<?php
/**
 * DbTablesSchema — Infrastructure tables schema.
 *
 * These are cross-cutting tables not owned by any single feature module:
 *   • security_logs     — general security event log
 *   • audit_logs        — admin action audit trail
 *   • security_alerts   — user-facing alert notifications
 *   • security_events   — real-time event stream
 *
 * @package UltraguardPro\modules\db_tables\schema
 */

namespace UltraguardPro\modules\db_tables\schema;

use UltraguardPro\modules\core\AbstractModuleSchema;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class DbTablesSchema extends AbstractModuleSchema {

    public function get_module_id(): string { return 'db_tables'; }

    public function get_table_map(): array {
        return [
            'security_logs'    => \UltraguardPro\modules\db_tables\db\SecurityLogsTable::class,
            'audit_logs'       => \UltraguardPro\modules\db_tables\db\AuditLogsTable::class,
            'security_alerts'  => \UltraguardPro\modules\db_tables\db\SecurityAlertsTable::class,
            'security_events'  => \UltraguardPro\modules\db_tables\db\SecurityEventsTable::class,
            'threat_ips'       => \UltraguardPro\modules\db_tables\db\ThreatIpsTable::class,
        ];
    }

    public function get_schemas(): array {
        $cs = $this->charset_collate();
        return [
            $this->table( 'ultraguard_security_logs' ) => "CREATE TABLE {$this->table('ultraguard_security_logs')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  event_type varchar(100) NOT NULL DEFAULT '',
  severity varchar(20) NOT NULL DEFAULT 'info',
  message text NOT NULL,
  ip_address varchar(45) DEFAULT NULL,
  user_id bigint(20) UNSIGNED DEFAULT NULL,
  context longtext DEFAULT NULL,
  module varchar(50) DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_event_type (event_type),
  KEY idx_severity (severity),
  KEY idx_ip_address (ip_address(20)),
  KEY idx_user_id (user_id),
  KEY idx_module (module),
  KEY idx_created_at (created_at)
) {$cs};",

            $this->table( 'ultraguard_audit_logs' ) => "CREATE TABLE {$this->table('ultraguard_audit_logs')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  action varchar(100) NOT NULL DEFAULT '',
  entity_type varchar(50) NOT NULL DEFAULT '',
  entity_id varchar(100) DEFAULT NULL,
  user_id bigint(20) UNSIGNED DEFAULT NULL,
  ip_address varchar(45) DEFAULT NULL,
  old_values longtext DEFAULT NULL,
  new_values longtext DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_action (action),
  KEY idx_entity_type (entity_type),
  KEY idx_user_id (user_id),
  KEY idx_created_at (created_at)
) {$cs};",

            $this->table( 'ultraguard_security_alerts' ) => "CREATE TABLE {$this->table('ultraguard_security_alerts')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  alert_type varchar(100) NOT NULL DEFAULT '',
  severity varchar(20) NOT NULL DEFAULT 'medium',
  title varchar(255) NOT NULL DEFAULT '',
  message text NOT NULL,
  is_read tinyint(1) NOT NULL DEFAULT 0,
  resolved tinyint(1) NOT NULL DEFAULT 0,
  resolved_by bigint(20) UNSIGNED DEFAULT NULL,
  module varchar(50) DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_alert_type (alert_type),
  KEY idx_severity (severity),
  KEY idx_is_read (is_read),
  KEY idx_resolved (resolved),
  KEY idx_module (module)
) {$cs};",

            $this->table( 'ultraguard_security_events' ) => "CREATE TABLE {$this->table('ultraguard_security_events')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  event_type varchar(100) NOT NULL DEFAULT '',
  severity varchar(20) NOT NULL DEFAULT 'info',
  ip_address varchar(45) DEFAULT NULL,
  user_id bigint(20) UNSIGNED DEFAULT NULL,
  details longtext DEFAULT NULL,
  module varchar(50) DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_event_type (event_type),
  KEY idx_ip_address (ip_address(20)),
  KEY idx_module (module),
  KEY idx_created_at (created_at)
) {$cs};",

            $this->table( 'ultraguard_threat_ips' ) => "CREATE TABLE {$this->table('ultraguard_threat_ips')} (
  id           bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  ip_address   varchar(45)         NOT NULL DEFAULT '',
  cidr_range   varchar(50)                  DEFAULT NULL,
  source       varchar(30)         NOT NULL DEFAULT 'cloud_blacklist',
  threat_level varchar(20)         NOT NULL DEFAULT 'medium',
  attack_types longtext                     DEFAULT NULL,
  report_count int(11) UNSIGNED    NOT NULL DEFAULT 1,
  country_code varchar(5)                   DEFAULT NULL,
  is_active    tinyint(1)          NOT NULL DEFAULT 1,
  first_seen   datetime                     DEFAULT NULL,
  last_seen    datetime                     DEFAULT NULL,
  expires_at   datetime                     DEFAULT NULL,
  synced_at    datetime                     DEFAULT NULL,
  created_at   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  UNIQUE KEY idx_ip_address  (ip_address),
  KEY idx_source       (source),
  KEY idx_threat_level (threat_level),
  KEY idx_is_active    (is_active),
  KEY idx_expires_at   (expires_at),
  KEY idx_synced_at    (synced_at),
  KEY idx_country_code (country_code)
) {$cs};",
        ];
    }
}
