#!/usr/bin/env python3
"""
Shared category, feed-file, and tuning configuration.

Single source of truth for values that used to be copy-pasted across
threat_intel_bot.py, check_feeds.py, and validation/run_validation.py —
edit here, not in the callers.
"""

# category -> (display label, emoji)
CATEGORY_LABELS = {
    "news":         ("News", "📰"),
    "malware":      ("Malware", "🦠"),
    "threat_intel": ("Threat Intel", "🛰️"),
    "osint":        ("OSINT", "🕵️"),
    "research":     ("Research", "🔬"),
}

# category -> RSS feed list file. Every key here must also be in CATEGORY_LABELS.
CATEGORY_FEEDS = {
    "news":         "feeds/news_feeds.json",
    "malware":      "feeds/malware_feeds.json",
    "threat_intel": "feeds/threat_intel_feeds.json",
    "osint":        "feeds/osint_feeds.json",
    "research":     "feeds/research_feeds.json",
}

# Categories with no RSS feed of their own (e.g. fed by an API poller instead).
# Subscribable via /on_<category>, but excluded from the RSS polling/status loops.
EXTRA_CATEGORY_LABELS = {
    "ransomware": ("Ransomware", "💰"),
}

CATEGORY_EMOJIS = {
    key: emoji for key, (_label, emoji) in {**CATEGORY_LABELS, **EXTRA_CATEGORY_LABELS}.items()
}

# How often the bot/validation monitor polls feeds and the ransomware.live API.
POLL_INTERVAL_SECONDS = 300

# How long "seen" fingerprints and recently-sent titles are kept for dedup.
# Only used to suppress re-alerting on the same story — no other retention need.
SEEN_RETENTION_DAYS = 14

# Only alert on ransomware.live victims headquartered in these ISO-2 countries.
# The general global feed is available directly on ransomware.live's own site.
ALLOWED_RANSOMWARE_COUNTRIES = {"LV", "EE", "LT"}

# Cross-source near-duplicate title matching (catches the same story reported
# by two different outlets with different URLs/wording).
TITLE_DEDUP_WINDOW_HOURS = 72
TITLE_SIMILARITY_THRESHOLD = 0.72