package classify

import "time"

// TrafficClass represents a classified network traffic category.
type TrafficClass string

const (
	ClassICMP     TrafficClass = "ICMP"
	ClassDNS      TrafficClass = "DNS"
	ClassHTTPS    TrafficClass = "HTTPS"
	ClassHTTP     TrafficClass = "HTTP"
	ClassSSH      TrafficClass = "SSH"
	ClassSMTP     TrafficClass = "SMTP"
	ClassNTP      TrafficClass = "NTP"
	ClassDHCP     TrafficClass = "DHCP"
	ClassOtherTCP TrafficClass = "other-TCP"
	ClassOtherUDP TrafficClass = "other-UDP"
	// D-04: ClassUnknown replaced by 4 hash-bucketed classes for distinct tones
	ClassUnknown1 TrafficClass = "unknown-1"
	ClassUnknown2 TrafficClass = "unknown-2"
	ClassUnknown3 TrafficClass = "unknown-3"
	ClassUnknown4 TrafficClass = "unknown-4"

	// --- Mail (PROTO-01) ---
	ClassIMAP    TrafficClass = "IMAP"
	ClassPOP3    TrafficClass = "POP3"
	ClassSMTPSub TrafficClass = "SMTP-sub" // D-04: separate from ClassSMTP (port 25)

	// --- File Transfer (PROTO-02) ---
	ClassFTP  TrafficClass = "FTP"
	ClassSMB  TrafficClass = "SMB"
	ClassTFTP TrafficClass = "TFTP"

	// --- Remote Access (PROTO-03) ---
	ClassRDP    TrafficClass = "RDP"
	ClassTelnet TrafficClass = "Telnet"
	ClassVNC    TrafficClass = "VNC"

	// --- Database (PROTO-04) ---
	ClassMySQL      TrafficClass = "MySQL"
	ClassPostgreSQL TrafficClass = "PostgreSQL"
	ClassRedis      TrafficClass = "Redis"
	ClassMongoDB    TrafficClass = "MongoDB"

	// --- Discovery (PROTO-05) ---
	ClassMDNS TrafficClass = "mDNS"
	ClassSSDP TrafficClass = "SSDP"
	ClassSNMP TrafficClass = "SNMP"

	// --- VoIP (PROTO-06) ---
	ClassSIP TrafficClass = "SIP"

	// --- Web extension (PROTO-07) ---
	ClassQUIC TrafficClass = "QUIC"

	// --- Infrastructure extension (PROTO-08) ---
	ClassLDAP     TrafficClass = "LDAP"
	ClassKerberos TrafficClass = "Kerberos"
	ClassSyslog   TrafficClass = "Syslog"
)

// AllClasses returns all known traffic classes in display order.
func AllClasses() []TrafficClass {
	return []TrafficClass{
		// Infrastructure
		ClassICMP, ClassDNS, ClassNTP, ClassDHCP,
		ClassMDNS, ClassSSDP, ClassSNMP,
		ClassLDAP, ClassKerberos, ClassSyslog,
		// Web
		ClassHTTPS, ClassHTTP, ClassQUIC,
		// Mail
		ClassSMTP, ClassIMAP, ClassPOP3, ClassSMTPSub,
		// Remote Access
		ClassSSH, ClassRDP, ClassTelnet, ClassVNC,
		// File Transfer
		ClassFTP, ClassSMB, ClassTFTP,
		// Database
		ClassMySQL, ClassPostgreSQL, ClassRedis, ClassMongoDB,
		// VoIP
		ClassSIP,
		// Unknown / catch-all
		ClassUnknown1, ClassUnknown2, ClassUnknown3, ClassUnknown4,
		ClassOtherTCP, ClassOtherUDP,
	}
}

// ClassifiedPacket pairs a raw packet's classification result with metadata.
type ClassifiedPacket struct {
	Class     TrafficClass
	SrcPort   uint16
	DstPort   uint16
	Protocol  string    // "tcp", "udp", "icmp"
	Length    int
	Timestamp time.Time // Set from pkt.Metadata().CaptureInfo.Timestamp; zero in live mode (D-01)
}

// WindowSnapshot holds aggregated packet counts for a time window.
// This is the contract between the aggregation stage and future audio synthesis (Phase 2).
type WindowSnapshot struct {
	Counts       map[TrafficClass]int64
	TotalPackets int64
	WindowIndex  int
}