"""
Cybersecurity threat analysis and explainability engine:
Generates risk severity assessments, behavioral threat summaries, and actionable
SOC/CSIRT incident response playbooks.
"""

from typing import Dict, Any, List
from src.feature_engineering import extract_threat_indicators


def assess_threat_level(predicted_class: str, probabilities: Dict[str, float], indicators: Dict[str, Any]) -> Dict[str, Any]:
    """
    Synthesizes machine learning probabilities with deterministic threat indicators
    to determine the operational risk level and defense recommendations.
    """
    susp_prob = probabilities.get("Suspicious", 0.0)
    spam_prob = probabilities.get("Spam", 0.0)
    legit_prob = probabilities.get("Legitimate", 0.0)

    # Base severity mapping
    if predicted_class == "Suspicious" or susp_prob >= 0.50:
        if indicators["credential_count"] > 0 or indicators["financial_count"] > 0 or indicators["ip_url_count"] > 0:
            severity = "CRITICAL THREAT"
            badge_color = "#e53e3e"  # Deep red
            risk_score = min(round(8.5 + susp_prob * 1.5, 1), 10.0)
            summary = "Critical Business Email Compromise (BEC) or credential harvesting threat detected."
        else:
            severity = "HIGH THREAT"
            badge_color = "#dd6b20"  # Orange
            risk_score = min(round(7.0 + susp_prob * 2.0, 1), 9.0)
            summary = "High probability phishing attempt with social engineering characteristics."
    elif predicted_class == "Spam" or spam_prob >= 0.50:
        severity = "MODERATE RISK"
        badge_color = "#d69e2e"  # Amber/Yellow
        risk_score = round(3.5 + spam_prob * 2.5, 1)
        summary = "Unsolicited commercial email or promotional spam message."
    else:
        severity = "LOW RISK"
        badge_color = "#38a169"  # Emerald green
        risk_score = round(max(0.5, 10.0 - (legit_prob * 9.5)), 1)
        summary = "Legitimate business or personal communication with normal linguistic markers."

    # Generate actionable defensive guidance
    recommendations = generate_recommendations(predicted_class, indicators, severity)

    return {
        "severity": severity,
        "badge_color": badge_color,
        "risk_score_out_of_10": risk_score,
        "summary": summary,
        "recommendations": recommendations
    }


def generate_recommendations(predicted_class: str, indicators: Dict[str, Any], severity: str) -> List[str]:
    """
    Generates SOC / CSIRT security playbook action items tailored to detected signals.
    """
    recs = []

    if severity in ["CRITICAL THREAT", "HIGH THREAT"]:
        recs.append("DO NOT click any embedded hyperlinks or access external portals.")
        recs.append("DO NOT download or execute any attached files (archives, documents, scripts).")
        recs.append("Forward this message as an RFC 822 attachment to your SOC abuse mailbox (e.g., abuse@yourcompany.com).")
        
        if indicators["financial_count"] > 0:
            recs.append("DO NOT process wire transfers or banking changes without verbal out-of-band verification via official phone channels.")
        if indicators["credential_count"] > 0:
            recs.append("If you entered login credentials on any linked webpage, immediately change your corporate password and revoke active sessions.")
        if indicators["ip_url_count"] > 0 or indicators["shortened_url_count"] > 0:
            recs.append("The email contains raw IP or shortened redirect links commonly used to bypass reputation filters.")
            
        recs.append("Report sender domain to IT Security to initiate domain-wide gateway quarantine.")

    elif severity == "MODERATE RISK":
        recs.append("Mark message as Junk / Spam to update local filtering rules.")
        recs.append("Do not reply to this email, as confirmation validates your active inbox to bulk senders.")
        recs.append("Avoid clicking unsubscribed links on unverified senders; use your email client's native block feature instead.")
        recs.append("Never share sensitive personal or corporate data with unknown commercial vendors.")

    else:  # LOW RISK / LEGITIMATE
        recs.append("Standard business communication; safe to process under normal workflow.")
        recs.append("Verify unfamiliar external senders if unanticipated attachments or requests arrive.")
        recs.append("Maintain good cybersecurity hygiene by verifying sender address headers.")

    return recs