"""MCP tools for malware intelligence."""

from typing import Any

from ..decorator.api import handle_api_errors
from ..server.server import get_client, mcp
from ..utils.serialize import paginated_to_dict


@mcp.tool()
@handle_api_errors
async def get_malware(identifier: str) -> dict[str, Any]:
    """Get a malware entity by UUID or name.

    Use for: malware profiles, linked vulnerabilities, TTPs, observables.

    Args:
        identifier: Malware UUID or name.

    Returns:
        Malware record with display_name, description, related entities.
    """
    return await get_client().malware.get(identifier)


@mcp.tool()
@handle_api_errors
async def list_malware(
    filter: str = "",
    offset: int = 0,
    limit: int = 10,
    sort: str = "created_at",
    order: str = "desc",
) -> dict[str, Any]:
    """List or search malware with optional filters and pagination.

    Use for: discovering malware, building catalogs, trend analysis.

    Args:
        filter: Optional filter (e.g. name:, uuid:).
        offset: Pagination offset. Default 0.
        limit: Max items per page. Default 10.
        sort: Field to sort by. Default created_at.
        order: asc or desc.

    Returns:
        Paginated result with items, total, offset, limit, has_more.
    """
    resp = await get_client().malware.list(
        filter=filter or None,
        offset=offset,
        limit=limit,
        sort=sort,
        order=order,
    )
    return paginated_to_dict(resp)


@mcp.tool()
@handle_api_errors
async def list_trending_malware(
    period: str = "7d",
    offset: int = 0,
    limit: int = 10,
) -> dict[str, Any]:
    """List malware trending over a time period.

    Use for: active campaigns, current reporting focus.

    Args:
        period: 1d, 7d, or 30d.
        offset: Pagination offset. Default 0.
        limit: Max items. Default 10.

    Returns:
        Paginated result with trending malware items.
    """
    resp = await get_client().malware.trending(
        period=period,
        offset=offset,
        limit=limit,
    )
    return paginated_to_dict(resp)


@mcp.tool()
@handle_api_errors
async def get_malware_vulnerabilities(
    identifier: str,
    offset: int = 0,
    limit: int = 10,
) -> Any:
    """Get vulnerabilities linked to a malware entity.

    Use for: exploit chains, CVE usage by malware.

    Args:
        identifier: Malware UUID or name.
        offset: Pagination offset. Default 0.
        limit: Max items. Default 10.

    Returns:
        Vulnerabilities associated with this malware.
    """
    return await get_client().malware.vulnerabilities(
        identifier,
        offset=offset,
        limit=limit,
    )


@mcp.tool()
@handle_api_errors
async def get_malware_attack_patterns(
    identifier: str,
    offset: int = 0,
    limit: int = 10,
) -> Any:
    """Get MITRE ATT&CK patterns associated with a malware.

    Use for: TTP mapping, detection engineering.

    Args:
        identifier: Malware UUID or name.
        offset: Pagination offset. Default 0.
        limit: Max items. Default 10.

    Returns:
        Attack patterns linked to this malware.
    """
    return await get_client().malware.attack_patterns(
        identifier,
        offset=offset,
        limit=limit,
    )
