package analyzer

import (
	"time"

	"dip-ids/internal/storage"

	"github.com/google/gopacket"
)

// Detector — интерфейс детектора атак
type Detector interface {
	Name() string
	Analyze(pkt gopacket.Packet) []storage.Alert
	Reset()
}

// timeWindow скользящее временное окно для хранения меток времени
type timeWindow struct {
	entries []time.Time
	size    time.Duration
}

func newTimeWindow(seconds int) *timeWindow {
	return &timeWindow{size: time.Duration(seconds) * time.Second}
}

func (w *timeWindow) add(t time.Time) {
	w.entries = append(w.entries, t)
	w.evict(t)
}

func (w *timeWindow) evict(now time.Time) {
	cutoff := now.Add(-w.size)
	i := 0
	for i < len(w.entries) && w.entries[i].Before(cutoff) {
		i++
	}
	w.entries = w.entries[i:]
}

func (w *timeWindow) count(now time.Time) int {
	w.evict(now)
	return len(w.entries)
}