detector

type BanAction struct {
	IP       netip.Addr
	Duration time.Duration
	Reason   string
	Score    int32
	Service  string
	IsNew    bool // true if this is a new ban, false if escalation
}

type Detector interface {
	// Name returns the detector identifier
	Name() string

	// Detect checks if a log line matches this detector's patterns
	// Returns (verdict, true) if matched, (zero, false) if not
	// The line is passed as []byte to enable zero-copy processing
	Detect(line []byte) (Verdict, bool)
}

type FTPDetector struct {
	// contains filtered or unexported fields
}

type IPState struct {
	Score       int32     // Current score (scaled by 100)
	Detections  int32     // Total detection count
	BanCount    int32     // Number of times banned
	LastSeen    time.Time // Last detection time
	LastBan     time.Time // Last ban time
	FirstSeen   time.Time // First detection time
	LastService string    // Last service that detected this IP
	LastReason  uint16    // Last reason code
}

type MailDetector struct {
	// contains filtered or unexported fields
}

type PanelDetector struct {
	// contains filtered or unexported fields
}

type Registry struct {
	// contains filtered or unexported fields
}

type SSHDetector struct {
	// contains filtered or unexported fields
}

type Scorer struct {
	// contains filtered or unexported fields
}

type ScorerConfig struct {
	// Thresholds (score * 100 for precision)
	ThresholdTempBan   int32 // Score to trigger temp ban (default: 45 = 0.45)
	ThresholdEscalate  int32 // Score to escalate ban (default: 65 = 0.65)
	ThresholdPermanent int32 // Score for permanent ban (default: 100 = 1.00)

	// Ban durations
	TempBanDuration   time.Duration   // Initial temp ban (default: 15m)
	EscalateDurations []time.Duration // Escalation ladder (2h, 4h, 12h, 24h)

	// Decay
	ScoreDecayInterval time.Duration // How often to decay scores (default: 5m)
	ScoreDecayAmount   int32         // Points to decay per interval (default: 5)

	// Cleanup
	IPRetentionDuration time.Duration // How long to keep IP data (default: 24h)
}

type Stats struct {
	TotalDetections  atomic.Int64
	TotalBans        atomic.Int64
	TotalEscalations atomic.Int64
	TotalPermanent   atomic.Int64
	UniqueIPs        atomic.Int64

	// IPv4/IPv6 tracking
	DetectionsIPv4 atomic.Int64
	DetectionsIPv6 atomic.Int64
	BansIPv4       atomic.Int64
	BansIPv6       atomic.Int64
	UniqueIPv4     atomic.Int64
	UniqueIPv6     atomic.Int64

	// Per-service detection counts
	DetectionsByService sync.Map // map[string]*atomic.Int64

	// Per-service ban counts
	BansByService sync.Map // map[string]*atomic.Int64

	// Per-reason detection counts
	DetectionsByReason sync.Map // map[uint16]*atomic.Int64

	// Per-reason ban counts
	BansByReason sync.Map // map[uint16]*atomic.Int64
}

type StatsSnapshot struct {
	TotalDetections  int64
	TotalBans        int64
	TotalEscalations int64
	TotalPermanent   int64
	UniqueIPs        int64

	// IPv4/IPv6 breakdown
	DetectionsIPv4 int64
	DetectionsIPv6 int64
	BansIPv4       int64
	BansIPv6       int64
	UniqueIPv4     int64
	UniqueIPv6     int64

	// By service
	DetectionsByService map[string]int64
	BansByService       map[string]int64

	// By reason
	DetectionsByReason map[string]int64
	BansByReason       map[string]int64
}

type Verdict struct {
	IP         netip.Addr // Parsed IP address (IPv4 or IPv6)
	Reason     uint16     // Stable enum code for the detection reason
	ScoreDelta int16      // Points to add to the IP's risk score (scaled by 100)
	User       string     // Optional: username involved (empty if not extracted)
	Service    string     // Service name (ssh, dovecot, etc.)
}