/*-
 * ~~~~~~licensing~~~~~~
 * cef-logger-layout
 * ==========
 * Copyright (C) 2020 - 2025 EmDev LLC
 * ==========
 * You may not use this file except in accordance with the License Terms of the Copyright
 * Holder located at: https://entaxy.ru/eula . All copyrights, all intellectual property
 * rights to the Software and any copies are the property of the Copyright Holder. Unless
 * it is explicitly allowed the Copyright Holder, the User is prohibited from using the
 * Software for commercial purposes to provide services to third parties.
 * 
 * The Copyright Holder hereby declares that the Software is provided on an "AS IS".
 * Under no circumstances does the Copyright Holder guarantee or promise that the
 * Software provided by him will be suitable or not suitable for the specific purposes
 * of the User, that the Software will meet all commercial and personal subjective
 * expectations of the User, that the Software will work properly, without technical
 * errors, quickly and uninterruptedly.
 * 
 * Under no circumstances shall the Copyright Holder or its Affiliates is not liable
 * to the User for any direct or indirect losses of the User, his expenses or actual
 * damage, including, downtime; loss of bussines; lost profit; lost earnings; loss
 * or damage to data, property, etc.
 * ~~~~~~/licensing~~~~~~
 */
package ru.emdev.cef;

import static java.util.regex.Pattern.compile;

import java.util.regex.Pattern;

public enum AuditEvent {
    APP_OWNER_UPDATED("app_owner_updated", "Owner of application updated", compile(
            "(?<msg>^Successfully updated the owner of application ((?!from).*) from ((?!to).*) to (?<suser>.*).$)")),
    COMMON_ACTION_RESULT("action", "Common action result", compile(
            "^Initiator : (?<suser>[^|]*) \\| Action : (?<eventName>[^|]*) \\| (?<msg>Target : ([^|]*) \\| Data : ([^|]*) \\| Result : (.*)$)")),
    COMMON_ACTION_OUTCOME("action", "Common action outcome", compile(
            "^Initiator=(?<suser>(?! Action).*) Action=(?<eventName>(?! Target).*) (?<msg>Target=((?! Data).*) Data=((?! Outcome).*) Outcome=((?!Error=).*)$)")),
    COMMON_ACTION_ERROR("action", "Common action error", compile(
            "^Initiator=(?<suser>(?! Action).*) Action=(?<eventName>(?! Target).*) (?<msg>Target=((?! Data).*) Data=((?! Outcome).*) Outcome=Failure Error=(.*)$)")),
    COMMON_ACTION_CLAIMS("action", "Common action claims", compile(
            "^Initiator : (?<suser>[^|]*) \\| Action : (?<eventName>[^|]*) \\| (?<msg>Target : ([^|]*) \\| Claims : (.*)$)")),
    SIGN_WRAPPING_ATTACK("attack", "Possible Signature Wrapping Attack", compile(
            "(?<msg>^Signature do not confirm to SAML signature profile. Possible XML Signature Wrapping  (?<eventType>Attack)!$)")),
    LOGGED_OUT("auth", "Logged out", compile(
            "(?<msg>^'(?<suser>(?!@).*)@((?! ).*) \\[((?!]).*)]' logged out at (?<end>((?! delegated).*))$)")),
    LOGGED_OUT_DELEGATED("auth", "Logged out", compile(
            "(?<msg>^'(?<suser>(?!@).*)@((?! ).*) \\[((?!]).*)]' logged out at (?<end>((?! delegated).*)) delegated by (.*)$)")),
    LOGIN_FAILED("auth", "Unauthorized login attempt", compile(
            "(?<msg>^Login failed\\. Unauthorized login attempt '(?<suser>(?!\\[).*)\\[((?!]).*)]' at (?<end>.*)$)")),
    LOGIN("auth", "Login success",
            compile("(?<msg>^'(?<suser>[^@]*)@([^ ]*) \\[((?!]).*)]' logged in at (?<end>.*)$)")),
    LOGIN_NULL_DOMAIN("auth", "Null domain login attempt",
            compile("(?<msg>^User with null domain tried to login\\.$)")),
    LOGIN_FROM_IP("auth", "Login success from ip", compile(
            "(?<msg>^'(?<suser>(?!@).*)@((?! ).*) \\[((?!]).*)]' logged in at (?<end>(?! from).*) from IP address (?<shost>.*)$)")),
    JMX_AUTHENTICATED("auth", "User authenticated to JMX", compile(
            "(?<msg>^User (?<suser>(?! successfully).*) successfully authenticated to perform JMX operations\\.$)")),
    JMX_AUTHORIZED("auth", "User authorized to JMX", compile(
            "(?<msg>^User : (?<suser>(?! successfully).*) successfully authorized to perform JMX operations\\.$)")),
    JMX_UNAUTHORIZED("auth", "Unauthorized access attempt to JMX", compile(
            "(?<msg>^Unauthorized access attempt to JMX operation\\. $)")),
    USER_NOT_AUTHORIZED("auth", "Unauthorized attempt to read the resource", compile(
            "(?<msg>^User (?<suser>(?! is).*) is not authorized to read the resource (.*)$)")),
    CSRF_ATTACK_WITH_HEADER("attack", "Possible CSRF attack", compile(
            "(?<msg>^Possible CSRF attack. Refer header : (.*)$)")),
    CSRF_ATTACK_WITHOUT_HEADER("attack", "Possible CSRF attack", compile(
            "(?<msg>^Possible CSRF attack. Request to '([^']*)' does not have a Referer header$)")),
    THREAT_ATTACK("attack", "Threat detected", compile(
            "(?<msg>^(.*)Threat detected in (.*)$)"));

    private final Pattern pattern;
    private final String eventName;
    private final String eventType;


    AuditEvent(String eventType, String eventName, Pattern pattern) {
        this.eventType = eventType;
        this.eventName = eventName;
        this.pattern = pattern;
    }

    public Pattern getPattern() {
        return pattern;
    }

    public String getEventName() {
        return eventName;
    }

    public String getEventType() {
        return eventType;
    }
}
