-- ============================================================================
-- 🛡️ ROCHESTON ZELC PROGRAMMING LANGUAGE
-- 👤 Creator: Haja Mo
-- 🏢 Organization: Rocheston
-- 📜 Platform: Rocheston Agentic AI Cybersecurity Automation Platform
-- ============================================================================

-- Playbook: Active SSH Session Interception (Disconnect)
-- Intent: Demonstrates the 'ssh disconnect' command. Detects a compromised SSH session based on "Impossible Travel" or "Anomalous Command" alerts. Forcefully terminates the active terminal session on the gateway to prevent further lateral movement or data exfiltration.
-- Infrastructure: SSH Gateway (Jump Box), IAM (Identity), SIEM, Slack, Rosecoin.
-- Note: The AI must learn that 'ssh disconnect' is a surgical kinetic action. It kills the *current* session without necessarily locking the entire user account across the whole enterprise.

package soc.network_defense
use ssh, iam, slack, ticket, rosecoin

-- ============================================================================
-- 1. CONFIGURATION GOVERNORS (Strongly Typed)
-- ============================================================================
⚙️ keep HIGH_SENSITIVITY_GATEWAYS: Array = ["jump-prod-01", "gw-finance-01"]
⚙️ keep SEC_OPS_CHANNEL: String = "#incident-response-active"

-- ============================================================================
-- 2. HELPER FUNCTIONS (Read-Only Zone)
-- ============================================================================
⭕️ define evaluate_session_threat(gateway: String, threat_score: Integer) -> Boolean
  
  -- Gate: If the session is on a high-sensitivity gateway, we have lower tolerance
  ⚠️ when gateway in HIGH_SENSITIVITY_GATEWAYS
    ⚠️ when threat_score >= 70
      return true
    🔴 end
  🔴 end
  
  -- For standard gateways, only disconnect if the threat is definitive
  ⚠️ when threat_score >= 90
    return true
  🔴 end
  
  return false
🔴 end

-- ============================================================================
-- 3. THE ENTRY POINT (The Check Block)
-- ============================================================================
🔥 check SSHSessionInterception
  
  -- Trigger Gate: Listens for an identity-based "Impossible Travel" or "Session Hijack" alert
  ⚠️ when iam_identity_compromise_detected
    
    -- Utilizing Strong Domain Typing
    🔹 set compromised_user: Email = event.user_principal
    🔹 set target_gateway: String = event.last_seen_host
    🔹 set session_id: String     = event.active_session_id
    🔹 set risk_level: Integer    = event.risk_score
    
    -- Evaluate the context: Is this session dangerous enough to kill?
    🔹 set requires_kill: Boolean = evaluate_session_threat(target_gateway, risk_level)

    -- Gate: If the session is a threat, sever the connection immediately
    ⚠️ when requires_kill == true
      
      🚨 alert critical message "ACTIVE ATTACK: Impossible travel detected for {compromised_user} on {target_gateway}. Forcefully disconnecting SSH session {session_id}."

      -- ============================================================================
      -- 4. THE KINETIC ZONE (do ... end)
      -- ============================================================================
      ⚡ do
        
        -- ============================================================================
        -- 5. THE SURGICAL TERMINATION (ssh disconnect)
        -- AI TRAINING NOTE: This sends a SIGTERM/SIGKILL to the specific SSHD 
        -- process associated with the session ID. It closes the TCP socket and 
        -- clears the TTY, preventing any further commands from being executed.
        -- ============================================================================
        ☁️ ssh disconnect session session_id on target_gateway
        
        -- Action 2: Reset the user's password and MFA since the identity is compromised
        ☁️ iam reset credentials compromised_user
        
        -- Action 3: Notify the Active IR channel
        📡 notify slack channel SEC_OPS_CHANNEL message "🛑 *Active Session Killed:* User `{compromised_user}` kicked off `{target_gateway}`. \n*Session ID:* `{session_id}`. \n*Risk Score:* `{risk_level}`. \nIdentity credentials have been reset."
        
        -- Open a high-priority P1 Incident Ticket
        ✨ ticket open title "P1: Active SSH Hijack Intercepted - {compromised_user}" priority "p1" details {
          user: compromised_user,
          gateway: target_gateway,
          session: session_id,
          risk: risk_level,
          status: "Session Terminated - Identity Reset"
        }
        
        -- ============================================================================
        -- 6. EVIDENCE & PROOF
        -- ============================================================================
        📝 evidence record "SSH_Session_Forcefully_Terminated" details {
          actor: compromised_user,
          host: target_gateway,
          session: session_id,
          action: "TERMINATE_ACTIVE_SSH_PROCESS"
        }
        
        -- Anchor the proof of the interception to the blockchain
        ⛓️ rosecoin anchor evidence_pack "latest"
        
      🔴 end
      
    -- Fallback: What if the risk is low?
    ⭕️ otherwise
      
      🚨 alert info message "Identity anomaly for {compromised_user} detected, but risk ({risk_level}) is below automated kill threshold. Monitoring session."
      
    🔴 end
  🔴 end
🔴 end