<?php
/**
 * VulnerabilitySchema — DB schema for the Vulnerability Scanner module.
 *
 * Owns:
 *   • ultraguard_vulnerability_results — per-component CVE findings
 *   • ultraguard_virtual_patches       — active WAF rule overrides for unpatched CVEs
 *
 * @package UltraguardPro\modules\vulnerability\schema
 */

namespace UltraguardPro\modules\vulnerability\schema;

use UltraguardPro\modules\core\AbstractModuleSchema;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class VulnerabilitySchema extends AbstractModuleSchema {

    public function get_module_id(): string { return 'vulnerability'; }

    public function get_table_map(): array {
        return [
            'vulnerability_results' => \UltraguardPro\modules\vulnerability\db\VulnerabilityResultsTable::class,
            'virtual_patches'       => \UltraguardPro\modules\vulnerability\db\VirtualPatchesTable::class,
        ];
    }

    public function get_schemas(): array {
        $cs = $this->charset_collate();

        return [

            // ── vulnerability_results ─────────────────────────────────────────
            $this->table( 'ultraguard_vulnerability_results' ) =>
            "CREATE TABLE {$this->table('ultraguard_vulnerability_results')} (
  id                     BIGINT UNSIGNED  NOT NULL AUTO_INCREMENT,
  component_type         ENUM('plugin','theme','core') NOT NULL DEFAULT 'plugin',
  component_slug         VARCHAR(200)     NOT NULL DEFAULT '',
  component_version      VARCHAR(50)      DEFAULT NULL,
  cve_id                 VARCHAR(50)      DEFAULT NULL,
  cvss_score             FLOAT            DEFAULT NULL,
  severity               ENUM('low','medium','high','critical') NOT NULL DEFAULT 'medium',
  title                  VARCHAR(300)     NOT NULL DEFAULT '',
  description            TEXT             DEFAULT NULL,
  `references`           TEXT             DEFAULT NULL,
  patched_in_version     VARCHAR(50)      DEFAULT NULL,
  is_exploitable         TINYINT(1)       NOT NULL DEFAULT 0,
  virtual_patch_active   TINYINT(1)       NOT NULL DEFAULT 0,
  status                 ENUM('open','patched','ignored','virtual_patched') NOT NULL DEFAULT 'open',
  first_seen             DATETIME         NOT NULL DEFAULT CURRENT_TIMESTAMP,
  last_checked           DATETIME         NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  created_at             DATETIME         NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at             DATETIME         NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_component_slug   (component_slug(100)),
  KEY idx_component_type   (component_type),
  KEY idx_severity         (severity),
  KEY idx_status           (status),
  KEY idx_cve_id           (cve_id),
  KEY idx_status_created   (status, created_at),
  KEY idx_created_at       (created_at)
) {$cs};",

            // ── virtual_patches ───────────────────────────────────────────────
            $this->table( 'ultraguard_virtual_patches' ) =>
            "CREATE TABLE {$this->table('ultraguard_virtual_patches')} (
  id                      BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
  cve_id                  VARCHAR(50)     NOT NULL DEFAULT '',
  component_slug          VARCHAR(200)    NOT NULL DEFAULT '',
  component_version_range VARCHAR(100)    DEFAULT NULL,
  waf_rule_id             BIGINT UNSIGNED DEFAULT NULL,
  applied_at              DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
  expires_at              DATETIME        DEFAULT NULL,
  created_at              DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at              DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  UNIQUE KEY idx_cve_id    (cve_id),
  KEY idx_component_slug   (component_slug(100)),
  KEY idx_expires_at       (expires_at),
  KEY idx_created_at       (created_at)
) {$cs};",

        ];
    }
}
