"""Security event classification shared by writers and monitoring APIs."""

from __future__ import annotations

from app.services.ip_location import IpLocation


SENSITIVE_PROBE_MARKERS = (
    "/.env",
    ".env",
    "/.git",
    ".git/config",
    "backup",
    "config.php",
    "wp-config",
    "database.yml",
)

def classify_security_event(
    *,
    path: str,
    status_code: int,
    auth_status: str,
    ip_location: IpLocation | None = None,
) -> dict[str, str]:
    normalized_path = (path or "").lower()
    if any(marker in normalized_path for marker in SENSITIVE_PROBE_MARKERS):
        return {"category": "PROBE", "severity": "CRITICAL"}
    if status_code >= 500:
        return {"category": "SERVER_ERROR", "severity": "HIGH"}
    if auth_status == "INVALID_TOKEN":
        return {"category": "INVALID_TOKEN", "severity": "MEDIUM"}
    if auth_status == "ANONYMOUS" and status_code in {401, 403}:
        return {"category": "ANONYMOUS_API", "severity": "MEDIUM"}
    if status_code == 404:
        return {"category": "NOT_FOUND_NOISE", "severity": "LOW"}
    return {"category": "OTHER", "severity": "LOW"}