<?php
/**
 * AntivirusSchema — DB schema for the Antivirus module.
 *
 * Owns:
 *   • scan_results        — per-file scan findings
 *   • quarantine          — isolated malicious files
 *   • malware_signatures  — known threat signature hashes and patterns
 *   • vulnerability_scans — plugin/theme/core CVE findings
 *
 * @package UltraguardPro\modules\antivirus\schema
 */

namespace UltraguardPro\modules\antivirus\schema;

use UltraguardPro\modules\core\AbstractModuleSchema;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class AntivirusSchema extends AbstractModuleSchema {

    public function get_module_id(): string { return 'antivirus'; }

    public function get_table_map(): array {
        return [
            'scan_results'        => \UltraguardPro\modules\antivirus\db\ScanResultsTable::class,
            'quarantine'          => \UltraguardPro\modules\antivirus\db\QuarantineTable::class,
            'malware_signatures'  => \UltraguardPro\modules\antivirus\db\MalwareSignaturesTable::class,
            'vulnerability_scans' => \UltraguardPro\modules\antivirus\db\VulnerabilityScansTable::class,
        ];
    }

    public function get_schemas(): array {
        $cs = $this->charset_collate();

        return [

            // ── scan_results ──────────────────────────────────────────────────
            $this->table( 'ultraguard_scan_results' ) =>
            "CREATE TABLE {$this->table('ultraguard_scan_results')} (
  id                bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  scan_id           varchar(64)  NOT NULL DEFAULT '',
  scan_type         varchar(50)  NOT NULL DEFAULT 'full',
  file_path         text         NOT NULL,
  file_hash         varchar(64)  DEFAULT NULL,
  file_size         bigint(20)   UNSIGNED DEFAULT 0,
  threat_type       varchar(100) DEFAULT NULL,
  threat_level      varchar(20)  NOT NULL DEFAULT 'none',
  status            varchar(30)  NOT NULL DEFAULT 'pending',
  details           longtext     DEFAULT NULL,
  is_false_positive tinyint(1)   NOT NULL DEFAULT 0,
  created_by        bigint(20)   UNSIGNED DEFAULT NULL,
  created_at        datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at        datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_scan_id       (scan_id),
  KEY idx_scan_type     (scan_type),
  KEY idx_threat_level  (threat_level),
  KEY idx_status        (status),
  KEY idx_file_hash     (file_hash),
  KEY idx_created_at    (created_at)
) {$cs};",

            // ── quarantine ────────────────────────────────────────────────────
            $this->table( 'ultraguard_quarantine' ) =>
            "CREATE TABLE {$this->table('ultraguard_quarantine')} (
  id               bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  original_path    text         NOT NULL,
  quarantine_path  text         NOT NULL,
  file_hash        varchar(64)  DEFAULT NULL,
  file_size        bigint(20)   UNSIGNED DEFAULT 0,
  threat_type      varchar(100) DEFAULT NULL,
  threat_level     varchar(20)  NOT NULL DEFAULT 'medium',
  status           varchar(20)  NOT NULL DEFAULT 'active',
  clean_method     varchar(30)  DEFAULT NULL,
  cleaned_at       datetime     DEFAULT NULL,
  clean_backup_path text        DEFAULT NULL,
  restored_by      bigint(20)   UNSIGNED DEFAULT NULL,
  restore_reason   text         DEFAULT NULL,
  notes            text         DEFAULT NULL,
  created_at       datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at       datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_status        (status),
  KEY idx_threat_level  (threat_level),
  KEY idx_created_at    (created_at)
) {$cs};",

            // ── malware_signatures ────────────────────────────────────────────
            $this->table( 'ultraguard_malware_signatures' ) =>
            "CREATE TABLE {$this->table('ultraguard_malware_signatures')} (
  id              bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  signature_hash  varchar(128) NOT NULL DEFAULT '',
  name            varchar(255) NOT NULL DEFAULT '',
  type            varchar(50)  NOT NULL DEFAULT 'hash',
  pattern         text         DEFAULT NULL,
  threat_level    varchar(20)  NOT NULL DEFAULT 'medium',
  is_active       tinyint(1)   NOT NULL DEFAULT 1,
  source          varchar(100) DEFAULT NULL,
  hits_count      bigint(20)   UNSIGNED NOT NULL DEFAULT 0,
  created_at      datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at      datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  UNIQUE KEY idx_signature_hash (signature_hash),
  KEY idx_type         (type),
  KEY idx_threat_level (threat_level),
  KEY idx_is_active    (is_active),
  KEY idx_source       (source)
) {$cs};",

            // ── vulnerability_scans ───────────────────────────────────────────
            $this->table( 'ultraguard_vulnerability_scans' ) =>
            "CREATE TABLE {$this->table('ultraguard_vulnerability_scans')} (
  id                   bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  scan_id              varchar(64)  NOT NULL DEFAULT '',
  component_type       varchar(20)  NOT NULL DEFAULT 'plugin',
  component_slug       varchar(255) NOT NULL DEFAULT '',
  component_version    varchar(50)  DEFAULT NULL,
  vulnerability_type   varchar(100) DEFAULT NULL,
  severity             varchar(20)  NOT NULL DEFAULT 'medium',
  description          text         DEFAULT NULL,
  cve_id               varchar(50)  DEFAULT NULL,
  status               varchar(20)  NOT NULL DEFAULT 'open',
  remediation          text         DEFAULT NULL,
  created_at           datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at           datetime     NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_scan_id         (scan_id),
  KEY idx_component_type  (component_type),
  KEY idx_component_slug  (component_slug(100)),
  KEY idx_severity        (severity),
  KEY idx_status          (status),
  KEY idx_cve_id          (cve_id)
) {$cs};",

        ];
    }
}
