from datetime import datetime
from typing import Optional

from pydantic import BaseModel

from py_ocsf_models.events.findings.category_uid import CategoryUID
from py_ocsf_models.events.findings.class_uid import ClassUID
from py_ocsf_models.events.findings.compliance_finding_type_id import (
    ComplianceFindingTypeID,
)
from py_ocsf_models.events.findings.finding import Finding
from py_ocsf_models.objects.compliance import Compliance
from py_ocsf_models.objects.device import Device
from py_ocsf_models.objects.evidence_artifacts import EvidenceArtifacts
from py_ocsf_models.objects.finding_info import FindingInformation
from py_ocsf_models.objects.remediation import Remediation
from py_ocsf_models.objects.resource_details import ResourceDetails


class ComplianceFinding(Finding, BaseModel):
    """
    A Compliance Finding describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001 etc. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object. Note: If the Finding is an incident, i.e. requires incident workflow, also apply the incident profile or aggregate this finding into an Incident Finding.

    Attributes:
        Category (category_name): The event category name, as defined by CategoryUID.Findings.value.
        Class (class_name) [Optional]: The event class name, as defined by ClassUID.ComplianceFinding.value.
        Class ID (class_uid): The unique identifier of a class. A Class describes the attributes available in an event.
        Compliance (compliance): The compliance object.
        Device (device) [Optional]: The device object.
        Evidences (evidences) [Optional]: Artifacts related to the security detection activities.
        Finding Information (finding_info): Describes metadata related to a security finding generated by a security tool or system.
        Remediation Guidance (remediation) [Optional]: Suggested steps to address the finding.
        Resources (resources) [Optional]: Describes details about resources that were the target of the activity that triggered the finding.
        Time (time) [Required]: The standardized time when the event occurred or the finding was created.
        Timezone Offset (timezone_offset) [Optional]: Difference in minutes from UTC.
        Type ID (type_uid): The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
        Type Name (type_name) [Optional]: The event/finding type name, as defined by the type_uid.
    """

    category_name: str = CategoryUID.Findings.name
    category_uid: int = CategoryUID.Findings.value
    class_name: Optional[str] = ClassUID.ComplianceFinding.name
    class_uid: int = ClassUID.ComplianceFinding
    compliance: Compliance
    device: Optional[Device] = None
    evidences: Optional[list[EvidenceArtifacts]] = None
    finding_info: FindingInformation
    remediation: Optional[Remediation] = None
    resources: Optional[list[ResourceDetails]] = None
    time: int
    time_dt: Optional[datetime] = None
    timezone_offset: Optional[int] = None
    type_uid: ComplianceFindingTypeID
    type_name: Optional[str] = None
