from pydantic import Field, model_validator
from typing import Optional, List, Self

from .flowsint_base import FlowsintType
from .registry import flowsint_type


@flowsint_type
class Malware(FlowsintType):
    """Represents malware with family, capabilities, and threat intelligence."""

    name: str = Field(..., description="Malware name or identifier", title="Name", json_schema_extra={"primary": True})
    family: Optional[str] = Field(None, description="Malware family", title="Family")
    type: Optional[str] = Field(
        None, description="Type of malware (trojan, ransomware, etc.)", title="Type"
    )
    description: Optional[str] = Field(
        None, description="Malware description", title="Description"
    )
    first_seen: Optional[str] = Field(
        None, description="First time malware was observed", title="First Seen"
    )
    last_seen: Optional[str] = Field(
        None, description="Last time malware was observed", title="Last Seen"
    )
    is_active: Optional[bool] = Field(
        None, description="Whether malware is currently active", title="Is Active"
    )
    threat_level: Optional[str] = Field(
        None, description="Threat level assessment", title="Threat Level"
    )
    targets: Optional[List[str]] = Field(
        None, description="Target platforms or systems", title="Targets"
    )
    capabilities: Optional[List[str]] = Field(
        None, description="Malware capabilities", title="Capabilities"
    )
    indicators: Optional[List[str]] = Field(
        None, description="IOCs (Indicators of Compromise)", title="Indicators"
    )
    c2_servers: Optional[List[str]] = Field(
        None, description="Command and control servers", title="C2 Servers"
    )
    distribution_methods: Optional[List[str]] = Field(
        None, description="Distribution methods", title="Distribution Methods"
    )
    evasion_techniques: Optional[List[str]] = Field(
        None, description="Evasion techniques used", title="Evasion Techniques"
    )
    persistence_mechanisms: Optional[List[str]] = Field(
        None, description="Persistence mechanisms", title="Persistence Mechanisms"
    )
    encryption_methods: Optional[List[str]] = Field(
        None, description="Encryption methods used", title="Encryption Methods"
    )
    source: Optional[str] = Field(
        None, description="Source of malware information", title="Source"
    )
    analysis_report: Optional[str] = Field(
        None, description="Link to analysis report", title="Analysis Report"
    )
    sample_hashes: Optional[List[str]] = Field(
        None, description="Sample file hashes", title="Sample Hashes"
    )

    @model_validator(mode='after')
    def compute_label(self) -> Self:
        if self.family:
            self.nodeLabel = f"{self.name} ({self.family})"
        else:
            self.nodeLabel = self.name
        return self

    @classmethod
    def from_string(cls, line: str):
        """Parse a malware from a raw string."""
        return cls(name=line.strip())

    @classmethod
    def detect(cls, line: str) -> bool:
        """Malware cannot be reliably detected from a single line of text."""
        return False
