package cloudfoundry

import (
	"nudgebee/collector/cloud/providers"
	"time"
)

// getCFEventRules returns static event rules for Cloud Foundry audit events.
// CF has no native alerting like CloudWatch Alarms, so we define rules based
// on audit event types to enable the event rules framework.
func getCFEventRules() []providers.EventRule {
	return []providers.EventRule{
		// Critical app events
		{
			Name:        "audit.app.process.crash",
			Summary:     "Application process crashed",
			Description: "A Cloud Foundry application process has crashed. This may indicate an application error, out-of-memory condition, or misconfiguration.",
			Expr:        "audit.app.process.crash",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "app", "event_type": "crash"},
		},
		{
			Name:        "audit.app.delete-request",
			Summary:     "Application deleted",
			Description: "A Cloud Foundry application has been deleted. Verify this was intentional.",
			Expr:        "audit.app.delete-request",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "app", "event_type": "delete"},
		},
		// Warning app events
		{
			Name:        "audit.app.stop",
			Summary:     "Application stopped",
			Description: "A Cloud Foundry application has been stopped.",
			Expr:        "audit.app.stop",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "stop"},
		},
		{
			Name:        "audit.app.update",
			Summary:     "Application updated",
			Description: "A Cloud Foundry application configuration has been updated.",
			Expr:        "audit.app.update",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "update"},
		},
		{
			Name:        "audit.app.restage",
			Summary:     "Application restaged",
			Description: "A Cloud Foundry application has been restaged, which may cause brief downtime.",
			Expr:        "audit.app.restage",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "restage"},
		},
		// Info app events
		{
			Name:        "audit.app.create",
			Summary:     "Application created",
			Description: "A new Cloud Foundry application has been created.",
			Expr:        "audit.app.create",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "create"},
		},
		{
			Name:        "audit.app.start",
			Summary:     "Application started",
			Description: "A Cloud Foundry application has been started.",
			Expr:        "audit.app.start",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "start"},
		},
		// Service instance events
		{
			Name:        "audit.service_instance.delete",
			Summary:     "Service instance deleted",
			Description: "A Cloud Foundry service instance has been deleted. Verify dependent applications are not affected.",
			Expr:        "audit.service_instance.delete",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "service_instance", "event_type": "delete"},
		},
		{
			Name:        "audit.service_instance.create",
			Summary:     "Service instance created",
			Description: "A new Cloud Foundry service instance has been created.",
			Expr:        "audit.service_instance.create",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "service_instance", "event_type": "create"},
		},
		// Space events
		{
			Name:        "audit.space.delete-request",
			Summary:     "Space deleted",
			Description: "A Cloud Foundry space has been deleted. All resources within the space will be removed.",
			Expr:        "audit.space.delete-request",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "space", "event_type": "delete"},
		},
		// Route events
		{
			Name:        "audit.route.delete-request",
			Summary:     "Route deleted",
			Description: "A Cloud Foundry route has been deleted. Applications using this route may become unreachable.",
			Expr:        "audit.route.delete-request",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "route", "event_type": "delete"},
		},
		// Build events
		{
			Name:        "audit.build.create",
			Summary:     "Build created",
			Description: "A new application build has been initiated in Cloud Foundry.",
			Expr:        "audit.build.create",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "build", "event_type": "create"},
		},
		// Task events
		{
			Name:        "audit.app.task.create",
			Summary:     "Task created",
			Description: "A new task has been created for a Cloud Foundry application.",
			Expr:        "audit.app.task.create",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "task", "event_type": "create"},
		},
		// Environment variable changes
		{
			Name:        "audit.app.environment_variables.update",
			Summary:     "Application environment variables updated",
			Description: "Environment variables for a Cloud Foundry application have been updated. This may affect application behavior or expose sensitive configuration.",
			Expr:        "audit.app.environment_variables.update",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "environment_variables"},
		},
		// Route mapping events
		{
			Name:        "audit.app.map_route",
			Summary:     "Route mapped to application",
			Description: "A route has been mapped to a Cloud Foundry application, changing its network accessibility.",
			Expr:        "audit.app.map_route",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "map_route"},
		},
		{
			Name:        "audit.app.unmap_route",
			Summary:     "Route unmapped from application",
			Description: "A route has been unmapped from a Cloud Foundry application. The application may become unreachable via this route.",
			Expr:        "audit.app.unmap_route",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "unmap_route"},
		},
		// Scaling events
		{
			Name:        "audit.app.process.scale",
			Summary:     "Application process scaled",
			Description: "A Cloud Foundry application process has been scaled (instances, memory, or disk). Monitor for resource pressure changes.",
			Expr:        "audit.app.process.scale",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "scale"},
		},
		// Service binding events
		{
			Name:        "audit.service_binding.create",
			Summary:     "Service binding created",
			Description: "A new service binding has been created between an application and a service instance.",
			Expr:        "audit.service_binding.create",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "service_binding", "event_type": "create"},
		},
		{
			Name:        "audit.service_binding.delete",
			Summary:     "Service binding deleted",
			Description: "A service binding between an application and a service instance has been deleted. The application may lose access to the service.",
			Expr:        "audit.service_binding.delete",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "service_binding", "event_type": "delete"},
		},
		// SSH access events
		{
			Name:        "audit.app.ssh-authorized",
			Summary:     "SSH access authorized for application",
			Description: "SSH access has been authorized for a Cloud Foundry application. This is a security-relevant event.",
			Expr:        "audit.app.ssh-authorized",
			Source:      "cloudfoundry",
			Category:    "security",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "ssh"},
		},
		{
			Name:        "audit.app.ssh-unauthorized",
			Summary:     "SSH access unauthorized for application",
			Description: "An unauthorized SSH access attempt was made to a Cloud Foundry application. Investigate the source.",
			Expr:        "audit.app.ssh-unauthorized",
			Source:      "cloudfoundry",
			Category:    "security",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "ssh"},
		},
		// Service instance update
		{
			Name:        "audit.service_instance.update",
			Summary:     "Service instance updated",
			Description: "A Cloud Foundry service instance configuration has been updated. Verify dependent applications are not affected.",
			Expr:        "audit.service_instance.update",
			Source:      "cloudfoundry",
			Category:    "change",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "service_instance", "event_type": "update"},
		},
		// Health monitoring synthetic rules
		{
			Name:        "cf.app.instances_down",
			Summary:     "Application instances are down",
			Description: "One or more application instances are in CRASHED or DOWN state, below the desired instance count.",
			Expr:        "cf.health.instances_down",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "app", "event_type": "health"},
		},
		{
			Name:        "cf.app.high_memory",
			Summary:     "Application memory usage above 90%",
			Description: "Application memory usage has exceeded 90% of the allocated quota. Consider scaling up.",
			Expr:        "cf.health.high_memory",
			Source:      "cloudfoundry",
			Category:    "performance",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "health"},
		},
		{
			Name:        "cf.app.high_disk",
			Summary:     "Application disk usage above 90%",
			Description: "Application disk usage has exceeded 90% of the allocated quota. Consider increasing disk allocation.",
			Expr:        "cf.health.high_disk",
			Source:      "cloudfoundry",
			Category:    "performance",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "health"},
		},
		// Log error synthetic rules
		{
			Name:        "cf.app.high_error_rate",
			Summary:     "Application has high error log rate",
			Description: "Application is generating a high rate of ERR log entries, indicating potential issues.",
			Expr:        "cf.log.high_error_rate",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "log_error"},
		},
		{
			Name:        "cf.app.critical_error",
			Summary:     "Critical error pattern detected in application logs",
			Description: "Application logs contain critical error patterns such as OOM, panics, connectivity failures, or timeouts.",
			Expr:        "cf.log.critical_error",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "app", "event_type": "log_error"},
		},
		// Build/Task/Service instance failure synthetic rules
		{
			Name:        "cf.build.failed",
			Summary:     "Application build staging failed",
			Description: "A Cloud Foundry application build has failed during staging. Check buildpack compatibility and application code.",
			Expr:        "cf.build.failed",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "build", "event_type": "build_failure"},
		},
		{
			Name:        "cf.task.failed",
			Summary:     "Application task execution failed",
			Description: "A Cloud Foundry task has failed. Check the failure reason and application logs.",
			Expr:        "cf.task.failed",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityWarning,
			Labels:      map[string]string{"resource_type": "app", "event_type": "task_failure"},
		},
		{
			Name:        "cf.service_instance.operation_failed",
			Summary:     "Service instance operation failed",
			Description: "A Cloud Foundry service instance create, update, or delete operation has failed. Check service broker logs and configuration.",
			Expr:        "cf.service_instance.operation_failed",
			Source:      "cloudfoundry",
			Category:    "availability",
			Duration:    0 * time.Second,
			Severity:    providers.EventDefinitionSeverityCritical,
			Labels:      map[string]string{"resource_type": "service_instance", "event_type": "service_instance_failure"},
		},
	}
}
