package com.common.mapper;

import com.common.entity.GroupedSyslogData;
import com.common.entity.SyslogNormalData;
import com.common.entity.SyslogNormalAlarm;
import org.apache.ibatis.annotations.Mapper;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;

import java.time.LocalDateTime;
import java.util.List;
import java.util.Map;

@Mapper
public interface SyslogNormalAlarmMapper {

    /**
     * 动态插入数据 - 使用 Map
     */
    int insertDynamic(@Param("dataMap") Map<String, Object> dataMap);

    /**
     * 动态插入数据 - 使用实体类
     */
    int insertByEntity(SyslogNormalAlarm entity);

    /**
     * 批量插入数据
     */
    int batchInsert(@Param("dataList") List<Map<String, Object>> dataList);


    /**
     * 统计24小时内分组数据量
     */
    @Select("SELECT count(1) as group_count from ( select  " +
            "to_char(log_time, 'YYYYMMDD') || '_' || " +
            "dest_ip || '_' || " +
            "origin_event_name " +
            "FROM syslog_normal_alarm " +
            "WHERE log_time >= #{startTime} AND log_time < #{endTime} " +
            "AND event_level >= 1 AND src_ip NOT IN ('127.0.0.1', '127.0.0.2') " +
            "GROUP BY to_char(log_time, 'YYYYMMDD'),src_ip, dest_ip, origin_event_name  )" )
    Long count24HoursGroupedData(@Param("startTime") LocalDateTime startTime,
                                 @Param("endTime") LocalDateTime endTime);

    /**
     * 分页查询分组数据
     */
    @Select("SELECT " +
            "to_char(log_time, 'YYYYMMDD') as log_date, " +
            "ARRAY_AGG(DISTINCT  host(src_ip)::text)  as  attack_ips, " +
            "origin_event_name, " +
            "MAX(attack_result) as attack_result, " +
            "MIN(log_time) as min_log_time, " +
            "MAX(log_time) as max_log_time, " +
            "COUNT(1) as log_count, " +
            "ARRAY_AGG(DISTINCT  host(dest_ip)::text) as victim_ips, " +
            "ARRAY_AGG(DISTINCT http_url) as victim_web_urls, " +
            "ARRAY_AGG(DISTINCT device_id) as device_ids, " +
            "ARRAY_AGG(DISTINCT id) as origin_log_ids, " +
            "MAX(event_level) as max_event_level, " +
            "MIN(origin_event_type)  AS first_event_type, " +
            "MAX(origin_event_type) as event_type, " +
            "MIN(event_type) as min_event_type, " +
            "ARRAY_AGG(DISTINCT src_port::int4) as attack_ports, " +
            "ARRAY_AGG(DISTINCT dest_port::int4) as victim_ports, " +
            "ARRAY_AGG(DISTINCT http_resp_codes::text) as http_status_codes, " +
            "ARRAY_AGG(DISTINCT payload::BYTEA) as payload_samples, " +
            "ARRAY_AGG(DISTINCT http_req_header) as httpReqHeaders, " +
            "ARRAY_AGG(DISTINCT http_req_body) as httpReqBodys, " +
            "ARRAY_AGG(DISTINCT http_resp_header) as httpRespHeaders, " +
            "ARRAY_AGG(DISTINCT http_resp_body) as httpRespBodys, " +
            "MODE() WITHIN GROUP (ORDER BY dest_domain) as dns_info, " +
            "STRING_AGG(DISTINCT COALESCE(host(dest_ip)::text, ''), ',') as victim_ips_str " +
            "FROM syslog_normal_alarm  " +
            "WHERE log_time >= #{startTime} AND log_time < #{endTime} " +
            "AND event_level >= 1 AND src_ip NOT IN ('127.0.0.1', '127.0.0.2') " +
            "GROUP BY to_char(log_time, 'YYYYMMDD'), src_ip, dest_ip, origin_event_name  " +
            "ORDER BY log_date, dest_ip, origin_event_name  " +
            "LIMIT #{pageSize} OFFSET #{offset}")
    List<GroupedSyslogData> select24HoursGroupedDataByPage(
            @Param("startTime") LocalDateTime startTime,
            @Param("endTime") LocalDateTime endTime,
            @Param("offset") int offset,
            @Param("pageSize") int pageSize);
}