using System.Text.Json;
using webApiGateway.Objects.Objects;

namespace ms_mappingservice.Mapping;

/// <summary>
/// Provides a mapping from log source names to query strings.
/// </summary>
public class QueryMapping
{
    /// <summary>
    /// Represents the logger instance for this class.
    /// </summary>
    private static ILogger Logger = Logging.LoggerFactory.CreateLogger<QueryMapping>();

    /// <summary>
    /// Returns the query string corresponding to the specified log source for use case mapping.
    /// </summary>
    /// <param name="logSource">The log source to map.</param>
    /// <returns>The query string for the log source, or "null" if the log source cannot be mapped.</returns>
    public static async Task<string> GetQuery(LogSource logSource)
    {
        //Mapping the VALUES in own log source categorization and for log sources contained GUI to its SIGMA rules value
        Dictionary<string, string> values = new Dictionary<string, string>()
        {
            {"Amazon Web Service", "aws, cloudtrail" },
            {"Microsoft Azure", "azure" },
            {"Python Application", "python" },
            {"Google Cloud", "gcp, gcp.audit" },
            {"GitHub", "github, audit" },
            {"Google Workspace", "google_workspace, google_workspace.admin" },
            {"Java Virtual Machine", "jvm, application" },
            {"Microsoft 365", "m365" },
            {"Spring Application", "spring, application" },
            {"Web server", "webserver" },
            {"Apache", "apache" },
            {"Networking hardware", "nhw" },
            {"Database server", "database" },
            {"DNS server", "dns" },
            {"Proxy server", "proxy" },
            {"Antivirus", "antivirus" },
            {"IAM", "okta" },
            {"SSO", "onelogin, onelogin.events" },
            {"Zeek", "zeek" },
            {"RPC Firewall", "rpc_firewall, application" },
            {"Firewall", "firewall" },
            {"IDS", "ids" },
            {"Linux","linux"},
            {"Windows","windows"},
            {"MacOS","macos"}
        };
        
        string query = string.Empty;
        
        //Getting the value
        if (values.TryGetValue(logSource.Name, out query))
        {
            return query;
        }
        else
        {
            query = "null"; //Returning null, if the log source cannot be mapped to SIGMA rules.
            Logger.LogError("Log source {0} cannot be mapped into Sigma log sources for this application.", JsonSerializer.Serialize(logSource)); //Log
        }

        return query;
    }
}