<?php

namespace Database\Factories;

use App\Models\SecurityEvent;
use App\Models\Site;
use Illuminate\Database\Eloquent\Factories\Factory;

class SecurityEventFactory extends Factory
{
    protected $model = SecurityEvent::class;

    public function definition(): array
    {
        return [
            'site_id'     => Site::factory(),
            'type'        => $this->faker->randomElement(['brute_force', 'tor_exit', 'malware', 'firewall', 'scan']),
            'severity'    => $this->faker->randomElement(['info', 'low', 'medium', 'high', 'critical']),
            'blocked'     => true,
            'source_ip'   => $this->faker->ipv4(),
            'country'     => $this->faker->countryCode(),
            'message'     => $this->faker->sentence(8),
            'meta'        => null,
            'occurred_at' => $this->faker->dateTimeBetween('-24 hours', 'now'),
        ];
    }

    public function critical(): self
    {
        return $this->state(['severity' => 'critical']);
    }
}