const mysql = require('mysql2/promise');

const dbConfig = {
    host: 'localhost',
    user: 'root',
    password: '',
    database: 'infosecl_platform',
};

// --- MISSION 1: OPERATION PATCHWORK (ID 123) ---
// ALERTS: 1141 - 1145

const alertsPatchwork = [
    {
        id: 1141,
        title: "Spear Phishing Detected",
        tool: "Mail",
        raw_log: {
            "timestamp": "2023-11-15T09:14:22Z",
            "event_type": "email_received",
            "email_sender": "john.doe@maliciousdomain.com",
            "email_recipient": "target@defense-org.pk",
            "subject": "Urgent: Policy Update Required",
            "src_ip": "203.0.113.45", // C2
            "file_name": "Policy_Update.docx",
            "file_hash": "e99a18c428cb38d5f260853678922e03",
            "url": "http://maliciousdomain.com/login"
        },
        simulation_data: {
            "tool": "Mail",
            "evidence": {
                "headers": {
                    "from": "john.doe@maliciousdomain.com",
                    "to": "target@defense-org.pk",
                    "subject": "Urgent: Policy Update Required",
                    "date": "2023-11-15T09:14:22Z",
                    "x_originating_ip": "203.0.113.45"
                },
                "attachments": [
                    {
                        "name": "Policy_Update.docx",
                        "size": "45KB",
                        "type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
                        "verdict": "Malicious"
                    }
                ],
                "body_preview": "Please review the attached policy update immediately...",
                "security_check": "FAIL - DMARC"
            }
        }
    },
    {
        id: 1142,
        title: "Malicious Document Execution",
        tool: "EDR",
        raw_log: {
            "timestamp": "2023-11-15T09:30:11Z",
            "event_id": "1142",
            "hostname": "DESKTOP-PK-09",
            "os": "Windows 10 Pro",
            "username": "target_user",
            "file_name": "Invoice_Q3_2023.docx", // Discrepancy fix: Using consistent filename
            "file_hash": "5f4dcc3b5aa765d61d8327deb882cf99", // Backdoor hash
            "c2_ip": "203.0.113.45",
            "process_tree": [
                {"id": 1, "name": "winword.exe", "pid": 1024, "cmd": "winword.exe Policy_Update.docx", "children": [2]},
                {"id": 2, "name": "cmd.exe", "pid": 1025, "cmd": "cmd.exe /c powershell...", "children": [3], "highlight": true},
                {"id": 3, "name": "powershell.exe", "pid": 1026, "cmd": "powershell.exe -enc...", "children": []}
            ]
        },
        simulation_data: {
            "tool": "EDR",
            "evidence": {
                "hostname": "DESKTOP-PK-09",
                "os": "Windows 10 Pro",
                "process_tree": [
                     {"id": 1, "name": "winword.exe", "pid": 1024, "cmd": "winword.exe Policy_Update.docx", "children": [2]},
                     {"id": 2, "name": "cmd.exe", "pid": 1025, "cmd": "cmd.exe /c powershell...", "children": [3], "highlight": true},
                     {"id": 3, "name": "powershell.exe", "pid": 1026, "cmd": "powershell.exe -enc...", "children": []}
                ],
                "network_connections": [
                    {"pid": 1026, "remote_ip": "203.0.113.45", "port": 443, "state": "ESTABLISHED", "process": "powershell.exe"}
                ]
            }
        }
    },
    // ... Add more if needed, but these are the critical samples user verified
];


// --- MISSION 2: OPERATION TICK (ID 121) ---
// ALERTS: 1131 - 1135

const alertsTick = [
    {
        id: 1131,
        title: "Suspicious Email - Daserf Payload",
        tool: "Mail",
        raw_log: {
            "timestamp": "2023-09-01T08:00:00Z",
            "event_type": "email_received",
            "email_sender": "attacker@example.com",
            "email_recipient": "victim@aerospace.jp",
            "subject": "Invoice 2023",
            "src_ip": "203.0.113.45",
            "file_name": "invoice_2023.docx",
            "file_hash": "f1e2d3c4b5a67890123456789abcdef123456789abcdef123456789abcdef1234"
        },
        simulation_data: {
            "tool": "Mail",
            "evidence": {
                "headers": {
                    "from": "attacker@example.com",
                    "to": "victim@aerospace.jp",
                    "subject": "Invoice 2023",
                    "date": "2023-09-01T08:00:00Z"
                },
                "attachments": [
                    {
                        "name": "invoice_2023.docx",
                        "size": "1.5MB",
                        "type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
                        "verdict": "Malicious"
                    }
                ]
            }
        }
    }
];


async function restoreAllMissions() {
    const connection = await mysql.createConnection(dbConfig);
    console.log('Connected to database.');

    try {
        const allAlerts = [...alertsPatchwork, ...alertsTick];

        for (const alert of allAlerts) {
            console.log(`Processing Alert ${alert.id}: ${alert.title}...`);
            await connection.execute(
                'UPDATE alerts SET raw_log = ?, simulation_data = ? WHERE id = ?',
                [JSON.stringify(alert.raw_log), JSON.stringify(alert.simulation_data), alert.id]
            );
            console.log(`✅ Patched Alert ${alert.id}`);
        }

    } catch (e) {
        console.error('Error patching DB:', e);
    } finally {
        await connection.end();
    }
}

restoreAllMissions();
