParserVersion         uint16            `json:"parser_version"`
	IngestDelayMS         int64             `json:"ingest_delay_ms"`
}