#!/usr/bin/env python3
"""Shared core for the local-dev intrusion-detection scripts.

`copyparty.py` and `npm.py` are thin adapters. They only provide:

  * a log-file matcher (glob-ish pattern / suffixes)
  * a line parser producing `Request` objects
  * a flagging rule (which IPs look hostile)
  * column definitions for their CSV output

Everything else -- IP aggregation, whitelisting, console + file reports,
MikroTik RouterOS export -- lives in this module.
"""

from __future__ import annotations

import argparse

from .constants import DEFAULT_TOP


def arg_parser(description: str, default_log_path: str,
               default_report_dir: str) -> argparse.ArgumentParser:
    p = argparse.ArgumentParser(description=description)
    p.add_argument("--log-path", default=default_log_path,
                   help=f"log directory (default: {default_log_path})")
    p.add_argument("--report-dir", default=default_report_dir,
                   help=f"report output dir (default: {default_report_dir})")
    p.add_argument("--top", type=int, default=DEFAULT_TOP,
                   help=f"rows in the top-IP table (default: {DEFAULT_TOP})")
    p.add_argument("--quiet", action="store_true",
                   help="write files, print nothing but the paths")
    p.add_argument("--no-rsc", action="store_true",
                   help="skip MikroTik .rsc generation")
    return p