<?php
declare(strict_types=1);

namespace App\Application\Security\Events\System;

use App\Application\Security\{OWASPSecurityEvent};
use App\Application\Security\ValueObjects\{OWASPEventIdentifier, OWASPLogLevel, MaskedEmail};

final class SystemAnomalyEvent implements OWASPSecurityEvent
{
    public function __construct(
        public readonly string $anomalyType,
        public readonly string $description,
        public readonly array $metrics,
        public readonly string $severity
    ) {}

    public function getOWASPEventIdentifier(): OWASPEventIdentifier
    {
        return OWASPEventIdentifier::systemAnomaly($this->anomalyType);
    }

    public function getOWASPLogLevel(): OWASPLogLevel
    {
        return match ($this->severity) {
            'low' => OWASPLogLevel::INFO,
            'medium' => OWASPLogLevel::WARN,
            'high' => OWASPLogLevel::ERROR,
            'critical' => OWASPLogLevel::FATAL,
            default => OWASPLogLevel::WARN
        };
    }

    public function getDescription(): string
    {
        return "System anomaly detected: {$this->anomalyType}";
    }

    public function getEventData(): array
    {
        return [
            'anomaly_type' => $this->anomalyType,
            'description' => $this->description,
            'metrics' => $this->metrics,
            'severity' => $this->severity
        ];
    }
}
