#!/usr/bin/env python3
"""Intrusion Detection System — unified entry point.

By default this starts the localhost-only Flask web UI. Pass ``scan`` to
run the consolidated CLI scan instead.

Usage:
    python app.py                          # start the web UI (default)
    python app.py --web-port 54666         # web UI with a custom port
    python app.py scan [options]           # run the consolidated CLI scan
"""

from __future__ import annotations

import argparse
import sys

from app.utils.constants import WEB_HOST, WEB_PORT


def _web_parser() -> argparse.ArgumentParser:
    parser = argparse.ArgumentParser(
        prog="app.py",
        description="Intrusion Detection System: web UI (default) or 'scan' subcommand.",
    )
    parser.add_argument("--web-host", default=WEB_HOST,
                        help=f"web UI bind host (default: {WEB_HOST})")
    parser.add_argument("--web-port", type=int, default=WEB_PORT,
                        help=f"web UI port (default: {WEB_PORT})")
    return parser


def _run_web(host: str, port: int) -> None:
    from app.web import serve
    serve(host=host, port=port)


def _run_scan(argv: list[str]) -> None:
    from app.scan import main as scan_main
    scan_main(argv)


def _run_analyze(argv: list[str]) -> None:
    from app.analyze import main as analyze_main
    analyze_main(argv)


def main() -> None:
    # `python app.py scan ...` runs the consolidated CLI scan.
    if len(sys.argv) > 1 and sys.argv[1] == "scan":
        _run_scan(sys.argv[2:])
        return

    # `python app.py analyze ...` prints a detailed report from the SQLite store.
    if len(sys.argv) > 1 and sys.argv[1] == "analyze":
        _run_analyze(sys.argv[2:])
        return

    # Default: start the web UI (parse_known_args tolerates stray flags).
    args, _ = _web_parser().parse_known_args()
    _run_web(args.web_host, args.web_port)


if __name__ == "__main__":
    main()