"""Windows event data attribute containers."""

from dfdatetime import uuid_time as dfdatetime_uuid_time

from plaso.containers import events


class WindowsDistributedLinkTrackingEventData(events.EventData):
  """Windows distributed link event data attribute container.

  Attributes:
    creation_time (dfdatetime.DateTimeValues): file entry creation date
        and time.
    mac_address (str): MAC address stored in the UUID.
    origin (str): origin of the event (event source).
        E.g. the path of the corresponding LNK file or file reference
        MFT entry with the corresponding NTFS $OBJECT_ID attribute.
    uuid (str): UUID.
  """

  DATA_TYPE = 'windows:distributed_link_tracking:creation'

  def __init__(self, uuid, origin):
    """Initializes an event object.

    Args:
      uuid (uuid.UUID): UUID.
      origin (str): origin of the event (event source).
          E.g. the path of the corresponding LNK file or file reference
          MFT entry with the corresponding NTFS $OBJECT_ID attribute.

    Raises:
      ValueError: if the UUID version is not supported.
    """
    if uuid.version != 1:
      raise ValueError('Unsupported UUID version.')

    mac_address = (f'{uuid.hex[20:22]:s}:{uuid.hex[22:24]:s}:'
                   f'{uuid.hex[24:26]:s}:{uuid.hex[26:28]:s}:'
                   f'{uuid.hex[28:30]:s}:{uuid.hex[30:32]:s}')

    super().__init__(
        data_type=self.DATA_TYPE)
    self.creation_time = dfdatetime_uuid_time.UUIDTime(timestamp=uuid.time)
    self.mac_address = mac_address
    # TODO: replace origin my something machine readable.
    self.origin = origin
    self.uuid = f'{uuid!s}'


class WindowsRegistryEventData(events.EventData):
  """Windows Registry event data attribute container.

  Attributes:
    key_path (str): Windows Registry key path.
    last_written_time (dfdatetime.DateTimeValues): key last written date and
        time.
    values (list[tuple[str, str, str]]): name, data type and data of the values
        in the key.
  """

  DATA_TYPE = 'windows:registry:key_value'

  def __init__(self):
    """Initializes event data."""
    super().__init__(data_type=self.DATA_TYPE)
    self.key_path = None
    self.last_written_time = None
    self.values = None


class WindowsShellItemFileEntryEventData(events.EventData):
  """Windows shell item file entry event data attribute container.

  Attributes:
    access_time (dfdatetime.DateTimeValues): file entry last access date
        and time.
    creation_time (dfdatetime.DateTimeValues): file entry creation date
        and time.
    file_reference (str): NTFS file reference, in the format:
        "MTF entry - sequence number".
    localized_name (str): localized name of the file entry shell item.
    long_name (str): long name of the file entry shell item.
    modification_time (dfdatetime.DateTimeValues): file entry last modification
        date and time.
    name (str): name of the file entry shell item.
    origin (str): origin of the event.
    shell_item_path (str): shell item path.
  """

  DATA_TYPE = 'windows:shell_item:file_entry'

  def __init__(self):
    """Initializes event data."""
    super().__init__(
        data_type=self.DATA_TYPE)
    self.access_time = None
    self.creation_time = None
    self.file_reference = None
    self.localized_name = None
    self.long_name = None
    self.modification_time = None
    self.name = None
    self.origin = None
    self.shell_item_path = None


class WindowsVolumeEventData(events.EventData):
  """Windows volume event data attribute container.

  Attributes:
    creation_time (dfdatetime.DateTimeValues): volume creation date and time.
    device_path (str): volume device path.
    origin (str): origin of the event (event source), for example
        the corresponding Prefetch file name.
    serial_number (str): volume serial number.
  """

  DATA_TYPE = 'windows:volume:creation'

  def __init__(self):
    """Initializes event data."""
    super().__init__(data_type=self.DATA_TYPE)
    self.creation_time = None
    self.device_path = None
    # TODO: replace origin with something machine readable.
    self.origin = None
    self.serial_number = None
