admin / Syanpse-Vanguard

"""Agent configuration + persisted identity state.

Config is read from a JSON/TOML file (path via SV_AGENT_CONFIG) with env-var
overrides. Identity (agent_id + dev-mode ingest token) is persisted separately
so a restart re-uses the existing enrollment."""
from __future__ import annotations

import json
import os
from dataclasses import dataclass, field


@dataclass
class AgentConfig:
    ingest_url: str = "https://localhost:9443"
    enrollment_token: str = "dev-enrollment-token"
    hostname: str = field(default_factory=lambda: os.uname().nodename
                          if hasattr(os, "uname") else os.environ.get("COMPUTERNAME", "host"))
    platform: str = "linux"
    channels: list[str] = field(default_factory=list)
    agent_version: str = "0.1.0"

    # mTLS (production) — paths to the agent's signed client cert/key + CA.
    mtls_enabled: bool = False
    client_cert: str | None = None
    client_key: str | None = None
    ca_cert: str | None = None
    verify_tls: bool = True

    # buffering / batching
    buffer_path: str = "./agent-buffer.sqlite"
    state_path: str = "./agent-state.json"
    batch_size: int = 500
    flush_interval_s: float = 5.0

    # collector-specific knobs
    syslog_paths: list[str] = field(default_factory=lambda: ["/var/log/syslog"])
    auditd_path: str = "/var/log/audit/audit.log"
    winlog_channels: list[str] = field(default_factory=lambda: [
        "Security",
        "System",
        "Application",
        "Microsoft-Windows-Sysmon/Operational",
        "Microsoft-Windows-PowerShell/Operational",
        "Windows PowerShell",
        "Microsoft-Windows-Windows Defender/Operational",
        "Microsoft-Windows-TaskScheduler/Operational",
        "Microsoft-Windows-WMI-Activity/Operational",
        "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational",
    ])

    @classmethod
    def load(cls, path: str | None = None) -> "AgentConfig":
        path = path or os.environ.get("SV_AGENT_CONFIG")
        data: dict = {}
        if path and os.path.exists(path):
            with open(path, "r", encoding="utf-8") as fh:
                if path.endswith(".toml"):
                    # tomllib is stdlib only on Python 3.11+. Fall back to the
                    # `tomli` backport (same API) on 3.10 and earlier.
                    try:
                        import tomllib
                    except ModuleNotFoundError:
                        import tomli as tomllib
                    data = tomllib.loads(fh.read())
                else:
                    data = json.load(fh)
        # env overrides for the common knobs
        for key in ("ingest_url", "enrollment_token", "hostname", "platform"):
            env = os.environ.get(f"SV_AGENT_{key.upper()}")
            if env:
                data[key] = env
        known = {f.name for f in cls.__dataclass_fields__.values()}
        return cls(**{k: v for k, v in data.items() if k in known})


def load_state(path: str) -> dict:
    if os.path.exists(path):
        with open(path, "r", encoding="utf-8") as fh:
            return json.load(fh)
    return {}


def save_state(path: str, state: dict) -> None:
    tmp = path + ".tmp"
    with open(tmp, "w", encoding="utf-8") as fh:
        json.dump(state, fh)
    os.replace(tmp, path)