<?php
/**
 * FirewallSchema — DB schema for the Firewall module.
 *
 * Owns:
 *   • firewall_rules      — allow/block rules, WAF patterns
 *   • firewall_logs       — every request evaluated by the firewall
 *   • blocked_requests    — requests that were blocked
 *   • ip_blacklist        — manually and auto-blocked IP addresses
 *   • ip_whitelist        — trusted IP addresses
 *   • attack_patterns     — detected attack signatures
 *   • geolocation_data    — IP-to-country cache
 *   • rate_limiting       — per-IP request rate counters
 *
 * @package UltraguardPro\modules\firewall\schema
 */

namespace UltraguardPro\modules\firewall\schema;

use UltraguardPro\modules\core\AbstractModuleSchema;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class FirewallSchema extends AbstractModuleSchema {

    public function get_module_id(): string { return 'firewall'; }

    public function get_table_map(): array {
        return [
            'firewall_rules'    => \UltraguardPro\modules\firewall\db\FirewallRulesTable::class,
            'firewall_logs'     => \UltraguardPro\modules\firewall\db\FirewallLogsTable::class,
            'blocked_requests'  => \UltraguardPro\modules\firewall\db\BlockedRequestsTable::class,
            'ip_blacklist'      => \UltraguardPro\modules\firewall\db\IpBlacklistTable::class,
            'ip_whitelist'      => \UltraguardPro\modules\firewall\db\IpWhitelistTable::class,
            'attack_patterns'   => \UltraguardPro\modules\firewall\db\AttackPatternsTable::class,
            'geolocation_data'  => \UltraguardPro\modules\firewall\db\GeolocationDataTable::class,
            'rate_limiting'     => \UltraguardPro\modules\firewall\db\RateLimitingTable::class,
        ];
    }

    public function get_schemas(): array {
        $cs = $this->charset_collate();
        return [

            $this->table( 'ultraguard_firewall_rules' ) =>
            "CREATE TABLE {$this->table('ultraguard_firewall_rules')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  name varchar(255) NOT NULL DEFAULT '',
  description text DEFAULT NULL,
  rule_type varchar(50) NOT NULL DEFAULT 'block',
  match_field varchar(50) NOT NULL DEFAULT 'ip',
  match_operator varchar(20) NOT NULL DEFAULT 'equals',
  match_value text NOT NULL,
  action varchar(20) NOT NULL DEFAULT 'block',
  priority int(11) NOT NULL DEFAULT 100,
  is_active tinyint(1) NOT NULL DEFAULT 1,
  hits_count bigint(20) UNSIGNED NOT NULL DEFAULT 0,
  last_hit_at datetime DEFAULT NULL,
  created_by bigint(20) UNSIGNED DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_rule_type (rule_type),
  KEY idx_is_active (is_active),
  KEY idx_priority (priority),
  KEY idx_action (action)
) {$cs};",

            $this->table( 'ultraguard_firewall_logs' ) =>
            "CREATE TABLE {$this->table('ultraguard_firewall_logs')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  ip_address varchar(45) NOT NULL DEFAULT '',
  request_method varchar(10) NOT NULL DEFAULT 'GET',
  request_uri text NOT NULL,
  user_agent text DEFAULT NULL,
  rule_id bigint(20) UNSIGNED DEFAULT NULL,
  action varchar(20) NOT NULL DEFAULT 'allowed',
  threat_level varchar(20) NOT NULL DEFAULT 'none',
  country_code varchar(5) DEFAULT NULL,
  user_id bigint(20) UNSIGNED DEFAULT NULL,
  response_code int(11) DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_ip_address (ip_address(20)),
  KEY idx_action (action),
  KEY idx_threat_level (threat_level),
  KEY idx_rule_id (rule_id),
  KEY idx_created_at (created_at)
) {$cs};",

            $this->table( 'ultraguard_blocked_requests' ) =>
            "CREATE TABLE {$this->table('ultraguard_blocked_requests')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  ip_address varchar(45) NOT NULL DEFAULT '',
  request_method varchar(10) NOT NULL DEFAULT 'GET',
  request_uri text NOT NULL,
  user_agent text DEFAULT NULL,
  block_reason varchar(255) NOT NULL DEFAULT '',
  rule_id bigint(20) UNSIGNED DEFAULT NULL,
  threat_level varchar(20) NOT NULL DEFAULT 'medium',
  country_code varchar(5) DEFAULT NULL,
  user_id bigint(20) UNSIGNED DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_ip_address (ip_address(20)),
  KEY idx_block_reason (block_reason(50)),
  KEY idx_threat_level (threat_level),
  KEY idx_created_at (created_at)
) {$cs};",

            $this->table( 'ultraguard_ip_blacklist' ) =>
            "CREATE TABLE {$this->table('ultraguard_ip_blacklist')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  ip_address varchar(45) NOT NULL DEFAULT '',
  ip_range varchar(50) DEFAULT NULL,
  reason varchar(255) NOT NULL DEFAULT '',
  source varchar(50) NOT NULL DEFAULT 'manual',
  severity varchar(20) NOT NULL DEFAULT 'medium',
  is_active tinyint(1) NOT NULL DEFAULT 1,
  expires_at datetime DEFAULT NULL,
  hits_count bigint(20) UNSIGNED NOT NULL DEFAULT 0,
  last_hit_at datetime DEFAULT NULL,
  added_by bigint(20) UNSIGNED DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  UNIQUE KEY idx_ip_address (ip_address),
  KEY idx_is_active (is_active),
  KEY idx_source (source),
  KEY idx_expires_at (expires_at)
) {$cs};",

            $this->table( 'ultraguard_ip_whitelist' ) =>
            "CREATE TABLE {$this->table('ultraguard_ip_whitelist')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  ip_address varchar(45) NOT NULL DEFAULT '',
  ip_range varchar(50) DEFAULT NULL,
  label varchar(255) NOT NULL DEFAULT '',
  is_active tinyint(1) NOT NULL DEFAULT 1,
  added_by bigint(20) UNSIGNED DEFAULT NULL,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  UNIQUE KEY idx_ip_address (ip_address),
  KEY idx_is_active (is_active)
) {$cs};",

            $this->table( 'ultraguard_attack_patterns' ) =>
            "CREATE TABLE {$this->table('ultraguard_attack_patterns')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  pattern_name varchar(255) NOT NULL DEFAULT '',
  pattern_type varchar(50) NOT NULL DEFAULT 'regex',
  pattern_value text NOT NULL,
  attack_category varchar(100) NOT NULL DEFAULT '',
  severity varchar(20) NOT NULL DEFAULT 'medium',
  is_active tinyint(1) NOT NULL DEFAULT 1,
  match_count bigint(20) UNSIGNED NOT NULL DEFAULT 0,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  KEY idx_attack_category (attack_category),
  KEY idx_severity (severity),
  KEY idx_is_active (is_active)
) {$cs};",

            $this->table( 'ultraguard_geolocation_data' ) =>
            "CREATE TABLE {$this->table('ultraguard_geolocation_data')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  ip_address varchar(45) NOT NULL DEFAULT '',
  country_code varchar(5) DEFAULT NULL,
  country_name varchar(100) DEFAULT NULL,
  region varchar(100) DEFAULT NULL,
  city varchar(100) DEFAULT NULL,
  isp varchar(255) DEFAULT NULL,
  is_proxy tinyint(1) NOT NULL DEFAULT 0,
  is_tor tinyint(1) NOT NULL DEFAULT 0,
  threat_score int(3) NOT NULL DEFAULT 0,
  cached_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  UNIQUE KEY idx_ip_address (ip_address),
  KEY idx_country_code (country_code),
  KEY idx_cached_at (cached_at)
) {$cs};",

            $this->table( 'ultraguard_rate_limiting' ) =>
            "CREATE TABLE {$this->table('ultraguard_rate_limiting')} (
  id bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
  ip_address varchar(45) NOT NULL DEFAULT '',
  endpoint varchar(255) NOT NULL DEFAULT '',
  request_count int(11) NOT NULL DEFAULT 1,
  window_start datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  window_end datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  is_blocked tinyint(1) NOT NULL DEFAULT 0,
  created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (id),
  UNIQUE KEY idx_ip_endpoint (ip_address, endpoint(191)),
  KEY idx_is_blocked (is_blocked),
  KEY idx_window_end (window_end)
) {$cs};",
        ];
    }
}
