"""Security-lake playbook, step 3: one `gcs` source per OCSF class, each mapped
through the pack's catalog, each on a daily schedule.

The catalog decides how every OCSF row becomes an event (its `type_uid` picks
the event type; the actor's uid is the user). The schedules keep the lake
flowing in production; step 4 runs the same syncs now, through the documented
manual trigger, so this page does not wait for 03:00 UTC.
"""

import sys
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parents[1]))  # playbooks/playbook_api.py
from playbook_api import Api, State

api, state = Api(), State("security-lake")

bucket = state["bucket"]
sources = {}
for catalog in ("ocsf.authentication", "ocsf.account_change", "ocsf.api_activity"):
    folder = catalog.removeprefix("ocsf.")
    source = api.post(
        "/sources",
        {
            "name": f"ocsf {folder}",
            "kind": "gcs",
            "config": {"bucket": bucket, "prefix": f"ocsf/{folder}/", "format": "parquet"},
        },
        key=f"security-lake-source-{folder}",
    )
    source_id = source["source_id"]
    api.put(f"/sources/{source_id}/mapping", {"pack_catalog": {"pack": "ocsf", "catalog": catalog}})
    provenance = api.get(f"/sources/{source_id}/mapping/provenance")
    schedule = api.put(
        f"/sources/{source_id}/schedule",
        {"schedule": {"kind": "daily", "at_utc": "03:00"}, "enabled": True},
    )
    sources[catalog] = source_id
    pinned = provenance.get("pack_fingerprint") is not None
    print(f"{catalog}: mapped through the pack catalog, pack pinned: {pinned}")
    print(f"{catalog}: schedule daily at 03:00 UTC, enabled: {schedule['enabled']}")
state.update(sources=sources)