<?php

declare(strict_types=1);

namespace App\Application\Security\Events\Authorization;

use App\Application\Security\{OWASPSecurityEvent};
use App\Application\Security\ValueObjects\{MaskedEmail, OWASPEventIdentifier, OWASPLogLevel};

final class PrivilegeEscalationEvent implements OWASPSecurityEvent
{
    private MaskedEmail $maskedEmail;

    public function __construct(
        public readonly string $email,
        public readonly string $fromRole,
        public readonly string $toRole,
        public readonly string $method,
        public readonly bool $successful = false
    ) {
        $this->maskedEmail = MaskedEmail::fromString($this->email);
    }

    public function getOWASPEventIdentifier(): OWASPEventIdentifier
    {
        return OWASPEventIdentifier::privilegeEscalation(
            $this->maskedEmail->toString(),
            $this->fromRole,
            $this->toRole
        );
    }

    public function getOWASPLogLevel(): OWASPLogLevel
    {
        return OWASPLogLevel::FATAL;
    }

    public function getDescription(): string
    {
        $status = $this->successful ? 'successful' : 'attempted';

        return "Privilege escalation {$status} by user {$this->maskedEmail->toString()}";
    }

    public function getEventData(): array
    {
        return [
            'username' => $this->maskedEmail->toString(),
            'from_role' => $this->fromRole,
            'to_role' => $this->toRole,
            'escalation_method' => $this->method,
            'successful' => $this->successful,
        ];
    }

    public function getMaskedEmail(): MaskedEmail
    {
        return $this->maskedEmail;
    }
}
