<?php
declare(strict_types=1);
namespace App\Platform\Soc\Correlation;

final class RiskScoreCalculator
{
    /** @param list<array<string,mixed>> $events */
    public function calculate(array $events, int $baseScore): int
    {
        $score = max(0, min(100, $baseScore));
        $critical = 0;
        $warning = 0;
        $categories = [];
        foreach ($events as $event) {
            $severity = (string) ($event['severity'] ?? 'info');
            if ($severity === 'critical') $critical++;
            if ($severity === 'warning') $warning++;
            $category = trim((string) ($event['category'] ?? ''));
            if ($category !== '') $categories[$category] = true;
        }
        $score += min(25, $critical * 8);
        $score += min(15, $warning * 3);
        $score += min(15, max(0, count($events) - 1) * 2);
        $score += min(10, max(0, count($categories) - 1) * 3);
        return max(0, min(100, $score));
    }

    public function severity(int $score): string
    {
        if ($score >= 75) return 'critical';
        if ($score >= 50) return 'high';
        if ($score >= 25) return 'medium';
        return 'low';
    }
}
