from datetime import datetime
from typing import Optional

from pydantic import BaseModel

from py_ocsf_models.events.findings.application_security_posture_finding_type_id import (
    ApplicationSecurityPostureFindingTypeID,
)
from py_ocsf_models.events.findings.category_uid import CategoryUID
from py_ocsf_models.events.findings.class_uid import ClassUID
from py_ocsf_models.events.findings.finding import Finding
from py_ocsf_models.objects.device import Device
from py_ocsf_models.objects.evidence_artifacts import EvidenceArtifacts
from py_ocsf_models.objects.finding_info import FindingInformation
from py_ocsf_models.objects.remediation import Remediation
from py_ocsf_models.objects.resource_details import ResourceDetails
from py_ocsf_models.objects.vulnerability_details import VulnerabilityDetails


class ApplicationSecurityPostureFinding(Finding, BaseModel):
    """
    The Application Security Posture Finding event is a notification about any bug, defect, deficiency, exploit, vulnerability, weakness or any other issue with software and related systems. Application Security Posture Findings typically involve reporting on the greater context including compliance, impacted resources, remediation guidance, specific code defects, and/or vulnerability metadata. Application Security Posture Findings can be reported by Threat & Vulnerability Management (TVM) tools, Application Security Posture Management (ASPM) tools, or other similar tools. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.

    Attributes:
        Category (category_name): The event category name, as defined by CategoryUID.Findings.value.
        Class (class_name) [Optional]: The event class name, as defined by ClassUID.ApplicationSecurityPostureFinding.value.
        Class ID (class_uid): The unique identifier of a class. A Class describes the attributes available in an event.
        Device (device) [Optional]: The device object.
        Finding Information (finding_info): Describes metadata related to a security finding generated by a security tool or system.
        Remediation Guidance (remediation) [Optional]: Suggested steps to address the finding.
        Resources (resources) [Optional]: Describes details about resources that were the target of the activity that triggered the finding.
        Time (time) [Required]: The standardized time when the event occurred or the finding was created.
        Timezone Offset (timezone_offset) [Optional]: Difference in minutes from UTC.
        Type ID (type_uid): The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
        Type Name (type_name) [Optional]: The event/finding type name, as defined by the type_uid.
        Vulnerabilities (vulnerabilities) [Optional]: Vulnerabilities identified in the finding.
    """

    category_name: str = CategoryUID.Findings.name
    category_uid: int = CategoryUID.Findings.value
    class_name: Optional[str] = ClassUID.ApplicationSecurityPostureFinding.name
    class_uid: int = ClassUID.ApplicationSecurityPostureFinding
    device: Optional[Device] = None
    evidences: Optional[list[EvidenceArtifacts]] = None
    finding_info: FindingInformation
    remediation: Optional[Remediation] = None
    resources: Optional[list[ResourceDetails]] = None
    time: int
    time_dt: Optional[datetime] = None
    timezone_offset: Optional[int] = None
    type_uid: ApplicationSecurityPostureFindingTypeID
    type_name: Optional[str] = None
    vulnerabilities: Optional[list[VulnerabilityDetails]] = None
