#ifndef WIFI_SECURITY_SCAN_H
#define WIFI_SECURITY_SCAN_H

// ============================================================================
// wifi_security_scan.h — Passive whitehat WiFi security-posture scanner
// (ADDITIVE — a Mythos-adjacent capability for the sensor's own deployment
// environment, not a general-purpose network attack tool).
//
// Builds on network_id.cpp's EXISTING beacon/probe-response catalog (which
// already parses RSN IEs and flags CIPHER_OPEN/CIPHER_WEP/CIPHER_TKIP/
// CIPHER_CCMP per nearby AP) to surface real security irregularities:
//   - Open (unencrypted) networks
//   - WEP networks (deprecated, trivially crackable)
//   - TKIP-only networks with no CCMP (weak legacy WPA)
//   - Evil-twin suspicion: the same SSID observed from multiple BSSIDs with
//     DIFFERENT security postures (a classic rogue-AP/spoofing signature)
//   - Deauth/disassoc frame flooding (a live attack-in-progress indicator,
//     counted directly from management-frame subtypes — separate from
//     jamming_detector.cpp's RSSI/packet-loss-based approach)
//
// Strictly passive: reads beacon/probe/deauth/disassoc frames already
// captured by the existing promiscuous callback. No injection, no attack
// tooling, no active probing of any network. Whitehat/defensive use only —
// for observing and reporting on the sensor's own deployment environment.
// ============================================================================

#include <cstdint>
#include <cstddef>

void wifi_security_scan_init();

// Call periodically (e.g. every main-loop cycle or every few seconds) — scans
// the current network_id table for security-posture irregularities.
void wifi_security_scan_tick();

// Feed a raw 802.11 management frame to count deauth (subtype 0x0C) and
// disassoc (subtype 0x0A) frames for flood detection. Safe to call from the
// promiscuous RX callback (IRAM-safe, no malloc, no blocking).
void wifi_security_scan_process_frame(const uint8_t* frame, size_t len);

enum WifiSecurityIssue : uint8_t {
    WIFI_SEC_ISSUE_NONE = 0,
    WIFI_SEC_ISSUE_OPEN,
    WIFI_SEC_ISSUE_WEP,
    WIFI_SEC_ISSUE_WEAK_TKIP_ONLY,
    WIFI_SEC_ISSUE_EVIL_TWIN_SUSPECT,
};

struct WifiSecurityFinding {
    uint8_t  bssid[6];
    char     ssid[33];
    WifiSecurityIssue issue;
    int8_t   last_rssi;
};

struct WifiSecurityStats {
    uint16_t open_networks;
    uint16_t wep_networks;
    uint16_t weak_tkip_only_networks;
    uint16_t evil_twin_suspects;
    uint32_t deauth_frames_last_60s;
    uint32_t disassoc_frames_last_60s;
    bool     deauth_flood_alert;   // sustained high deauth/disassoc rate
};

void wifi_security_scan_get_stats(WifiSecurityStats* out);

// Snapshot current findings (networks with a flagged issue). Returns the
// number of entries written (<= max).
size_t wifi_security_scan_list_findings(WifiSecurityFinding* out, size_t max);

#endif // WIFI_SECURITY_SCAN_H
