types.ts

// Shared threat intelligence types used across backend & frontend

export type Severity = "critical" | "high" | "medium" | "low" | "info";

export type AttackType =
  | "ddos"
  | "brute-force"
  | "malware"
  | "phishing"
  | "port-scan"
  | "sql-injection"
  | "xss"
  | "ransomware"
  | "botnet"
  | "exploit"
  | "credential-stuffing"
  | "ssh-attack"
  | "web-exploit";

export type ThreatCategory =
  | "malware"
  | "botnet"
  | "spam"
  | "phishing"
  | "scanner"
  | "exploit"
  | "proxy"
  | "tor"
  | "ransomware";

/** A live attack event flowing on the world map. */
export interface AttackEvent {
  id: string;
  sourceCountry: string; // ISO-2 code, e.g. "CN"
  sourceCountryName: string;
  sourceCoords: [number, number]; // [lng, lat]
  targetCountry: string;
  targetCountryName: string;
  targetCoords: [number, number];
  type: AttackType;
  severity: Severity;
  sourceIp: string;
  targetIp: string;
  port: number;
  timestamp: number;
}

/** A threat indicator from a feed (abuse.ch / alienvault / pulsedive / abuseipdb). */
export interface ThreatIndicator {
  id: string;
  ioc: string; // IP / domain / hash / url
  type: "ip" | "domain" | "url" | "hash" | "email";
  country?: string;
  countryName?: string;
  category: ThreatCategory;
  confidence: number; // 0-100
  tags: string[];
  source: "abuseipdb" | "abusech" | "alienvault" | "pulsedive";
  firstSeen: string;
  lastSeen: string;
  description?: string;
  malware?: string; // malware family / campaign name (abuse.ch ThreatFox)
}

/** IP reputation result from AbuseIPDB. */
export interface IpReputation {
  ip: string;
  abuseScore: number; // 0-100
  confidence: "clean" | "low" | "medium" | "high" | "critical";
  country: string;
  countryName: string;
  isp: string;
  usageType: string;
  domain: string;
  totalReports: number;
  numDistinctUsers: number;
  lastReportedAt: string;
  hostnames: string[];
  categories: { id: number; name: string }[];
}

export interface NewsItem {
  id: string;
  title: string;
  description: string;
  source: string;
  url: string;
  publishedAt: string;
  imageUrl?: string;
}

export interface DashboardStats {
  totalAttacks: number;
  blockedAttacks: number;
  activeThreats: number;
  monitoredCountries: number;
  topAttackTypes: { type: AttackType; count: number }[];
  threatLevel: "low" | "guarded" | "elevated" | "high" | "critical";
  threatsPerMin: number;
  lastUpdated: number;
}

export interface CountryAttackStat {
  code: string;
  name: string;
  attacks: number;
  coords: [number, number];
}

export interface ThreatTimelinePoint {
  time: string;
  attacks: number;
  blocked: number;
  critical: number;
}

/** Unified API response shape for the live attack stream. */
export interface AttacksResponse {
  attacks: AttackEvent[];
  topSources: CountryAttackStat[];
  topTargets: CountryAttackStat[];
  generatedAt: number;
}

export interface FeedResponse {
  indicators: ThreatIndicator[];
  total: number;
  sources: string[];
  generatedAt: number;
}

export interface NewsResponse {
  articles: NewsItem[];
  total: number;
  generatedAt: number;
}

export interface StatsResponse extends DashboardStats {
  timeline: ThreatTimelinePoint[];
}