-- ============================================================================
-- ANUBIS CRAWLER RULES — Labeling des http_logs + pipeline ML
-- Architecture simplifiée (IP/CIDR et ASN uniquement) :
--   anubis_ip_rules (table) → dict_anubis_ip (IP_TRIE)
--   anubis_asn_rules (table) → dict_anubis_asn (FLAT)
--   http_logs : +anubis_bot_name, +anubis_bot_action, +anubis_bot_category
--   mv_http_logs : enrichissement Anubis (IP > ASN)
--   view_ai_features_1h : +anubis_bot_name, +anubis_bot_action (via dictGet)
--   ml_detected_anomalies / ml_all_scores : colonnes Anubis
-- ============================================================================

-- ----------------------------------------------------------------------------
-- 1. TABLE SOURCE — règles IP/CIDR (pour dictionnaire IP_TRIE)
--    Peuplée par fetch_rules.py depuis les fichiers YAML Anubis.
-- ----------------------------------------------------------------------------
CREATE TABLE IF NOT EXISTS ja4_processing.anubis_ip_rules
(
    prefix   String,
    bot_name LowCardinality(String),
    action   LowCardinality(String),
    rule_id  UInt64,
    has_ua   UInt8,
    category LowCardinality(String)
)
ENGINE = ReplacingMergeTree()
ORDER BY prefix;

-- ----------------------------------------------------------------------------
-- 3. TABLE SOURCE — règles ASN (pour dictionnaire Flat)
--    Peuplée par fetch_rules.py depuis botPolicies.yaml.
-- ----------------------------------------------------------------------------
CREATE TABLE IF NOT EXISTS ja4_processing.anubis_asn_rules
(
    asn      UInt32,
    bot_name LowCardinality(String),
    action   LowCardinality(String),
    category LowCardinality(String)
)
ENGINE = ReplacingMergeTree()
ORDER BY asn;

-- ----------------------------------------------------------------------------
-- 4. DICTIONNAIRE IP — IP_TRIE (actif)
-- ----------------------------------------------------------------------------
DROP DICTIONARY IF EXISTS ja4_processing.dict_anubis_ip;
CREATE DICTIONARY ja4_processing.dict_anubis_ip
(
    prefix   String,
    bot_name String,
    action   String,
    rule_id  UInt64,
    has_ua   UInt8,
    category String
)
PRIMARY KEY prefix
SOURCE(CLICKHOUSE(HOST 'localhost' PORT 9000 USER 'admin' PASSWORD 'CHANGE_ME' DB 'ja4_processing' TABLE 'anubis_ip_rules'))
LAYOUT(IP_TRIE())
LIFETIME(MIN 300 MAX 600);

-- ----------------------------------------------------------------------------
-- 5. DICTIONNAIRE ASN — Flat (actif)
-- ----------------------------------------------------------------------------
DROP DICTIONARY IF EXISTS ja4_processing.dict_anubis_asn;
CREATE DICTIONARY ja4_processing.dict_anubis_asn
(
    asn      UInt32,
    bot_name String,
    action   String,
    category String
)
PRIMARY KEY asn
SOURCE(CLICKHOUSE(HOST 'localhost' PORT 9000 USER 'admin' PASSWORD 'CHANGE_ME' DB 'ja4_processing' TABLE 'anubis_asn_rules'))
LAYOUT(FLAT())
LIFETIME(MIN 300 MAX 600);

-- ----------------------------------------------------------------------------
-- 6. AJOUT DES COLONNES ANUBIS dans http_logs (idempotent)
-- ----------------------------------------------------------------------------
ALTER TABLE ja4_logs.http_logs
    ADD COLUMN IF NOT EXISTS anubis_bot_name     LowCardinality(String) DEFAULT '',
    ADD COLUMN IF NOT EXISTS anubis_bot_action   LowCardinality(String) DEFAULT '',
    ADD COLUMN IF NOT EXISTS anubis_bot_category LowCardinality(String) DEFAULT '';

-- ============================================================================
-- INTÉGRATION ML — Propagation Anubis vers le pipeline bot_detector
-- ============================================================================

-- ----------------------------------------------------------------------------
-- 7. COLONNES ANUBIS dans ml_detected_anomalies
-- ----------------------------------------------------------------------------
ALTER TABLE ja4_processing.ml_detected_anomalies
    ADD COLUMN IF NOT EXISTS anubis_bot_name     LowCardinality(String) DEFAULT '',
    ADD COLUMN IF NOT EXISTS anubis_bot_action   LowCardinality(String) DEFAULT '',
    ADD COLUMN IF NOT EXISTS anubis_bot_category LowCardinality(String) DEFAULT '';

-- ----------------------------------------------------------------------------
-- 8. COLONNES ANUBIS dans ml_all_scores
-- ----------------------------------------------------------------------------
ALTER TABLE ja4_processing.ml_all_scores
    ADD COLUMN IF NOT EXISTS anubis_bot_name     LowCardinality(String) DEFAULT '',
    ADD COLUMN IF NOT EXISTS anubis_bot_action   LowCardinality(String) DEFAULT '',
    ADD COLUMN IF NOT EXISTS anubis_bot_category LowCardinality(String) DEFAULT '';

-- ----------------------------------------------------------------------------
-- 9. VIEW view_ai_features_1h — Enrichissement Anubis
--    Voir view_ai_features_anubis.sql pour le CREATE OR REPLACE VIEW complet.
-- ----------------------------------------------------------------------------