intercept/utils/bluetooth/models.py

"""
Bluetooth data models for the unified scanner.
"""

from __future__ import annotations

from dataclasses import dataclass, field
from datetime import datetime

# Import tracker types (will be available after tracker_signatures module loads)
# Use string type hints to avoid circular imports
from typing import TYPE_CHECKING

from .constants import (
    ADDRESS_TYPE_PUBLIC,
    MANUFACTURER_NAMES,
    PROTOCOL_BLE,
    PROXIMITY_UNKNOWN,
    RANGE_UNKNOWN,
    get_appearance_name,
)

if TYPE_CHECKING:
    pass


@dataclass
class BTObservation:
    """Represents a single Bluetooth advertisement or inquiry response."""

    timestamp: datetime
    address: str
    address_type: str = ADDRESS_TYPE_PUBLIC  # public, random, random_static, rpa, nrpa
    rssi: int | None = None
    tx_power: int | None = None
    name: str | None = None
    manufacturer_id: int | None = None
    manufacturer_data: bytes | None = None
    service_uuids: list[str] = field(default_factory=list)
    service_data: dict[str, bytes] = field(default_factory=dict)
    appearance: int | None = None
    is_connectable: bool = False
    is_paired: bool = False
    is_connected: bool = False
    class_of_device: int | None = None  # Classic BT only
    major_class: str | None = None
    minor_class: str | None = None
    adapter_id: str | None = None

    @property
    def device_id(self) -> str:
        """Unique device identifier combining address and type."""
        return f"{self.address}:{self.address_type}"

    @property
    def manufacturer_name(self) -> str | None:
        """Look up manufacturer name from ID."""
        if self.manufacturer_id is not None:
            return MANUFACTURER_NAMES.get(self.manufacturer_id)
        return None

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'timestamp': self.timestamp.isoformat(),
            'address': self.address,
            'address_type': self.address_type,
            'device_id': self.device_id,
            'rssi': self.rssi,
            'tx_power': self.tx_power,
            'name': self.name,
            'manufacturer_id': self.manufacturer_id,
            'manufacturer_name': self.manufacturer_name,
            'manufacturer_data': self.manufacturer_data.hex() if self.manufacturer_data else None,
            'service_uuids': self.service_uuids,
            'service_data': {k: v.hex() for k, v in self.service_data.items()},
            'appearance': self.appearance,
            'is_connectable': self.is_connectable,
            'is_paired': self.is_paired,
            'is_connected': self.is_connected,
            'class_of_device': self.class_of_device,
            'major_class': self.major_class,
            'minor_class': self.minor_class,
        }


@dataclass
class BTDeviceAggregate:
    """Aggregated Bluetooth device data over time."""

    device_id: str  # f"{address}:{address_type}"
    address: str
    address_type: str
    protocol: str = PROTOCOL_BLE  # 'ble' or 'classic'

    # Timestamps
    first_seen: datetime = field(default_factory=datetime.now)
    last_seen: datetime = field(default_factory=datetime.now)
    seen_count: int = 0
    seen_rate: float = 0.0  # observations per minute

    # RSSI aggregation (capped at MAX_RSSI_SAMPLES samples)
    rssi_samples: list[tuple[datetime, int]] = field(default_factory=list)
    rssi_current: int | None = None
    rssi_median: float | None = None
    rssi_min: int | None = None
    rssi_max: int | None = None
    rssi_variance: float | None = None
    rssi_confidence: float = 0.0  # 0.0-1.0

    # Range band (very_close/close/nearby/far/unknown) - legacy
    range_band: str = RANGE_UNKNOWN
    range_confidence: float = 0.0

    # Proximity band (new system: immediate/near/far/unknown)
    device_key: str | None = None
    proximity_band: str = PROXIMITY_UNKNOWN
    estimated_distance_m: float | None = None
    distance_confidence: float = 0.0
    rssi_ema: float | None = None
    rssi_60s_min: int | None = None
    rssi_60s_max: int | None = None
    is_randomized_mac: bool = False
    threat_tags: list[str] = field(default_factory=list)

    # Device info (merged from observations)
    name: str | None = None
    manufacturer_id: int | None = None
    manufacturer_name: str | None = None
    manufacturer_bytes: bytes | None = None
    service_uuids: list[str] = field(default_factory=list)
    tx_power: int | None = None
    appearance: int | None = None
    class_of_device: int | None = None
    major_class: str | None = None
    minor_class: str | None = None
    is_connectable: bool = False
    is_paired: bool = False
    is_connected: bool = False

    # Heuristic flags
    is_new: bool = False
    is_persistent: bool = False
    is_beacon_like: bool = False
    is_strong_stable: bool = False
    has_random_address: bool = False

    # Baseline tracking
    in_baseline: bool = False
    baseline_id: int | None = None
    seen_before: bool = False

    # Tracker detection fields
    is_tracker: bool = False
    tracker_type: str | None = None  # 'airtag', 'tile', 'samsung_smarttag', etc.
    tracker_name: str | None = None
    tracker_confidence: str | None = None  # 'high', 'medium', 'low', 'none'
    tracker_confidence_score: float = 0.0  # 0.0 to 1.0
    tracker_evidence: list[str] = field(default_factory=list)

    # Suspicious presence / following heuristics
    risk_score: float = 0.0  # 0.0 to 1.0
    risk_factors: list[str] = field(default_factory=list)

    # IRK (Identity Resolving Key) from paired device database
    irk_hex: str | None = None  # 32-char hex if known
    irk_source_name: str | None = None  # Name from paired DB

    # Payload fingerprint (survives MAC randomization)
    payload_fingerprint_id: str | None = None
    payload_fingerprint_stability: float = 0.0

    # Service data (for tracker analysis)
    service_data: dict[str, bytes] = field(default_factory=dict)

    def get_rssi_history(self, max_points: int = 50) -> list[dict]:
        """Get RSSI history for sparkline visualization."""
        if not self.rssi_samples:
            return []

        # Downsample if needed
        samples = self.rssi_samples[-max_points:]
        return [
            {'timestamp': ts.isoformat(), 'rssi': rssi}
            for ts, rssi in samples
        ]

    @property
    def age_seconds(self) -> float:
        """Seconds since last seen."""
        return (datetime.now() - self.last_seen).total_seconds()

    @property
    def duration_seconds(self) -> float:
        """Total duration from first to last seen."""
        return (self.last_seen - self.first_seen).total_seconds()

    @property
    def heuristic_flags(self) -> list[str]:
        """List of active heuristic flags."""
        flags = []
        if self.is_new:
            flags.append('new')
        if self.is_persistent:
            flags.append('persistent')
        if self.is_beacon_like:
            flags.append('beacon_like')
        if self.is_strong_stable:
            flags.append('strong_stable')
        if self.has_random_address:
            flags.append('random_address')
        return flags

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'device_id': self.device_id,
            'address': self.address,
            'address_type': self.address_type,
            'protocol': self.protocol,

            # Timestamps
            'first_seen': self.first_seen.isoformat(),
            'last_seen': self.last_seen.isoformat(),
            'age_seconds': self.age_seconds,
            'duration_seconds': self.duration_seconds,
            'seen_count': self.seen_count,
            'seen_rate': round(self.seen_rate, 2),

            # RSSI stats
            'rssi_current': self.rssi_current,
            'rssi_median': round(self.rssi_median, 1) if self.rssi_median else None,
            'rssi_min': self.rssi_min,
            'rssi_max': self.rssi_max,
            'rssi_variance': round(self.rssi_variance, 2) if self.rssi_variance else None,
            'rssi_confidence': round(self.rssi_confidence, 2),
            'rssi_history': self.get_rssi_history(),

            # Range (legacy)
            'range_band': self.range_band,
            'range_confidence': round(self.range_confidence, 2),

            # Proximity (new system)
            'device_key': self.device_key,
            'proximity_band': self.proximity_band,
            'estimated_distance_m': round(self.estimated_distance_m, 2) if self.estimated_distance_m else None,
            'distance_confidence': round(self.distance_confidence, 2),
            'rssi_ema': round(self.rssi_ema, 1) if self.rssi_ema else None,
            'rssi_60s_min': self.rssi_60s_min,
            'rssi_60s_max': self.rssi_60s_max,
            'is_randomized_mac': self.is_randomized_mac,
            'threat_tags': self.threat_tags,

            # Device info
            'name': self.name,
            'manufacturer_id': self.manufacturer_id,
            'manufacturer_name': self.manufacturer_name,
            'manufacturer_bytes': self.manufacturer_bytes.hex() if self.manufacturer_bytes else None,
            'service_uuids': self.service_uuids,
            'tx_power': self.tx_power,
            'appearance': self.appearance,
            'class_of_device': self.class_of_device,
            'major_class': self.major_class,
            'minor_class': self.minor_class,
            'is_connectable': self.is_connectable,
            'is_paired': self.is_paired,
            'is_connected': self.is_connected,

            # Heuristics
            'heuristics': {
                'is_new': self.is_new,
                'is_persistent': self.is_persistent,
                'is_beacon_like': self.is_beacon_like,
                'is_strong_stable': self.is_strong_stable,
                'has_random_address': self.has_random_address,
            },
            'heuristic_flags': self.heuristic_flags,

            # Baseline
            'in_baseline': self.in_baseline,
            'baseline_id': self.baseline_id,
            'seen_before': self.seen_before,

            # Tracker detection
            'tracker': {
                'is_tracker': self.is_tracker,
                'type': self.tracker_type,
                'name': self.tracker_name,
                'confidence': self.tracker_confidence,
                'confidence_score': round(self.tracker_confidence_score, 2),
                'evidence': self.tracker_evidence,
            },

            # Suspicious presence analysis
            'risk_analysis': {
                'risk_score': round(self.risk_score, 2),
                'risk_factors': self.risk_factors,
            },

            # IRK
            'has_irk': self.irk_hex is not None,
            'irk_hex': self.irk_hex,
            'irk_source_name': self.irk_source_name,

            # Fingerprint
            'fingerprint': {
                'id': self.payload_fingerprint_id,
                'stability': round(self.payload_fingerprint_stability, 2),
            },

            # Raw service data for investigation
            'service_data': {k: v.hex() for k, v in self.service_data.items()},
        }

    def to_summary_dict(self) -> dict:
        """Compact dictionary for list views."""
        return {
            'device_id': self.device_id,
            'device_key': self.device_key,
            'address': self.address,
            'address_type': self.address_type,
            'protocol': self.protocol,
            'name': self.name,
            'manufacturer_name': self.manufacturer_name,
            'rssi_current': self.rssi_current,
            'rssi_median': round(self.rssi_median, 1) if self.rssi_median else None,
            'rssi_ema': round(self.rssi_ema, 1) if self.rssi_ema else None,
            'rssi_min': self.rssi_min,
            'rssi_max': self.rssi_max,
            'rssi_variance': round(self.rssi_variance, 2) if self.rssi_variance else None,
            'range_band': self.range_band,
            'proximity_band': self.proximity_band,
            'estimated_distance_m': round(self.estimated_distance_m, 2) if self.estimated_distance_m else None,
            'distance_confidence': round(self.distance_confidence, 2),
            'is_randomized_mac': self.is_randomized_mac,
            'last_seen': self.last_seen.isoformat(),
            'first_seen': self.first_seen.isoformat(),
            'age_seconds': self.age_seconds,
            'duration_seconds': self.duration_seconds,
            'seen_count': self.seen_count,
            'seen_rate': round(self.seen_rate, 2),
            'tx_power': self.tx_power,
            'manufacturer_id': self.manufacturer_id,
            'appearance': self.appearance,
            'appearance_name': get_appearance_name(self.appearance),
            'is_connectable': self.is_connectable,
            'service_uuids': self.service_uuids,
            'service_data': {k: v.hex() for k, v in self.service_data.items()},
            'manufacturer_bytes': self.manufacturer_bytes.hex() if self.manufacturer_bytes else None,
            'heuristic_flags': self.heuristic_flags,
            'is_persistent': self.is_persistent,
            'is_beacon_like': self.is_beacon_like,
            'is_strong_stable': self.is_strong_stable,
            'in_baseline': self.in_baseline,
            'seen_before': self.seen_before,
            # Tracker info for list view
            'is_tracker': self.is_tracker,
            'tracker_type': self.tracker_type,
            'tracker_name': self.tracker_name,
            'tracker_confidence': self.tracker_confidence,
            'tracker_confidence_score': round(self.tracker_confidence_score, 2),
            'tracker_evidence': self.tracker_evidence,
            'risk_score': round(self.risk_score, 2),
            'risk_factors': self.risk_factors,
            'has_irk': self.irk_hex is not None,
            'irk_hex': self.irk_hex,
            'irk_source_name': self.irk_source_name,
            'fingerprint_id': self.payload_fingerprint_id,
        }


@dataclass
class ScanStatus:
    """Current scanning status."""

    is_scanning: bool = False
    mode: str = 'auto'  # 'dbus', 'bleak', 'hcitool', 'bluetoothctl', 'auto'
    backend: str | None = None  # Active backend being used
    adapter_id: str | None = None
    started_at: datetime | None = None
    duration_s: int | None = None
    devices_found: int = 0
    error: str | None = None

    @property
    def elapsed_seconds(self) -> float | None:
        """Seconds since scan started."""
        if self.started_at:
            return (datetime.now() - self.started_at).total_seconds()
        return None

    @property
    def remaining_seconds(self) -> float | None:
        """Seconds remaining if duration was set."""
        if self.duration_s and self.elapsed_seconds:
            return max(0, self.duration_s - self.elapsed_seconds)
        return None

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'is_scanning': self.is_scanning,
            'mode': self.mode,
            'backend': self.backend,
            'adapter_id': self.adapter_id,
            'started_at': self.started_at.isoformat() if self.started_at else None,
            'duration_s': self.duration_s,
            'elapsed_seconds': round(self.elapsed_seconds, 1) if self.elapsed_seconds else None,
            'remaining_seconds': round(self.remaining_seconds, 1) if self.remaining_seconds else None,
            'devices_found': self.devices_found,
            'error': self.error,
        }


@dataclass
class SystemCapabilities:
    """Bluetooth system capabilities check result."""

    # DBus/BlueZ
    has_dbus: bool = False
    has_bluez: bool = False
    bluez_version: str | None = None

    # Adapters
    adapters: list[dict] = field(default_factory=list)
    default_adapter: str | None = None

    # Permissions
    has_bluetooth_permission: bool = False
    is_root: bool = False

    # rfkill status
    is_soft_blocked: bool = False
    is_hard_blocked: bool = False

    # Fallback tools
    has_bleak: bool = False
    has_hcitool: bool = False
    has_bluetoothctl: bool = False
    has_btmgmt: bool = False
    has_ubertooth: bool = False

    # Recommended backend
    recommended_backend: str = 'none'

    # Issues found
    issues: list[str] = field(default_factory=list)

    @property
    def can_scan(self) -> bool:
        """Whether scanning is possible with any backend."""
        return (
            (self.has_dbus and self.has_bluez and len(self.adapters) > 0) or
            self.has_bleak or
            self.has_hcitool or
            self.has_bluetoothctl or
            self.has_ubertooth
        )

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'available': self.can_scan,  # Alias for frontend compatibility
            'can_scan': self.can_scan,
            'has_dbus': self.has_dbus,
            'has_bluez': self.has_bluez,
            'bluez_version': self.bluez_version,
            'adapters': self.adapters,
            'default_adapter': self.default_adapter,
            'has_bluetooth_permission': self.has_bluetooth_permission,
            'is_root': self.is_root,
            'is_soft_blocked': self.is_soft_blocked,
            'is_hard_blocked': self.is_hard_blocked,
            'has_bleak': self.has_bleak,
            'has_hcitool': self.has_hcitool,
            'has_bluetoothctl': self.has_bluetoothctl,
            'has_btmgmt': self.has_btmgmt,
            'has_ubertooth': self.has_ubertooth,
            'preferred_backend': self.recommended_backend,  # Alias for frontend
            'recommended_backend': self.recommended_backend,
            'issues': self.issues,
        }