//! [`EventXpMalwareDetected`]

use std::ffi::OsStr;

use endpoint_sec_sys::es_event_xp_malware_detected_t;

/// XProtect detected malware.
#[doc(alias = "es_event_xp_malware_detected_t")]
pub struct EventXpMalwareDetected<'a> {
    /// Raw event
    pub(crate) raw: &'a es_event_xp_malware_detected_t,
}

impl<'a> EventXpMalwareDetected<'a> {
    /// Version of the signatures used for detection. Currently corresponds to XProtect version.
    #[inline(always)]
    pub fn signature_version(&self) -> &'a OsStr {
        // Safety: 'a tied to self, object obtained through ES
        unsafe { self.raw.signature_version.as_os_str() }
    }

    /// String identifying the malware that was detected.
    #[inline(always)]
    pub fn malware_identifier(&self) -> &'a OsStr {
        // Safety: 'a tied to self, object obtained through ES
        unsafe { self.raw.malware_identifier.as_os_str() }
    }

    /// String identifying the incident, intended for linking multiple malware detected and
    /// remediated events.
    #[inline(always)]
    pub fn incident_identifier(&self) -> &'a OsStr {
        // Safety: 'a tied to self, object obtained through ES
        unsafe { self.raw.incident_identifier.as_os_str() }
    }

    /// Path where malware was detected. This path is not necessarily a malicious binary, it can
    /// also be a legitimate file containing a malicious portion.
    #[inline(always)]
    pub fn detected_path(&self) -> &'a OsStr {
        // Safety: 'a tied to self, object obtained through ES
        unsafe { self.raw.detected_path.as_os_str() }
    }
}

// Safety: safe to send across threads: does not contain any interior mutability nor depend on current thread state
unsafe impl Send for EventXpMalwareDetected<'_> {}
// Safety: safe to share across threads: does not contain any interior mutability nor depend on current thread state
unsafe impl Sync for EventXpMalwareDetected<'_> {}

impl_debug_eq_hash_with_functions!(
    EventXpMalwareDetected<'a>;
    signature_version, malware_identifier, incident_identifier, detected_path,
);
