detector

type BanAction struct {
	IP       netip.Addr
	Prefix   netip.Prefix // v1.113: set for subnet-aggregation bans; zero value otherwise
	Duration time.Duration
	Reason   string
	Score    int32
	Service  string
	IsNew    bool // true if this is a new ban, false if escalation
	IsSubnet bool // v1.113: true when this ban targets a CIDR via subnet aggregation
}

type Detector interface {
	// Name returns the detector identifier
	Name() string

	// Detect checks if a log line matches this detector's patterns
	// Returns (verdict, true) if matched, (zero, false) if not
	// The line is passed as []byte to enable zero-copy processing
	Detect(line []byte) (Verdict, bool)
}

type FTPDetector struct {
	// contains filtered or unexported fields
}

type IPState struct {
	Score       int32     // Current score (scaled by 100)
	Detections  int32     // Total detection count
	BanCount    int32     // Number of times banned
	LastSeen    time.Time // Last detection time
	LastBan     time.Time // Last ban time
	FirstSeen   time.Time // First detection time
	LastService string    // Last service that detected this IP
	LastReason  uint16    // Last reason code
}

type MailDetector struct {
	// contains filtered or unexported fields
}

type PanelDetector struct {
	// contains filtered or unexported fields
}

type Registry struct {
	// contains filtered or unexported fields
}

type SSHDetector struct {
	// contains filtered or unexported fields
}

type Scorer struct {
	// contains filtered or unexported fields
}

type ScorerConfig struct {
	// Thresholds (score * 100 for precision)
	ThresholdTempBan   int32 // Score to trigger temp ban (default: 45 = 0.45)
	ThresholdEscalate  int32 // Score to escalate ban (default: 65 = 0.65)
	ThresholdPermanent int32 // Score for permanent ban (default: 100 = 1.00)

	// Ban durations
	TempBanDuration   time.Duration   // Initial temp ban (default: 15m)
	EscalateDurations []time.Duration // Escalation ladder (2h, 4h, 12h, 24h)

	// Decay
	ScoreDecayInterval time.Duration // How often to decay scores (default: 5m)
	ScoreDecayAmount   int32         // Points to decay per interval (default: 5)

	// Cleanup
	IPRetentionDuration time.Duration // How long to keep IP data (default: 24h)

	// Deduplication (exponential backoff)
	RecentBanWindow    time.Duration // Initial suppress window (default: 10s)
	RecentBanMaxWindow time.Duration // Maximum suppress window (default: 5m)

	SubnetAggEnabled        bool           // Master toggle (default: false)
	SubnetAggMode           string         // "observe" or "enforce" (default: "observe")
	SubnetWindow            time.Duration  // Rolling-window duration (default: 5m)
	SubnetUniqueIPsMin      int            // Minimum distinct IPs in window (default: 5)
	SubnetMinTotalEvents    int            // Minimum total events in window (default: 10)
	SubnetIPv4Prefix        int            // IPv4 aggregation prefix (default: 24)
	SubnetIPv6Prefix        int            // IPv6 aggregation prefix (default: 64)
	SubnetAction            string         // "ban_cidr" (initial release); reserved: "pressure_score", "dynamic_threshold"
	SubnetCIDRBanDuration   time.Duration  // Duration for subnet ban (0 = permanent; default: 24h)
	SubnetMaxTracked        int            // Max simultaneously-tracked subnets (default: 10000; LRU eviction)
	SubnetTrustedAllowlist  []netip.Prefix // Operator-curated trusted-provider subnets (skip aggregation)
	SubnetTriggerReasonOnly bool           // Restrict aggregation to EXIM_AUTH_FAIL only (default: true)
}

type Stats struct {
	TotalDetections  atomic.Int64
	TotalBans        atomic.Int64
	TotalEscalations atomic.Int64
	TotalPermanent   atomic.Int64
	UniqueIPs        atomic.Int64

	// IPv4/IPv6 tracking
	DetectionsIPv4 atomic.Int64
	DetectionsIPv6 atomic.Int64
	BansIPv4       atomic.Int64
	BansIPv6       atomic.Int64
	UniqueIPv4     atomic.Int64
	UniqueIPv6     atomic.Int64

	// Per-service detection counts
	DetectionsByService sync.Map // map[string]*atomic.Int64

	// Per-service ban counts
	BansByService sync.Map // map[string]*atomic.Int64

	// Per-reason detection counts
	DetectionsByReason sync.Map // map[uint16]*atomic.Int64

	// Per-reason ban counts
	BansByReason sync.Map // map[uint16]*atomic.Int64

	// v1.113 subnet-aggregation counters
	SubnetPressureCount atomic.Int64 // Cumulative observe-mode pressure events emitted across all prefixes.
	SubnetBansTotal     atomic.Int64 // Cumulative CIDR bans triggered in enforce mode.
	SubnetWatchActive   atomic.Int64 // Current number of prefixes being actively watched (gauge).
}

type StatsSnapshot struct {
	TotalDetections  int64
	TotalBans        int64
	TotalEscalations int64
	TotalPermanent   int64
	UniqueIPs        int64

	// IPv4/IPv6 breakdown
	DetectionsIPv4 int64
	DetectionsIPv6 int64
	BansIPv4       int64
	BansIPv6       int64
	UniqueIPv4     int64
	UniqueIPv6     int64

	// By service
	DetectionsByService map[string]int64
	BansByService       map[string]int64

	// By reason
	DetectionsByReason map[string]int64
	BansByReason       map[string]int64

	// v1.113 subnet aggregation
	SubnetPressureCount int64
	SubnetBansTotal     int64
	SubnetWatchActive   int64
}

type SubnetState struct {
	// UniqueIPs maps source IPs seen in this prefix to their last-seen
	// timestamp. Used both for the unique-IP-count threshold and for
	// per-IP timestamp eviction when the rolling window expires.
	UniqueIPs map[netip.Addr]time.Time

	TotalEvents  int       // Total events in this prefix within the rolling window.
	FirstSeen    time.Time // Anchor for the rolling window (advances on window-expiry reset).
	LastSeen     time.Time // Most recent event timestamp.
	Banned       bool      // Set true once the subnet has been banned (in enforce mode).
	BannedAt     time.Time // Timestamp of the subnet ban.
	PressureHits int64     // Cumulative observe-mode pressure events emitted (audit counter).
}

type Verdict struct {
	IP         netip.Addr // Parsed IP address (IPv4 or IPv6)
	Reason     uint16     // Stable enum code for the detection reason
	ScoreDelta int16      // Points to add to the IP's risk score (scaled by 100)
	User       string     // Optional: username involved (empty if not extracted)
	Service    string     // Service name (ssh, dovecot, etc.)
}