ScanPage.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "Resource.hpp"
#include "ScanPage.hpp"
#include "Backend.hpp"
#include "Quarantine.hpp"
#include "Utils.hpp"
#include "cloud/MalwareBazaar.hpp"
#include "AurScan.hpp"
#include <atomic>
#include <chrono>
#include <iostream>
#include <fstream>
#include <filesystem>
#include <unordered_set>
#include <openssl/sha.h>
#include <nlohmann/json.hpp>
#include <sys/inotify.h>
#include <unistd.h>
 
namespace fs = std::filesystem;
using json = nlohmann::json;
 
 
extern std::string globalMalwareBazaarApiKey;
 
 
static std::unordered_set<std::string> recentlyScanned;
 
 
// ---------------------------------------------------------------------------
// Build/compile detection: salta la scansione automatica quando l'utente sta
// compilando, altrimenti l'inotify scatta su centinaia di file in pochi secondi
// e il sistema rallenta troppo.
// ---------------------------------------------------------------------------
 
// Burst counter: se arrivano troppi eventi in una finestra breve, si presume
// una compilazione in corso e si entra in modalità "throttle".
static std::atomic<int>      g_recentEventCount{0};
static std::atomic<int64_t>  g_burstWindowStartMs{0};
static std::atomic<int64_t>  g_throttleUntilMs{0};
 
// Soglie (regolabili)
static constexpr int     kBurstWindowMs    = 2000;   // finestra di osservazione
static constexpr int     kBurstThreshold   = 20;     // > N eventi nella finestra = burst
static constexpr int64_t kThrottleHoldMs   = 5000;   // dopo un burst, sospende per N ms
 
static int64_t nowMs() {
    return std::chrono::duration_cast<std::chrono::milliseconds>(
        std::chrono::steady_clock::now().time_since_epoch()).count();
}
 
static bool ends_with(const std::string& s, const std::string& suf) {
    return s.size() >= suf.size() &&
    s.compare(s.size() - suf.size(), suf.size(), suf) == 0;
}
 
// Estensioni tipiche di artefatti di compilazione: oggetti, librerie statiche/
// condivise temporanee, bytecode, ecc. Sui file con queste estensioni saltiamo
// la scansione automatica perché vengono prodotti a raffica dai compilatori.
static bool isBuildArtifactExt(const std::string& path) {
    static const char* exts[] = {
        ".o", ".obj", ".a", ".lo", ".la", ".pyc", ".pyo",
        ".class", ".d", ".gch", ".pch", ".mod", ".swp", ".swo",
        ".rlib", ".rmeta", ".tmp", ".bc", ".ll"
    };
    for (auto* e : exts) {
        if (ends_with(path, e)) return true;
    }
    return false;
}
 
// Directory tipiche dove i sistemi di build scrivono (CMake, Cargo, Node,
// Maven/Gradle, autotools, Meson, ecc.). Se il path le contiene, skip.
static bool isInBuildDir(const std::string& path) {
    static const char* needles[] = {
        "/build/", "/cmake-build-", "/CMakeFiles/", "/.ninja_",
        "/target/",        // Cargo / Rust, Maven
        "/node_modules/",  // npm
        "/dist/", "/out/", "/bin/", "/obj/",
        "/.gradle/", "/.m2/", "/.cargo/",
        "/__pycache__/", "/.pytest_cache/",
        "/.next/", "/.nuxt/", "/.svelte-kit/",
        "/.tox/", "/.venv/", "/venv/",
        "/Debug/", "/Release/"
    };
    for (auto* n : needles) {
        if (path.find(n) != std::string::npos) return true;
    }
    return false;
}
 
static std::string normalizePath(std::string p) {
    while (!p.empty() && p.back() == '/')
        p.pop_back();
    return p;
}
 
static std::string trim(const std::string& s) {
    size_t start = s.find_first_not_of(" \n\r\t");
    if (start == std::string::npos) return "";
    size_t end = s.find_last_not_of(" \n\r\t");
    return s.substr(start, end - start + 1);
}
 
 
ScanPage::~ScanPage()
{
    if (alive_) alive_->store(false, std::memory_order_release);
}
 
 
ScanPage::ScanPage(Gtk::Window& parent)
: Gtk::Box(Gtk::Orientation::VERTICAL, 5),
parentWindow(parent)
{
    set_margin(8);
    set_spacing(5);
 
 
    buttonBox.set_spacing(8);
    buttonBox.append(btnChooseFolder);
    buttonBox.append(btnChooseFile);
    buttonBox.append(btnScan);
    append(buttonBox);
 
    btnChooseFolder.signal_clicked().connect(sigc::mem_fun(*this, &ScanPage::onChooseFolder));
    btnChooseFile.signal_clicked().connect(sigc::mem_fun(*this, &ScanPage::onChooseFile));
    btnScan.signal_clicked().connect(sigc::mem_fun(*this, &ScanPage::onStartScan));
 
    // ===== UI scansione automatica =====
    autoScanLabel.set_text(_("Scansione automatica"));
    autoScanBox.set_spacing(8);
    autoScanBox.append(autoScanLabel);
    autoScanBox.append(autoScanSwitch);
    append(autoScanBox);
 
    autoScanSwitch.set_active(true);
    autoScanEnabled = true;
 
    autoScanSwitch.property_active().signal_changed().connect([this]() {
        autoScanEnabled = autoScanSwitch.get_active();
        enqueueLog(autoScanEnabled ? _("⚙️ Scansione automatica attiva")
        : _("⛔ Scansione automatica disattivata"));
        if (autoScanEnabled) {
            enableAutoScanDownloads();
            enableGlobalDownloadMonitor();
        } else {
            disableAllMonitors();
        }
        saveConfig();
    });
 
    textBuffer = Gtk::TextBuffer::create();
    textView.set_buffer(textBuffer);
    textView.set_editable(false);
    textView.set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
 
    auto scrollLog = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrollLog->set_child(textView);
    scrollLog->set_min_content_height(180);
    scrollLog->set_expand(true);
    append(*scrollLog);
 
 
    auto scrollFiles = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrollFiles->set_child(fileListBox);
    scrollFiles->set_min_content_height(150);
    scrollFiles->set_expand(true);
    append(*scrollFiles);
 
 
    apiKeyBox.set_spacing(8);
    auto lbl = Gtk::make_managed<Gtk::Label>(_("API Key VirusTotal:"));
    lbl->set_valign(Gtk::Align::CENTER);
    apiKeyEntry.set_hexpand(true);
    apiKeyEntry.set_visibility(false);
    apiKeyBox.append(*lbl);
    apiKeyBox.append(apiKeyEntry);
 
    apiKeyBox.set_spacing(8);
 
 
    lbl->set_valign(Gtk::Align::CENTER);
 
 
    apiKeyEntry.set_hexpand(true);
    apiKeyEntry.set_visibility(false);
    apiKeyEntry.set_valign(Gtk::Align::CENTER);
 
 
    btnShowApiKey.set_icon_name("view-reveal-symbolic");
    btnShowApiKey.add_css_class("flat");
    btnShowApiKey.set_valign(Gtk::Align::CENTER);
 
 
    btnApiKeySave.set_valign(Gtk::Align::CENTER);
 
 
    btnPrivacy.set_icon_name("dialog-information-symbolic");
    btnPrivacy.set_tooltip_text(_("Privacy e dati cloud"));
    btnPrivacy.add_css_class("flat");
    btnPrivacy.set_valign(Gtk::Align::CENTER);
 
    btnShowApiKey.signal_clicked().connect(
        sigc::mem_fun(*this, &ScanPage::onToggleApiKeyVisibility)
    );
 
 
    apiKeyActionsBox.set_valign(Gtk::Align::CENTER);
    apiKeyActionsBox.append(btnShowApiKey);
    apiKeyActionsBox.append(btnApiKeySave);
    apiKeyActionsBox.append(btnPrivacy);
 
 
    apiKeySizeGroup = Gtk::SizeGroup::create(Gtk::SizeGroup::Mode::VERTICAL);
    apiKeySizeGroup->add_widget(apiKeyEntry);
    apiKeySizeGroup->add_widget(btnShowApiKey);
    apiKeySizeGroup->add_widget(btnApiKeySave);
    apiKeySizeGroup->add_widget(btnPrivacy);
 
 
    apiKeyBox.append(*lbl);
    apiKeyBox.append(apiKeyEntry);
    apiKeyBox.append(apiKeyActionsBox);
 
    append(apiKeyBox);
 
 
 
    btnPrivacy.set_label(_("Privacy / Dati cloud"));
    btnPrivacy.set_icon_name("dialog-information");
    btnPrivacy.set_halign(Gtk::Align::START);
    btnPrivacy.add_css_class("flat");
 
    btnPrivacy.signal_clicked().connect(
        sigc::mem_fun(*this, &ScanPage::showCloudPrivacyDisclaimer)
    );
 
 
 
    btnApiKeySave.signal_clicked().connect(sigc::mem_fun(*this, &ScanPage::onApiKeySaveClicked));
 
    loadConfig();
    loadCloudApiKeys();
    loadCloudConfig();
 
 
    inotifyFd = inotify_init1(IN_NONBLOCK | IN_CLOEXEC);
    if (inotifyFd < 0) {
        enqueueLog(_("❌ Errore: inotify non inizializzato"));
    } else {
        enqueueLog(_("📡 Inotify inizializzato"));
 
        inotifySource = Glib::IOSource::create(inotifyFd, Glib::IOCondition::IO_IN);
 
        inotifySource->connect(sigc::mem_fun(*this, &ScanPage::onInotifyEvent));
        inotifySource->attach(Glib::MainContext::get_default());
    }
 
 
    knownDownloadDirs = detectBrowserDownloadDirs();
    enableAutoScanDownloads();
    enableGlobalDownloadMonitor();
}
 
 
void ScanPage::enqueueLog(const std::string& msg) {
    std::lock_guard<std::mutex> lock(logMutex);
    pendingLog.push_back(msg);
    if (!logFlushScheduled) {
        logFlushScheduled = true;
        Glib::signal_timeout().connect_once(
            [this]() { flushLog(); }, 50
        );
    }
}
 
void ScanPage::flushLog() {
    std::vector<std::string> batch;
    {
        std::lock_guard<std::mutex> lock(logMutex);
        batch.swap(pendingLog);
        logFlushScheduled = false;
    }
    Glib::ustring s;
    for (auto& m : batch) s += m + "\n";
    textBuffer->insert(textBuffer->end(), s);
}
 
 
std::string getConfigPath() {
    return Glib::get_home_dir() + "/.local/share/BastionGuard/config.json";
}
 
void ScanPage::saveConfig() {
    try {
        fs::create_directories(Glib::get_home_dir() + "/.local/share/BastionGuard");
        json cfg;
        cfg["auto_scan_enabled"] = autoScanEnabled;
        std::ofstream ofs(getConfigPath());
        ofs << cfg.dump(4);
    } catch (...) {}
}
 
void ScanPage::loadConfig() {
    try {
        if (!fs::exists(getConfigPath())) return;
        json cfg;
        std::ifstream ifs(getConfigPath());
        ifs >> cfg;
        autoScanEnabled = cfg.value("auto_scan_enabled", true);
        autoScanSwitch.set_active(autoScanEnabled);
    } catch (...) {}
}
 
void ScanPage::addInotifyRecursive(const std::string& root)
{
    namespace fs = std::filesystem;
 
    if (!fs::exists(root)) return;
 
    std::string norm = normalizePath(root);
 
    // Evita duplicati
    if (alreadyWatched.count(norm)) return;
 
    // ANTI-BOOTLOOP: se la cartella è una directory di build (CMake, Cargo,
    // node_modules, .venv, target/, …), NON aggiungere watch. Durante una
    // compilazione vengono creati migliaia di file in pochi secondi: senza
    // questo filtro inotify scatena un cascade di eventi che a sua volta
    // satura il main loop (handleInotifyFileEvent -> clamdscan async ->
    // ulteriori scritture) → bootloop di ScanPage e degrado del sistema.
    if (isInBuildDir(norm + "/")) {
        return;
    }
 
    alreadyWatched.insert(norm);
 
    int wd = inotify_add_watch(
        inotifyFd,
        norm.c_str(),
                               IN_CREATE | IN_MOVED_TO | IN_CLOSE_WRITE | IN_ATTRIB
    );
 
    if (wd < 0) {
        enqueueLog(_("⚠️ Impossibile monitorare: ") + norm);
        return;
    }
 
    watchMap[wd] = norm;
    enqueueLog(_("📁 Watch attivo: ") + norm);
 
 
    try {
        for (auto& entry : fs::directory_iterator(norm)) {
            if (entry.is_directory()) {
                std::string sub = entry.path().string();
                // ignora cartelle nascoste
                std::string name = entry.path().filename().string();
                if (!name.empty() && name[0] == '.')
                    continue;
 
                // ANTI-BOOTLOOP: non scendere in directory di build note
                // (build/, target/, node_modules/, CMakeFiles/, ecc.).
                // Il check con "/" finale forza isInBuildDir a matchare il
                // segmento completo.
                if (isInBuildDir(sub + "/")) {
                    continue;
                }
 
                addInotifyRecursive(sub);
            }
        }
    } catch (...) {
 
    }
}
 
 
bool ScanPage::onInotifyEvent(Glib::IOCondition cond)
{
    if (!static_cast<bool>(cond & Glib::IOCondition::IO_IN))
        return true;
 
    char buffer[4096]
    __attribute__((aligned(__alignof__(struct inotify_event))));
 
    ssize_t len = read(inotifyFd, buffer, sizeof(buffer));
    if (len <= 0)
        return true;
 
    const char* ptr = buffer;
 
    while (ptr < buffer + len) {
        const inotify_event* ev =
        reinterpret_cast<const inotify_event*>(ptr);
 
        std::string parentDir =
        watchMap.count(ev->wd) ? watchMap[ev->wd] : "";
 
        std::string name = ev->len ? std::string(ev->name) : "";
        std::string fullPath = parentDir + "/" + name;
 
        handleInotifyFileEvent(fullPath, ev->mask);
 
        ptr += sizeof(struct inotify_event) + ev->len;
    }
 
    return true;
}
 
void ScanPage::onChooseFolder()
{
    auto dialog = Gtk::FileDialog::create();
    dialog->set_title(_("Seleziona cartella"));
    dialog->set_modal(true);
 
    dialog->select_folder(
        parentWindow,
        sigc::bind(
            sigc::mem_fun(*this, &ScanPage::onChooseFolderFinish),
                   dialog
        )
    );
}
 
void ScanPage::onChooseFolderFinish(const Glib::RefPtr<Gio::AsyncResult>& result,
                                    Glib::RefPtr<Gtk::FileDialog> dialog)
{
    try {
        auto file = dialog->select_folder_finish(result);
        if (!file)
            return;
 
        selectedPath = file->get_path();
        enqueueLog(_("📁 Cartella selezionata: ") + selectedPath);
    }
    catch (const Glib::Error&) {
    }
}
 
 
 
void ScanPage::onChooseFile()
{
    auto dialog = Gtk::FileDialog::create();
    dialog->set_title(_("Seleziona file"));
    dialog->set_modal(true);
 
    dialog->open(
        parentWindow,
        sigc::bind(
            sigc::mem_fun(*this, &ScanPage::onChooseFileFinish),
                   dialog
        )
    );
}
 
void ScanPage::onChooseFileFinish(const Glib::RefPtr<Gio::AsyncResult>& result,
                                  Glib::RefPtr<Gtk::FileDialog> dialog)
{
    try {
        auto file = dialog->open_finish(result);
        if (!file)
            return;
 
        selectedPath = file->get_path();
        enqueueLog(_("📄 File selezionato: ") + selectedPath);
    }
    catch (const Glib::Error&) {
    }
}
 
 
void ScanPage::loadCloudConfig()
{
    std::string path = Glib::get_home_dir() + "/.config/BastionGuard/cloud.conf";
 
    try {
        if (!fs::exists(path)) {
            malwareBazaarApiKey = "";
            return;
        }
 
        std::ifstream f(path);
        std::string line;
 
        while (std::getline(f, line)) {
            line = trim(line);
            if (line.empty() || line[0] == '#') continue;
 
            size_t eq = line.find('=');
            if (eq == std::string::npos) continue;
 
            std::string key = trim(line.substr(0, eq));
            std::string value = trim(line.substr(eq + 1));
 
            if (key == "malware_bazaar_api_key") {
                malwareBazaarApiKey = value;
            }
        }
 
        apiKeyEntry.set_text(malwareBazaarApiKey);
        enqueueLog(_("🔑 API Key VirusTotal caricata da cloud.conf"));
        globalMalwareBazaarApiKey = malwareBazaarApiKey;
    }
    catch (...) {
        enqueueLog(_("⚠️ Errore caricamento cloud.conf"));
    }
}
 
 
void ScanPage::saveCloudConfig()
{
    std::string dir = Glib::get_home_dir() + "/.config/BastionGuard";
    std::string path = dir + "/cloud.conf";
 
    try {
        fs::create_directories(dir);
 
        std::ofstream f(path);
        f << "malware_bazaar_api_key=" << malwareBazaarApiKey << "\n";
 
        enqueueLog(_("💾 API Key salvata in cloud.conf"));
        globalMalwareBazaarApiKey = malwareBazaarApiKey;
    }
    catch (...) {
        enqueueLog(_("❌ Errore salvataggio cloud.conf"));
    }
}
 
void ScanPage::onApiKeySaveClicked()
{
    malwareBazaarApiKey = apiKeyEntry.get_text();
    saveCloudConfig();
}
 
 
void ScanPage::handleInotifyFileEvent(const std::string& path, uint32_t mask)
{
    if (!autoScanEnabled) return;
    if (path.empty()) return;
 
    // Filtro directory rumorose / sensibili. Usiamo segmenti con slash su
    // entrambi i lati per evitare falsi positivi come "/builder" o
    // "/.localdomain". Il filtro per le build dir vere è isInBuildDir()
    // poco sotto, qui filtriamo solo cache/git/local privati.
    if (path.find("/.cache/") != std::string::npos ||
        path.find("/.local/") != std::string::npos ||
        path.find("/.git/")   != std::string::npos)
        return;
 
 
    if (!(mask & (IN_CLOSE_WRITE | IN_MOVED_TO)))
        return;
 
 
    if (ends_with(path, ".part") || ends_with(path, ".crdownload"))
        return;
 
    // ---- Anti-compilazione: salta artefatti di build e directory di build.
    // Sui progetti che si compilano si producono molti file in pochi secondi,
    // se partisse una scansione per ognuno il sistema rallenterebbe troppo
    // (bootloop di ScanPage). Questo check va fatto PRIMA del burst counter,
    // così i file di build non lo gonfiano (altrimenti rischiamo di entrare
    // in throttle anche quando l'utente sta solo scaricando legittimamente).
    if (isBuildArtifactExt(path) || isInBuildDir(path))
        return;
 
    // ---- Anti-compilazione (parte 2): rilevamento "burst di scrittura".
    // Se in una finestra breve arrivano molti eventi vicini, presumiamo che
    // sia in corso una compilazione: entriamo in throttle e per qualche
    // secondo non scansioniamo nulla automaticamente.
    {
        const int64_t now = nowMs();
 
        // Se siamo già in throttle, salta direttamente.
        if (now < g_throttleUntilMs.load(std::memory_order_relaxed)) {
            return;
        }
 
        // Aggiorna/azzera la finestra di osservazione.
        int64_t winStart = g_burstWindowStartMs.load(std::memory_order_relaxed);
        if (winStart == 0 || now - winStart > kBurstWindowMs) {
            g_burstWindowStartMs.store(now, std::memory_order_relaxed);
            g_recentEventCount.store(1, std::memory_order_relaxed);
        } else {
            int n = g_recentEventCount.fetch_add(1, std::memory_order_relaxed) + 1;
            if (n > kBurstThreshold) {
                // Burst rilevato → throttle: niente scansione automatica.
                g_throttleUntilMs.store(now + kThrottleHoldMs,
                                        std::memory_order_relaxed);
                g_burstWindowStartMs.store(0, std::memory_order_relaxed);
                g_recentEventCount.store(0, std::memory_order_relaxed);
                enqueueLog(_("⏸️ Compilazione/burst rilevato: scansione automatica sospesa temporaneamente"));
                return;
            }
        }
    }
 
    if (recentlyScanned.count(path)) return;
    recentlyScanned.insert(path);
    Glib::signal_timeout().connect_once([path](){
        recentlyScanned.erase(path);
    }, 1500);
 
 
    Glib::signal_timeout().connect_once(
        [this, path]() {
            if (!fs::exists(path)) return;
            scanFileAutomatically(path);
        },
        100
    );
}
 
 
 
void ScanPage::disableAllMonitors()
{
    alreadyWatched.clear();
    watchMap.clear();
 
    if (inotifyFd >= 0) {
        close(inotifyFd);
        inotifyFd = -1;
    }
 
    enqueueLog(_("🛑 Tutti i monitor inotify sono stati disattivati"));
}
 
void ScanPage::onStartScan()
{
    if (scanInProgress) {
        enqueueLog(_("⏳ È già in corso un'altra scansione..."));
        return;
    }
 
    if (selectedPath.empty()) {
        textBuffer->set_text(_("⚠️ Nessun file o cartella selezionato.\n"));
        return;
    }
 
    scanInProgress = true;
    selectedPath = trim(selectedPath);
 
    textBuffer->set_text(_("🔍 Avvio scansione con clamdscan...\n\n"));
 
    infectedFilesBuffer.clear();
    fileListBox.remove_all();
 
    try {
        std::vector<std::string> argv = {
            "clamdscan",
            "--fdpass",
            "--no-summary",
            "--infected",
            selectedPath
        };
 
        subprocess = Gio::Subprocess::create(
            argv,
            Gio::Subprocess::Flags::STDOUT_PIPE |
            Gio::Subprocess::Flags::STDERR_PIPE
        );
 
        stdoutStream = subprocess->get_stdout_pipe();
        dataStream = Gio::DataInputStream::create(stdoutStream);
 
        dataStream->read_line_async(
            sigc::mem_fun(*this, &ScanPage::readOutput),
                                    Glib::RefPtr<Gio::Cancellable>(),
                                    Glib::PRIORITY_DEFAULT
        );
    }
    catch (const Glib::Error& ex) {
        textBuffer->insert(textBuffer->end(),
                           _("❌ Errore avvio clamdscan: ") + Glib::ustring(ex.what()) + "\n"
        );
        scanInProgress = false;
    }
}
 
 
void ScanPage::readOutput(const Glib::RefPtr<Gio::AsyncResult>& result)
{
    try {
        std::string line;
        bool ok = dataStream->read_line_finish(result, line);
 
        if (!ok) {
            scanInProgress = false;
            textBuffer->insert(textBuffer->end(), _("✅ Scansione completata.\n"));
            return;
        }
 
        auto alive = alive_;
        Glib::signal_idle().connect_once([this, alive, line]() {
            BastionGuard::if_alive(alive, [this, &line]() {
                textBuffer->insert(textBuffer->end(), line + "\n");
 
                // Esempio: "Scanning /path/file"
                if (line.rfind("Scanning ", 0) == 0) {
                    std::string filepath = line.substr(9);
                    addFileToList(filepath);
                }
 
                // Esempio: "/file: Virus FOUND"
                if (line.find("FOUND") != std::string::npos) {
 
                    size_t pos = line.find(": ");
                    size_t end = line.find(" FOUND");
 
                    if (pos != std::string::npos && end != std::string::npos) {
                        std::string infected = line.substr(0, pos);
                        std::string virus = line.substr(pos + 2, end - (pos + 2));
 
                        infectedFilesBuffer.push_back(infected);
                        handleInfectedFileWithName(infected, virus);
                    }
                }
            });
        });
 
        // Continua lettura
        dataStream->read_line_async(
            sigc::mem_fun(*this, &ScanPage::readOutput),
                                    Glib::RefPtr<Gio::Cancellable>(),
                                    Glib::PRIORITY_DEFAULT
        );
    }
    catch (const Glib::Error& ex) {
        textBuffer->insert(textBuffer->end(),
                           _("❌ Errore lettura output: ") + Glib::ustring(ex.what()) + "\n"
        );
        scanInProgress = false;
    }
}
 
 
void ScanPage::scanFileAutomatically(const std::string& filepath)
{
    if (!autoScanEnabled) return;
    if (!fs::exists(filepath)) return;
 
    if (!fs::is_regular_file(filepath)) {
        enqueueLog(_("📁 Ignorato (non è un file regolare): ") + filepath);
        return;
    }
 
    try {
        std::uintmax_t size = fs::file_size(filepath);
        if (size < 64) {
            enqueueLog(_("⏳ File troppo piccolo, potrebbe essere ancora in scrittura: ") + filepath);
            return;
        }
    }
    catch (...) {
        enqueueLog(_("❌ Impossibile determinare dimensione file: ") + filepath);
        return;
    }
 
    try {
        auto size = fs::file_size(filepath);
        auto timep = fs::last_write_time(filepath).time_since_epoch().count();
 
        std::string key = filepath + "_" + std::to_string(size) + "_" + std::to_string(timep);
 
        if (recentlyScanned.count(key)) return;
        recentlyScanned.insert(key);
 
        Glib::signal_timeout().connect_once([key]() {
            recentlyScanned.erase(key);
        }, 5000);
 
        enqueueLog(_("🔍 Scansione automatica per: ") + filepath);
 
        std::vector<std::string> argv = {
            "clamdscan",
            "--fdpass",
            "--no-summary",
            "--infected",
            filepath
        };
 
        auto proc = Gio::Subprocess::create(
            argv,
            Gio::Subprocess::Flags::STDOUT_PIPE
        );
 
        auto out = proc->get_stdout_pipe();
        auto ds = Gio::DataInputStream::create(out);
 
        auto reader = std::make_shared<std::function<void()>>();
        *reader = [this, ds, filepath, reader]() {
            ds->read_line_async(
                [this, ds, filepath, reader](const Glib::RefPtr<Gio::AsyncResult>& res) {
                    try {
                        std::string line;
                        bool ok = ds->read_line_finish(res, line);
 
                        // EOF: ClamAV non ha trovato nulla
                        if (!ok) {
                            auto alive = alive_;
                            Glib::signal_idle().connect_once([this, alive, filepath]() {
                                BastionGuard::if_alive(alive, [this, &filepath]() {
                                    enqueueLog(_("⬜ ClamAV pulito, avvio controllo cloud..."));
                                    cloudCheckMalwareBazaar(filepath);
                                });
                            });
                            return;
                        }
 
                        // Trovato malware
                        if (line.find("FOUND") != std::string::npos) {
                            size_t pos = line.find(": ");
                            size_t end = line.find(" FOUND");
 
                            std::string virus = "Sconosciuto";
                            if (pos != std::string::npos && end != std::string::npos)
                                virus = line.substr(pos + 2, end - (pos + 2));
 
                            auto alive = alive_;
                            Glib::signal_idle().connect_once([this, alive, filepath, virus]() {
                                BastionGuard::if_alive(alive, [this, &filepath, &virus]() {
                                    handleInfectedFileWithName(filepath, virus);
                                });
                            });
                            return;
                        }
 
                        // Continua a leggere fino a EOF
                        (*reader)();
                    }
                    catch (const Glib::Error& ex) {
                        enqueueLog(std::string(_("❌ Errore scansione automatica: ")) + ex.what());
                    }
                    catch (const std::exception& ex) {
                        enqueueLog(std::string(_("❌ Eccezione scansione automatica: ")) + ex.what());
                    }
                    catch (...) {
                        enqueueLog(_("❌ Errore scansione automatica"));
                    }
                },
                Glib::RefPtr<Gio::Cancellable>(),
                                Glib::PRIORITY_DEFAULT
            );
        };
 
        (*reader)();
    }
    catch (const std::exception& ex) {
        enqueueLog(std::string(_("❌ Errore accesso file: ")) + ex.what());
    }
}
 
 
 
void ScanPage::addFileToList(const std::string& filepath)
{
    auto row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
 
    auto icon = Gtk::make_managed<Gtk::Image>();
    icon->set_from_icon_name("text-x-generic");
    icon->set_pixel_size(20);
    row->append(*icon);
 
    auto lbl = Gtk::make_managed<Gtk::Label>(filepath);
    lbl->set_hexpand(true);
    lbl->set_ellipsize(Pango::EllipsizeMode::END);
    row->append(*lbl);
 
    fileListBox.append(*row);
}
 
std::vector<std::string> ScanPage::detectBrowserDownloadDirs()
{
    std::vector<std::string> dirs;
    std::string home = Glib::get_home_dir();
 
 
    std::string def = home + "/Downloads";
    if (fs::exists(def)) dirs.push_back(def);
 
 
    try {
        std::string base = home + "/.mozilla/firefox";
        if (fs::exists(base)) {
            for (auto& entry : fs::directory_iterator(base)) {
                if (!entry.is_directory()) continue;
 
                fs::path prefs = entry.path() / "prefs.js";
                if (!fs::exists(prefs)) continue;
 
                std::ifstream f(prefs);
                std::string line;
 
                while (std::getline(f, line)) {
                    if (line.find("browser.download.dir") != std::string::npos) {
                        size_t s = line.find('"', line.find(',') + 1);
                        size_t e = line.find('"', s + 1);
                        if (s != std::string::npos && e != std::string::npos) {
                            std::string d = line.substr(s + 1, e - s - 1);
                            if (fs::exists(d)) dirs.push_back(d);
                        }
                    }
                }
            }
        }
    } catch (...) {}
 
 
    std::vector<std::string> cfgs = {
        home + "/.config/google-chrome/Default/Preferences",
        home + "/.config/chromium/Default/Preferences",
        home + "/.config/microsoft-edge/Default/Preferences"
    };
 
    for (auto& pref : cfgs) {
        try {
            if (!fs::exists(pref)) continue;
 
            std::ifstream f(pref);
            std::string content(
                (std::istreambuf_iterator<char>(f)),
                                std::istreambuf_iterator<char>()
            );
 
            std::string key = "\"default_directory\"";
            size_t pos = content.find(key);
            if (pos == std::string::npos) continue;
 
            size_t s = content.find('"', pos + key.size());
            size_t e = content.find('"', s + 1);
 
            if (s != std::string::npos && e != std::string::npos) {
                std::string d = content.substr(s + 1, e - s - 1);
                if (fs::exists(d)) dirs.push_back(d);
            }
        } catch (...) {}
    }
 
 
    std::sort(dirs.begin(), dirs.end());
    dirs.erase(std::unique(dirs.begin(), dirs.end()), dirs.end());
 
    return dirs;
}
 
 
bool ScanPage::isOutsideKnownDownloadDirs(const std::string& path)
{
    for (const auto& d : knownDownloadDirs) {
        if (path.rfind(d, 0) == 0) return false;
    }
    return true;
}
 
 
void ScanPage::enableAutoScanDownloads()
{
    knownDownloadDirs = detectBrowserDownloadDirs();
 
    for (const auto& d : knownDownloadDirs) {
        if (!fs::exists(d)) continue;
        addInotifyRecursive(normalizePath(d));
    }
 
    enqueueLog(_("📡 Monitoraggio Download attivo (inotify)"));
}
 
 
std::vector<std::string> ScanPage::getXdgUserDirs()
{
    std::vector<std::string> out;
 
    std::string p = Glib::get_home_dir() + "/.config/user-dirs.dirs";
    if (!fs::exists(p)) return out;
 
    std::ifstream f(p);
    std::string line;
 
    while (std::getline(f, line)) {
        if (line.find("XDG_") != 0 || line.find("_DIR=") == std::string::npos)
            continue;
 
        size_t q1 = line.find('"');
        size_t q2 = line.find('"', q1 + 1);
 
        if (q1 == std::string::npos || q2 == std::string::npos)
            continue;
 
        std::string value = line.substr(q1 + 1, q2 - q1 - 1);
        if (value.find("$HOME") == 0)
            value.replace(0, 5, Glib::get_home_dir());
 
        if (fs::exists(value))
            out.push_back(value);
    }
 
    return out;
}
 
void ScanPage::enableGlobalDownloadMonitor()
{
    // ANTI-BOOTLOOP: NON monitorare $HOME né /tmp ricorsivamente.
    // Un singolo `make -j` in qualsiasi cartella del home (incluso il
    // checkout di BastionGuard stesso) creerebbe migliaia di file
    // sotto build/CMakeFiles/, e l'inotify watcher genererebbe una
    // cascata di eventi → scansioni clamdscan in serie → main loop
    // bloccato → "bootloop" visivo della ScanPage.
    //
    // Limitiamo i watch alle XDG user dirs (Downloads, Desktop,
    // Documents, …) e a ~/.var/app, che è l'unico path Flatpak
    // dove i browser scrivono i download.
    std::vector<std::string> dirs;
 
    auto xdg = getXdgUserDirs();
    dirs.insert(dirs.end(), xdg.begin(), xdg.end());
 
    std::string varApp = Glib::get_home_dir() + "/.var/app";
    if (fs::exists(varApp)) dirs.push_back(varApp);
 
    std::sort(dirs.begin(), dirs.end());
    dirs.erase(std::unique(dirs.begin(), dirs.end()), dirs.end());
 
    for (auto& d : dirs) {
        if (!fs::exists(d)) continue;
        // addInotifyRecursive a sua volta filtra le build dirs
        // (per esempio se l'utente ha ~/Documents/progetti/foo/build/).
        addInotifyRecursive(normalizePath(d));
    }
 
    enqueueLog(_("🌍 Monitor globale inotify attivo (XDG dirs)"));
}
 
 
void ScanPage::logMessage(const std::string& msg)
{
    textBuffer->insert(textBuffer->end(), msg + "\n");
}
 
 
void ScanPage::onAurPkgbuildDetected(const std::string& path)
{
    // Caso speciale: INFECTED:PATH
    if (path.rfind("INFECTED:", 0) == 0) {
        std::string real = path.substr(11);
        enqueueLog(_("⚠️ PKGBUILD sospetto: ") + real);
        handleInfectedFileWithName(real, "AUR.StaticHeuristic");
        return;
    }
 
    enqueueLog(_("📦 PKGBUILD rilevato: ") + path);
 
 
    AurScan::scanPKGBUILD(path);
 
 
    scanAurAuto(path);
}
 
void ScanPage::scanAurAuto(const std::string& path)
{
    if (!fs::exists(path)) {
        enqueueLog(_("❌ PKGBUILD non trovato: ") + path);
        return;
    }
 
    enqueueLog(_("🦠 Scansione AUR: ") + path);
 
    std::vector<std::string> argv = {
        "clamdscan",
        "--fdpass",
        "--no-summary",
        "--infected",
        path
    };
 
    try {
        auto proc = Gio::Subprocess::create(
            argv,
            Gio::Subprocess::Flags::STDOUT_PIPE
        );
 
        auto out = proc->get_stdout_pipe();
        auto ds = Gio::DataInputStream::create(out);
 
        ds->read_line_async(
            [this, ds, path](const Glib::RefPtr<Gio::AsyncResult>& res) {
                try {
                    std::string line;
                    bool ok = ds->read_line_finish(res, line);
 
                    if (ok && line.find("FOUND") != std::string::npos) {
 
                        size_t pos = line.find(": ");
                        size_t end = line.find(" FOUND");
 
                        std::string virus = "Sconosciuto";
                        if (pos != std::string::npos && end != std::string::npos)
                            virus = line.substr(pos + 2, end - (pos + 2));
 
                        auto alive = alive_;
                        Glib::signal_idle().connect_once([this, alive, path, virus]() {
                            BastionGuard::if_alive(alive, [this, &path, &virus]() {
                                handleInfectedFileWithName(path, virus);
                            });
                        });
 
                        return;
                    }
 
                    auto alive = alive_;
                    Glib::signal_idle().connect_once([this, alive, path]() {
                        BastionGuard::if_alive(alive, [this, &path]() {
                            enqueueLog(_("✅ PKGBUILD pulito: ") + path);
                        });
                    });
                }
                catch (...) {
                    enqueueLog(_("❌ Errore lettura output AUR"));
                }
            },
            Glib::RefPtr<Gio::Cancellable>(),
                            Glib::PRIORITY_DEFAULT
        );
    }
    catch (...) {
        enqueueLog(_("❌ Errore avvio clamdscan per PKGBUILD"));
    }
}
 
 
void ScanPage::cloudCheckMalwareBazaarWorker(const std::string& filepath)
{
    if (!fs::exists(filepath))
        return;
 
    std::string sha = MalwareBazaar::sha256_file(filepath);
    if (sha.empty())
        return;
 
    MBResult r = MalwareBazaar::lookupHash(sha);
 
    if (!alive_->load()) return;
 
    // Rientro nel main loop GTK
    auto alive = alive_;
    Glib::signal_idle().connect_once(
        [this, alive, filepath, r]() {
            BastionGuard::if_alive(alive, [this, &filepath, &r]() {
                if (!r.found) {
                    enqueueLog(_("🔏 Nessun match cloud → File sicuro."));
                    return;
                }
 
                enqueueLog("🚨 Malware identificato:");
                enqueueLog("Nome: " + r.malwareName);
                enqueueLog("Tipo: " + r.fileType);
                enqueueLog("Tags: " + r.tags);
 
                try {
                    auto conn = Gio::DBus::Connection::get_sync(
                        Gio::DBus::BusType::SESSION
                    );
                    auto proxy = Gio::DBus::Proxy::create_sync(
                        conn,
                        "org.BastionGuard.Ransomware.Alert",
                        "/org/BastionGuard/ransomware/alert",
                        "org.BastionGuard.Ransomware.Alert"
                    );
 
                    auto params = Glib::VariantContainerBase::create_tuple({
                        Glib::Variant<Glib::ustring>::create(filepath),
                                                                           Glib::Variant<Glib::ustring>::create(
                                                                               "VirusTotal: " + r.malwareName)
                    });
 
                    proxy->call_sync("ShowAlert", params);
                }
                catch (...) {
                    Utils::show_message(
                        &parentWindow,
                        (Glib::ustring("Malware cloud:\n") + filepath +
                         "\nNome: " + r.malwareName).raw(),
                        Gtk::MessageType::WARNING
                    );
                }
            });
        }
    );
}
 
static std::atomic<int> activeCloudChecks{0};
 
void ScanPage::cloudCheckMalwareBazaar(const std::string& filepath)
{
    if (activeCloudChecks.load() >= 4) {
        enqueueLog(_("⏳ Troppi controlli cloud in corso, salto temporaneamente."));
        return;
    }
 
    enqueueLog(_("🌐 Avvio controllo cloud..."));
    activeCloudChecks++;
 
    auto alive = alive_;
    std::thread([this, alive, filepath]() {
        try {
            cloudCheckMalwareBazaarWorker(filepath);
        }
        catch (const std::exception& ex) {
            if (!alive->load()) { activeCloudChecks--; return; }
            Glib::signal_idle().connect_once([this, alive, msg = std::string(ex.what())]() {
                BastionGuard::if_alive(alive, [this, &msg]() {
                    enqueueLog(std::string(_("❌ Errore controllo cloud: ")) + msg);
                });
            });
        }
        catch (...) {
            if (!alive->load()) { activeCloudChecks--; return; }
            Glib::signal_idle().connect_once([this, alive]() {
                BastionGuard::if_alive(alive, [this]() {
                    enqueueLog(_("❌ Errore controllo cloud sconosciuto."));
                });
            });
        }
 
        activeCloudChecks--;
    }).detach();
}
 
 
void ScanPage::handleInfectedFile(const std::string& filepath)
{
    handleInfectedFileWithName(filepath, "ClamAV.Detected");
}
 
 
void ScanPage::handleInfectedFiles(const std::vector<std::string>& files)
{
    if (files.empty()) return;
 
    try {
        auto conn = Gio::DBus::Connection::get_sync(Gio::DBus::BusType::SESSION);
        auto proxy = Gio::DBus::Proxy::create_sync(
            conn,
            "org.BastionGuard.Ransomware.Alert",
            "/org/BastionGuard/ransomware/alert",
            "org.BastionGuard.Ransomware.Alert"
        );
 
        for (const auto& f : files) {
            auto params = Glib::VariantContainerBase::create_tuple({
                Glib::Variant<Glib::ustring>::create(f),
                                                                   Glib::Variant<Glib::ustring>::create("ClamAV.Detected")
            });
            proxy->call_sync("ShowAlert", params);
 
            enqueueLog(_("⚠️ Alert inviato per file infetto: ") + f);
        }
    }
    catch (...) {
        Utils::show_message(
            &parentWindow,
            _("File infetto rilevato:\n") + files.front(),
            Gtk::MessageType::WARNING
        );
    }
}
 
 
void ScanPage::handleInfectedFileWithName(
    const std::string& filepath,
    const std::string& virusName)
{
    try {
        auto conn = Gio::DBus::Connection::get_sync(Gio::DBus::BusType::SESSION);
        auto proxy = Gio::DBus::Proxy::create_sync(
            conn,
            "org.BastionGuard.Ransomware.Alert",
            "/org/BastionGuard/ransomware/alert",
            "org.BastionGuard.Ransomware.Alert"
        );
 
        auto params = Glib::VariantContainerBase::create_tuple({
            Glib::Variant<Glib::ustring>::create(filepath),
                                                               Glib::Variant<Glib::ustring>::create(virusName)
        });
 
        proxy->call_sync("ShowAlert", params);
 
        enqueueLog(_("⚠️ File infetto: ") + filepath + "  (" + virusName + ")");
    }
    catch (...) {
        Utils::show_message(
            &parentWindow,
            _("File infetto:\n") + filepath + "\nVirus: " + virusName,
            Gtk::MessageType::WARNING
        );
    }
}
 
 
void ScanPage::showAlertWindow(const std::string& file, const std::string& family)
{
    Utils::show_message(
        &parentWindow,
        _("Minaccia rilevata:\n") + file + _("\nTipo: ") + family,
        Gtk::MessageType::WARNING
    );
}
 
 
bool ScanPage::safeExists(const std::string& p) noexcept
{
    try { return fs::exists(p); }
    catch (...) { return false; }
}
 
std::uintmax_t safeSize(const std::string& p) noexcept
{
    try { return fs::file_size(p); }
    catch (...) { return 0; }
}
 
void ScanPage::showCloudPrivacyDisclaimer()
{
    auto *dialog = new Gtk::Window();
    dialog->set_title("");
    dialog->set_default_size(560, 300);
    dialog->set_resizable(false);
    dialog->set_modal(false);
    dialog->add_css_class("app-dialog");
    dialog->add_css_class("main-window");
    dialog->add_css_class("app-window");
 
    /* CSS globale */
    try {
        auto css = Gtk::CssProvider::create();
        css->load_from_path(resource("BastionGuard.css"));
        auto display = Gdk::Display::get_default();
        Gtk::StyleContext::add_provider_for_display(
            display, css,
            GTK_STYLE_PROVIDER_PRIORITY_APPLICATION);
    } catch (...) {}
 
    /* Header custom */
    auto *header = Gtk::make_managed<Gtk::HeaderBar>();
    header->set_show_title_buttons(false);
    header->set_decoration_layout("");
    header->add_css_class("custom-headerbar");
 
    auto *close_box = Gtk::make_managed<Gtk::Box>(
        Gtk::Orientation::HORIZONTAL);
    close_box->set_margin_end(6);
 
    try {
        auto icon = Gdk::Pixbuf::create_from_file(
            resource("icon-close.png"), 28, 28, true);
        auto *btn = Gtk::make_managed<Gtk::Button>();
        btn->set_child(
            *Gtk::make_managed<Gtk::Image>(icon));
        btn->add_css_class("header-button");
        btn->signal_clicked().connect(
            [dialog]() { dialog->close(); delete dialog; });
        close_box->append(*btn);
    } catch (...) {}
 
    header->pack_end(*close_box);
 
    auto *wrap =
    Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL);
    wrap->append(*header);
    dialog->set_titlebar(*wrap);
 
    /* Contenuto */
    auto *vbox = Gtk::make_managed<Gtk::Box>(
        Gtk::Orientation::VERTICAL, 14);
    vbox->set_margin(24);
 
    auto title = Gtk::make_managed<Gtk::Label>(
        _("🔐 Privacy – Controllo Cloud"));
    title->add_css_class("title");
    title->set_halign(Gtk::Align::CENTER);
 
    auto msg = Gtk::make_managed<Gtk::Label>(_(
        "BastionGuard NON carica alcun file online.\n\n"
        "• Nessun contenuto locale viene trasmesso\n"
        "• Viene calcolato solo l’hash SHA256 del file\n"
        "• L’hash è confrontato con database pubblici\n"
        "• Nessun percorso o dato personale viene inviato\n"
        "• La API Key resta salvata esclusivamente in locale\n\n"
        "Il controllo cloud è una verifica di reputazione, "
        "non un upload del file.")
    );
    msg->set_wrap(true);
    msg->set_justify(Gtk::Justification::CENTER);
    msg->set_halign(Gtk::Align::CENTER);
 
    auto closeBtn =
    Gtk::make_managed<Gtk::Button>("Ho capito");
    closeBtn->add_css_class("btn-success");
    closeBtn->set_halign(Gtk::Align::CENTER);
    closeBtn->signal_clicked().connect(
        [dialog]() { dialog->close(); delete dialog; });
 
    vbox->append(*title);
    vbox->append(*msg);
    vbox->append(*closeBtn);
 
    dialog->set_child(*vbox);
    dialog->present();
}
 
void ScanPage::onToggleApiKeyVisibility()
{
    apiKeyVisible = !apiKeyVisible;
 
    apiKeyEntry.set_visibility(apiKeyVisible);
 
    btnShowApiKey.set_icon_name(
        apiKeyVisible
        ? "view-conceal-symbolic"
        : "view-reveal-symbolic"
    );
}