intercept/utils/wifi/models.py

"""
WiFi data models for the unified scanner.
"""

from __future__ import annotations

from dataclasses import dataclass, field
from datetime import datetime

from .constants import (
    AUTH_UNKNOWN,
    BAND_UNKNOWN,
    CIPHER_UNKNOWN,
    PROXIMITY_UNKNOWN,
    SCAN_MODE_QUICK,
    SECURITY_UNKNOWN,
    SIGNAL_UNKNOWN,
    WIDTH_UNKNOWN,
    get_band_from_channel,
    get_vendor_from_mac,
)


@dataclass
class WiFiObservation:
    """Represents a single WiFi access point scan result."""

    timestamp: datetime
    bssid: str
    essid: str | None = None
    channel: int | None = None
    frequency_mhz: int | None = None
    rssi: int | None = None

    # Security
    security: str = SECURITY_UNKNOWN
    cipher: str = CIPHER_UNKNOWN
    auth: str = AUTH_UNKNOWN

    # Additional info
    width: str = WIDTH_UNKNOWN
    beacon_count: int = 0
    data_count: int = 0

    @property
    def is_hidden(self) -> bool:
        """Check if this is a hidden network."""
        return not self.essid or self.essid.strip() == ''

    @property
    def band(self) -> str:
        """Get WiFi band from channel."""
        if self.channel:
            return get_band_from_channel(self.channel)
        return BAND_UNKNOWN

    @property
    def vendor(self) -> str | None:
        """Get vendor name from BSSID."""
        return get_vendor_from_mac(self.bssid)

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'timestamp': self.timestamp.isoformat(),
            'bssid': self.bssid,
            'essid': self.essid,
            'is_hidden': self.is_hidden,
            'channel': self.channel,
            'frequency_mhz': self.frequency_mhz,
            'band': self.band,
            'rssi': self.rssi,
            'security': self.security,
            'cipher': self.cipher,
            'auth': self.auth,
            'width': self.width,
            'beacon_count': self.beacon_count,
            'data_count': self.data_count,
            'vendor': self.vendor,
        }


@dataclass
class WiFiAccessPoint:
    """Aggregated WiFi access point data over time."""

    # Identity
    bssid: str
    essid: str | None = None
    is_hidden: bool = False
    revealed_essid: str | None = None  # Revealed through correlation

    # Radio info
    channel: int | None = None
    frequency_mhz: int | None = None
    band: str = BAND_UNKNOWN
    width: str = WIDTH_UNKNOWN

    # Signal aggregation
    rssi_samples: list[tuple[datetime, int]] = field(default_factory=list)
    rssi_current: int | None = None
    rssi_median: float | None = None
    rssi_min: int | None = None
    rssi_max: int | None = None
    rssi_variance: float | None = None
    rssi_ema: float | None = None

    # Proximity/signal bands
    signal_band: str = SIGNAL_UNKNOWN
    proximity_band: str = PROXIMITY_UNKNOWN
    estimated_distance_m: float | None = None
    distance_confidence: float = 0.0

    # Security
    security: str = SECURITY_UNKNOWN
    cipher: str = CIPHER_UNKNOWN
    auth: str = AUTH_UNKNOWN

    # Timestamps
    first_seen: datetime = field(default_factory=datetime.now)
    last_seen: datetime = field(default_factory=datetime.now)
    seen_count: int = 0
    seen_rate: float = 0.0  # Observations per minute

    # Traffic stats
    beacon_count: int = 0
    data_count: int = 0
    client_count: int = 0

    # Metadata
    vendor: str | None = None

    # Heuristic flags
    heuristic_flags: list[str] = field(default_factory=list)
    is_new: bool = False
    is_persistent: bool = False
    is_strong_stable: bool = False

    # Baseline tracking
    in_baseline: bool = False
    baseline_id: int | None = None

    @property
    def display_name(self) -> str:
        """Get display name (revealed SSID, ESSID, or BSSID)."""
        if self.revealed_essid:
            return f"{self.revealed_essid} (revealed)"
        if self.essid and not self.is_hidden:
            return self.essid
        return f"[Hidden] {self.bssid}"

    @property
    def age_seconds(self) -> float:
        """Seconds since last seen."""
        return (datetime.now() - self.last_seen).total_seconds()

    @property
    def duration_seconds(self) -> float:
        """Total duration from first to last seen."""
        return (self.last_seen - self.first_seen).total_seconds()

    def get_rssi_history(self, max_points: int = 50) -> list[dict]:
        """Get RSSI history for visualization."""
        if not self.rssi_samples:
            return []
        samples = self.rssi_samples[-max_points:]
        return [
            {'timestamp': ts.isoformat(), 'rssi': rssi}
            for ts, rssi in samples
        ]

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            # Identity
            'bssid': self.bssid,
            'essid': self.essid,
            'display_name': self.display_name,
            'is_hidden': self.is_hidden,
            'revealed_essid': self.revealed_essid,

            # Radio
            'channel': self.channel,
            'frequency_mhz': self.frequency_mhz,
            'band': self.band,
            'width': self.width,

            # Signal
            'rssi_current': self.rssi_current,
            'rssi_median': round(self.rssi_median, 1) if self.rssi_median else None,
            'rssi_min': self.rssi_min,
            'rssi_max': self.rssi_max,
            'rssi_variance': round(self.rssi_variance, 2) if self.rssi_variance else None,
            'rssi_ema': round(self.rssi_ema, 1) if self.rssi_ema else None,
            'rssi_history': self.get_rssi_history(),

            # Proximity
            'signal_band': self.signal_band,
            'proximity_band': self.proximity_band,
            'estimated_distance_m': round(self.estimated_distance_m, 2) if self.estimated_distance_m else None,
            'distance_confidence': round(self.distance_confidence, 2),

            # Security
            'security': self.security,
            'cipher': self.cipher,
            'auth': self.auth,

            # Timestamps
            'first_seen': self.first_seen.isoformat(),
            'last_seen': self.last_seen.isoformat(),
            'age_seconds': round(self.age_seconds, 1),
            'duration_seconds': round(self.duration_seconds, 1),
            'seen_count': self.seen_count,
            'seen_rate': round(self.seen_rate, 2),

            # Traffic
            'beacon_count': self.beacon_count,
            'data_count': self.data_count,
            'client_count': self.client_count,

            # Metadata
            'vendor': self.vendor,

            # Heuristics
            'heuristic_flags': self.heuristic_flags,
            'heuristics': {
                'is_new': self.is_new,
                'is_persistent': self.is_persistent,
                'is_strong_stable': self.is_strong_stable,
            },

            # Baseline
            'in_baseline': self.in_baseline,
            'baseline_id': self.baseline_id,
        }

    def to_summary_dict(self) -> dict:
        """Compact dictionary for list views."""
        return {
            'bssid': self.bssid,
            'essid': self.essid,
            'display_name': self.display_name,
            'is_hidden': self.is_hidden,
            'channel': self.channel,
            'band': self.band,
            'rssi_current': self.rssi_current,
            'rssi_median': round(self.rssi_median, 1) if self.rssi_median else None,
            'signal_band': self.signal_band,
            'proximity_band': self.proximity_band,
            'security': self.security,
            'vendor': self.vendor,
            'client_count': self.client_count,
            'last_seen': self.last_seen.isoformat(),
            'age_seconds': round(self.age_seconds, 1),
            'heuristic_flags': self.heuristic_flags,
            'in_baseline': self.in_baseline,
        }

    def to_legacy_dict(self) -> dict:
        """Convert to legacy format for TSCM compatibility."""
        return {
            'bssid': self.bssid,
            'essid': self.essid or '',
            'vendor': self.vendor,
            'power': str(self.rssi_current) if self.rssi_current else '-100',
            'channel': str(self.channel) if self.channel else '',
            'privacy': self.security,
            'first_seen': self.first_seen.isoformat() if self.first_seen else '',
            'last_seen': self.last_seen.isoformat() if self.last_seen else '',
            'beacon_count': str(self.beacon_count),
            'lan_ip': '',  # Not tracked in new system
        }


@dataclass
class WiFiClient:
    """WiFi client (station) observed during scanning."""

    # Identity
    mac: str
    vendor: str | None = None

    # Signal
    rssi_samples: list[tuple[datetime, int]] = field(default_factory=list)
    rssi_current: int | None = None
    rssi_median: float | None = None
    rssi_min: int | None = None
    rssi_max: int | None = None
    rssi_ema: float | None = None

    # Proximity
    signal_band: str = SIGNAL_UNKNOWN
    proximity_band: str = PROXIMITY_UNKNOWN
    estimated_distance_m: float | None = None

    # Association
    associated_bssid: str | None = None
    is_associated: bool = False

    # Probes
    probed_ssids: list[str] = field(default_factory=list)
    probe_timestamps: dict[str, datetime] = field(default_factory=dict)

    # Timestamps
    first_seen: datetime = field(default_factory=datetime.now)
    last_seen: datetime = field(default_factory=datetime.now)
    seen_count: int = 0

    # Traffic stats
    packets_sent: int = 0
    packets_received: int = 0

    # Heuristics
    heuristic_flags: list[str] = field(default_factory=list)

    @property
    def age_seconds(self) -> float:
        """Seconds since last seen."""
        return (datetime.now() - self.last_seen).total_seconds()

    def get_rssi_history(self, max_points: int = 50) -> list[dict]:
        """Get RSSI history for visualization."""
        if not self.rssi_samples:
            return []
        samples = self.rssi_samples[-max_points:]
        return [
            {'timestamp': ts.isoformat(), 'rssi': rssi}
            for ts, rssi in samples
        ]

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'mac': self.mac,
            'vendor': self.vendor,

            # Signal
            'rssi_current': self.rssi_current,
            'rssi_median': round(self.rssi_median, 1) if self.rssi_median else None,
            'rssi_min': self.rssi_min,
            'rssi_max': self.rssi_max,
            'rssi_ema': round(self.rssi_ema, 1) if self.rssi_ema else None,
            'rssi_history': self.get_rssi_history(),

            # Proximity
            'signal_band': self.signal_band,
            'proximity_band': self.proximity_band,
            'estimated_distance_m': round(self.estimated_distance_m, 2) if self.estimated_distance_m else None,

            # Association
            'associated_bssid': self.associated_bssid,
            'is_associated': self.is_associated,

            # Probes
            'probed_ssids': self.probed_ssids,
            'probe_count': len(self.probed_ssids),

            # Timestamps
            'first_seen': self.first_seen.isoformat(),
            'last_seen': self.last_seen.isoformat(),
            'age_seconds': round(self.age_seconds, 1),
            'seen_count': self.seen_count,

            # Traffic
            'packets_sent': self.packets_sent,
            'packets_received': self.packets_received,

            # Heuristics
            'heuristic_flags': self.heuristic_flags,
        }


@dataclass
class WiFiProbeRequest:
    """A single probe request captured during scanning."""

    timestamp: datetime
    client_mac: str
    probed_ssid: str
    rssi: int | None = None
    client_vendor: str | None = None

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'timestamp': self.timestamp.isoformat(),
            'client_mac': self.client_mac,
            'probed_ssid': self.probed_ssid,
            'rssi': self.rssi,
            'client_vendor': self.client_vendor,
        }


@dataclass
class ChannelStats:
    """Statistics for a single WiFi channel."""

    channel: int
    band: str = BAND_UNKNOWN
    frequency_mhz: int | None = None

    # Counts
    ap_count: int = 0
    client_count: int = 0

    # Signal stats
    rssi_avg: float | None = None
    rssi_min: int | None = None
    rssi_max: int | None = None

    # Utilization score (0.0-1.0, lower is better)
    utilization_score: float = 0.0

    # Recommendation rank (1 = best)
    recommendation_rank: int | None = None

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'channel': self.channel,
            'band': self.band,
            'frequency_mhz': self.frequency_mhz,
            'ap_count': self.ap_count,
            'client_count': self.client_count,
            'rssi_avg': round(self.rssi_avg, 1) if self.rssi_avg else None,
            'rssi_min': self.rssi_min,
            'rssi_max': self.rssi_max,
            'utilization_score': round(self.utilization_score, 3),
            'recommendation_rank': self.recommendation_rank,
        }


@dataclass
class ChannelRecommendation:
    """Channel recommendation with reasoning."""

    channel: int
    band: str
    score: float  # Lower is better
    reason: str
    is_dfs: bool = False
    recommendation_rank: int | None = None

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'channel': self.channel,
            'band': self.band,
            'score': round(self.score, 3),
            'reason': self.reason,
            'is_dfs': self.is_dfs,
            'rank': self.recommendation_rank,
        }


@dataclass
class WiFiScanResult:
    """Complete result from a WiFi scan operation."""

    # Discovered entities
    access_points: list[WiFiAccessPoint] = field(default_factory=list)
    clients: list[WiFiClient] = field(default_factory=list)
    probe_requests: list[WiFiProbeRequest] = field(default_factory=list)

    # Channel analysis
    channel_stats: list[ChannelStats] = field(default_factory=list)
    recommendations: list[ChannelRecommendation] = field(default_factory=list)

    # Scan metadata
    scan_mode: str = SCAN_MODE_QUICK
    interface: str | None = None
    started_at: datetime | None = None
    completed_at: datetime | None = None
    duration_seconds: float | None = None

    # Status
    is_complete: bool = False
    error: str | None = None
    warnings: list[str] = field(default_factory=list)

    @property
    def network_count(self) -> int:
        """Total number of access points found."""
        return len(self.access_points)

    @property
    def client_count(self) -> int:
        """Total number of clients found."""
        return len(self.clients)

    @property
    def hidden_count(self) -> int:
        """Number of hidden networks."""
        return sum(1 for ap in self.access_points if ap.is_hidden)

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            # Entities
            'access_points': [ap.to_dict() for ap in self.access_points],
            'clients': [c.to_dict() for c in self.clients],
            'probe_requests': [p.to_dict() for p in self.probe_requests],

            # Channel analysis
            'channel_stats': [cs.to_dict() for cs in self.channel_stats],
            'recommendations': [r.to_dict() for r in self.recommendations],

            # Metadata
            'scan_mode': self.scan_mode,
            'interface': self.interface,
            'started_at': self.started_at.isoformat() if self.started_at else None,
            'completed_at': self.completed_at.isoformat() if self.completed_at else None,
            'duration_seconds': round(self.duration_seconds, 2) if self.duration_seconds else None,

            # Stats
            'network_count': self.network_count,
            'client_count': self.client_count,
            'hidden_count': self.hidden_count,

            # Status
            'is_complete': self.is_complete,
            'error': self.error,
            'warnings': self.warnings,
        }

    def to_summary_dict(self) -> dict:
        """Compact summary for status endpoints."""
        return {
            'scan_mode': self.scan_mode,
            'interface': self.interface,
            'network_count': self.network_count,
            'client_count': self.client_count,
            'hidden_count': self.hidden_count,
            'is_complete': self.is_complete,
            'error': self.error,
        }


@dataclass
class WiFiScanStatus:
    """Current WiFi scanning status."""

    is_scanning: bool = False
    scan_mode: str = SCAN_MODE_QUICK
    interface: str | None = None
    started_at: datetime | None = None
    networks_found: int = 0
    clients_found: int = 0
    error: str | None = None

    @property
    def elapsed_seconds(self) -> float | None:
        """Seconds since scan started."""
        if self.started_at:
            return (datetime.now() - self.started_at).total_seconds()
        return None

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            'is_scanning': self.is_scanning,
            'scan_mode': self.scan_mode,
            'interface': self.interface,
            'started_at': self.started_at.isoformat() if self.started_at else None,
            'elapsed_seconds': round(self.elapsed_seconds, 1) if self.elapsed_seconds else None,
            'networks_found': self.networks_found,
            'clients_found': self.clients_found,
            'error': self.error,
        }


@dataclass
class WiFiCapabilities:
    """WiFi system capabilities check result."""

    # Platform
    platform: str = 'unknown'  # 'linux', 'darwin', 'windows'
    is_root: bool = False

    # Interfaces
    interfaces: list[dict] = field(default_factory=list)
    default_interface: str | None = None

    # Quick scan tools
    has_nmcli: bool = False
    has_iw: bool = False
    has_iwlist: bool = False
    has_airport: bool = False
    preferred_quick_tool: str | None = None

    # Deep scan tools
    has_airmon_ng: bool = False
    has_airodump_ng: bool = False
    has_monitor_capable_interface: bool = False
    monitor_interface: str | None = None

    # Issues
    issues: list[str] = field(default_factory=list)

    @property
    def can_quick_scan(self) -> bool:
        """Whether quick scanning is available."""
        return (
            self.has_nmcli or
            self.has_iw or
            self.has_iwlist or
            self.has_airport
        ) and len(self.interfaces) > 0

    @property
    def can_deep_scan(self) -> bool:
        """Whether deep scanning is available."""
        return (
            self.has_airmon_ng and
            self.has_airodump_ng and
            self.has_monitor_capable_interface and
            self.is_root
        )

    def to_dict(self) -> dict:
        """Convert to dictionary for JSON serialization."""
        return {
            # Status
            'available': self.can_quick_scan,
            'can_quick_scan': self.can_quick_scan,
            'can_deep_scan': self.can_deep_scan,

            # Platform
            'platform': self.platform,
            'is_root': self.is_root,

            # Interfaces
            'interfaces': self.interfaces,
            'default_interface': self.default_interface,

            # Quick scan tools
            'tools': {
                'nmcli': self.has_nmcli,
                'iw': self.has_iw,
                'iwlist': self.has_iwlist,
                'airport': self.has_airport,
                'airmon_ng': self.has_airmon_ng,
                'airodump_ng': self.has_airodump_ng,
            },
            'preferred_quick_tool': self.preferred_quick_tool,

            # Deep scan
            'has_monitor_capable_interface': self.has_monitor_capable_interface,
            'monitor_interface': self.monitor_interface,

            # Issues
            'issues': self.issues,
        }