// lib/ja4-lookup.ts
const JA4DB_API_URL = 'https://atlas.platphormnews.com/api'

export interface JA4LookupResult {
  fingerprint: string
  label: string | null
  application: string | null
  category: string | null
  severity: 'critical' | 'high' | 'medium' | 'low' | 'info' | null
  first_seen: string | null
  observation_count: number
  campaigns: Array<{
    name: string
    severity: string
    confidence: number
  }>
}

export async function lookupJA4(fingerprint: string): Promise<JA4LookupResult | null> {
  try {
    const response = await fetch(
      `${JA4DB_API_URL}/lookup?fingerprint=${encodeURIComponent(fingerprint)}`,
      { next: { revalidate: 3600 } } // Cache for 1 hour
    )
    
    if (!response.ok) return null
    return response.json()
  } catch {
    return null
  }
}

// Example: Check if a fingerprint is associated with known malware
export async function isMalicious(fingerprint: string): Promise<boolean> {
  const result = await lookupJA4(fingerprint)
  if (!result) return false
  return result.severity === 'critical' || result.severity === 'high'
}