from __future__ import annotations

from cti import mitre

from cti.feeds.base import Feed, load_json

from cti.models import Indicator

TYPE_MAP = {

    "IPv4": "ip",

    "IPv6": "ip",

    "domain": "domain",

    "hostname": "domain",

    "URL": "url",

    "FileHash-SHA256": "sha256",

    "FileHash-MD5": "md5",

    "FileHash-SHA1": "sha1",

}

class OTX(Feed):

    name = "otx"

    url = "https://otx.alienvault.com/api/v1/pulses/subscribed?limit=50"

    def headers(self) -> dict:

        key = self.settings.get("api_key")

        return {"X-OTX-API-KEY": key} if key else {}

    def parse(self, raw: str) -> list[Indicator]:

        payload = load_json(raw)

        indicators: list[Indicator] = []

        for pulse in payload.get("results", []):

            techniques = [

                a for a in pulse.get("attack_ids", []) if isinstance(a, str)

            ]

            techniques = [t.upper() for t in techniques]

            malware_families = pulse.get("malware_families") or []

            malware = malware_families[0].get("display_name") if malware_families else None

            tags = pulse.get("tags") or []

            for raw_ind in pulse.get("indicators", []):

                ind_type = TYPE_MAP.get(raw_ind.get("type"))

                if ind_type is None:

                    continue

                derived = list(techniques) + mitre.techniques_for_malware(malware)

                indicators.append(

                    Indicator(

                        type=ind_type,

                        value=raw_ind.get("indicator", ""),

                        source=self.name,

                        threat_type=pulse.get("name", "otx_pulse"),

                        confidence=60,

                        malware=malware,

                        techniques=sorted(set(derived)),

                        tags=tags,

                        reference=f"https://otx.alienvault.com/pulse/{pulse.get('id')}",

                    )

                )

        return indicators