from __future__ import annotations

from cti.models import Indicator

def deduplicate(indicators: list[Indicator]) -> list[Indicator]:

    merged: dict[tuple[str, str], Indicator] = {}

    for indicator in indicators:

        key = indicator.key()

        existing = merged.get(key)

        if existing is None:

            merged[key] = Indicator(

                type=indicator.type,

                value=indicator.value,

                source=indicator.source,

                threat_type=indicator.threat_type,

                confidence=indicator.confidence,

                malware=indicator.malware,

                techniques=sorted(set(indicator.techniques)),

                tags=sorted(set(indicator.tags)),

                reference=indicator.reference,

                first_seen=indicator.first_seen,

            )

            continue

        existing.confidence = max(existing.confidence, indicator.confidence)

        existing.techniques = sorted(set(existing.techniques) | set(indicator.techniques))

        existing.tags = sorted(set(existing.tags) | set(indicator.tags))

        existing.malware = existing.malware or indicator.malware

        existing.reference = existing.reference or indicator.reference

        existing.first_seen = existing.first_seen or indicator.first_seen

        if indicator.source not in existing.source.split(","):

            existing.source = ",".join(sorted(set(existing.source.split(",") + [indicator.source])))

    return list(merged.values())

def filter_by_confidence(indicators: list[Indicator], minimum: int) -> list[Indicator]:

    return [i for i in indicators if i.confidence >= minimum]