#!/usr/bin/env python
''' riskiq.cli.blacklist.malware
'''
from riskiq.cli.util import templated, six_hours
from riskiq.cli.parser import add_timerange_args, add_render_args
from riskiq.cli.blacklist import FILTERS, CONFIDENCES

def add_parser(subs):
    parser = subs.add_parser('malware',
        help='query RiskIQ suspicious binary feed for all samples stored within a '
            'given period')
    parser.add_argument('--filter', '-f', default=None,
        help='filter to one of "blackhole", "sakura" or "exploitKit"')
    parser.add_argument('--confidence', '-c', choices=['H', 'M', 'L'],
        default=None, help='restrict results to malicious probability of '
        '[H]igh, [M]edium, or [L]ow')
    add_timerange_args(parser)
    add_render_args(parser)

@templated('blacklist/malware')
def run(client, args, kwargs):
    if kwargs.get('six_hours'):
        kwargs['start'] = six_hours()
        del kwargs['six_hours']
    if kwargs['filter'] not in (None, ) + FILTERS:
        raise ValueError('Invalid filter.\nMust be one of %s' % str(FILTERS))
    if kwargs['confidence'] not in (None, ) + CONFIDENCES:
        raise ValueError('Invalid confidence.\n'
            'Must be one of %s' % str(CONFIDENCES))
    blacklist_filter = kwargs['filter']
    del kwargs['filter']
    data = client.get_blacklist_malware(blacklist_filter=blacklist_filter,
        **kwargs)
    return data, kwargs
