spawn-access-control 0.1.12

use crate::audit_log::{AuditLogEntry, AuditEventType, ActionResult};
use chrono::{DateTime, Utc};
use std::collections::HashMap;

pub struct AuditAnalyzer {
    entries: Vec<AuditLogEntry>,
}

impl AuditAnalyzer {
    pub fn new(entries: Vec<AuditLogEntry>) -> Self {
        Self { entries }
    }

    pub fn analyze_access_patterns(&self, time_window: chrono::Duration) -> AccessPatternReport {
        let now = Utc::now();
        let window_start = now - time_window;

        let mut report = AccessPatternReport {
            total_requests: 0,
            failed_attempts: 0,
            user_activity: HashMap::new(),
            resource_usage: HashMap::new(),
            suspicious_activities: Vec::new(),
        };

        for entry in &self.entries {
            if entry.timestamp < window_start {
                continue;
            }

            report.total_requests += 1;

            if let ActionResult::Failure { .. } = entry.result {
                report.failed_attempts += 1;
            }

            // Kullanıcı aktivitesi analizi
            report.user_activity
                .entry(entry.user.clone())
                .and_modify(|count| *count += 1)
                .or_insert(1);

            // Kaynak kullanımı analizi
            report.resource_usage
                .entry(entry.resource.clone())
                .and_modify(|count| *count += 1)
                .or_insert(1);

            // Şüpheli aktivite analizi
            if self.is_suspicious_activity(entry) {
                report.suspicious_activities.push(SuspiciousActivity {
                    timestamp: entry.timestamp,
                    user: entry.user.clone(),
                    activity_type: SuspiciousActivityType::UnusualAccessPattern,
                    details: format!("Unusual access to {}", entry.resource),
                });
            }
        }

        report
    }

    fn is_suspicious_activity(&self, entry: &AuditLogEntry) -> bool {
        // Şüpheli aktivite belirleme mantığı
        // Örnek: Kısa sürede çok sayıda başarısız deneme
        false
    }
}

#[derive(Debug)]
pub struct AccessPatternReport {
    pub total_requests: u32,
    pub failed_attempts: u32,
    pub user_activity: HashMap<String, u32>,
    pub resource_usage: HashMap<String, u32>,
    pub suspicious_activities: Vec<SuspiciousActivity>,
}

#[derive(Debug)]
pub struct SuspiciousActivity {
    pub timestamp: DateTime<Utc>,
    pub user: String,
    pub activity_type: SuspiciousActivityType,
    pub details: String,
}

#[derive(Debug)]
pub enum SuspiciousActivityType {
    UnusualAccessPattern,
    MultipleFailedAttempts,
    UnusualTimeAccess,
    UnusualLocation,
}