# src/ctf/forensics.py
# Library for forensic analysis

import click
from dataclasses import dataclass
from pathlib import Path
from rich.console import Console
from rich.table import Table

@click.group(name="forensics")
def forensics_group(): pass

@forensics_group.command()
def tf(): print("hello from forensics")

@dataclass
class FileMetadata:
    filename: str
    size: int
    magic: str
    extension: str

@forensics_group.command()
@click.argument('path', type=click.Path(exists=True))
def inspect(path):
    p = Path(path)
    size = p.stat().st_size
    extension = p.suffix
    
    try:
        with open(p, 'rb') as f:
            magic = f.read(4).hex().upper()
    except Exception:
        magic = "UNKNOWN"
        
    meta = FileMetadata(
        filename=p.name,
        size=size,
        magic=magic,
        extension=extension
    )
    
    # Present using Rich Table
    console = Console()
    table = Table(title=f"Metadata: {meta.filename}", show_header=False)
    table.add_column("Key", style="bold cyan")
    table.add_column("Value")
    
    table.add_row("Filename", meta.filename)
    table.add_row("Size", f"{meta.size} bytes")
    table.add_row("Magic Bytes (Hex)", meta.magic)
    table.add_row("Extension", meta.extension)
    
    console.print(table)
    return meta