from __future__ import annotations

from collections import defaultdict

from .logs import THREAT_ACTIONS, is_utm_event
from .models import LogEvent


def correlate_source_ips(events: list[LogEvent], *, limit: int = 20) -> list[dict[str, object]]:
    grouped: dict[str, list[LogEvent]] = defaultdict(list)
    for event in events:
        if event.src_ip:
            grouped[event.src_ip].append(event)
    correlations = []
    for source_ip, source_events in grouped.items():
        streams = sorted({event.fields.get("fgai_stream", "local_syslog") for event in source_events})
        if len(streams) < 2:
            continue
        threat_events = sum(event.action in THREAT_ACTIONS or is_utm_event(event) for event in source_events)
        correlations.append({"source_ip": source_ip, "streams": streams, "events": len(source_events), "security_events": threat_events})
    return sorted(correlations, key=lambda item: (int(item["security_events"]), int(item["events"])), reverse=True)[:limit]