<?php
/**
 * Plugin Constants
 *
 * @package VMPFence
 * @since 1.0.0
 * @since 2.0.0
 * @since 2.1.1
 * @since 2.1.2
 * @since 2.2.0
 * @since 2.2.4 -- Added constants for SIEM sync tables, cron hooks, and installation options
 * @since 2.2.5 -- Added constants for Enhanced Audit Log
 */

// Prevent direct access
if (!defined('ABSPATH')) {
    exit;
}

/**
 * VMPFence Constants Class
 *
 * @since 1.0.0
 * @since 2.0.0 -- Decrepited `vmpfence_failed_logins` table replaced with `vmpfence_security_attempts`
 * @since 2.1.0 -- Added constants for 2FA, audit log events, API endpoints, and more
 * @since 2.1.2 -- Added constants for PLUGIN_VERSION
 * @since 2.2.0 -- Added constants for blocked countries
 * @since 2.2.2 -- Added constants for waf rules, country block logs, custom patterns
 */
class VMPFence_Constants {

    /**
     * Plugin version (references global constant)
     */
    const PLUGIN_VERSION = VMPFENCE_VERSION;

    /**
     * Scan types
     */
    const SCAN_TYPE_QUICK = 'quick';
    const SCAN_TYPE_STANDARD = 'standard';
    const SCAN_TYPE_LIMITED = 'limited';
    const SCAN_TYPE_HIGH_SENSITIVITY = 'high_sensitivity';
    const SCAN_TYPE_CUSTOM = 'custom';

    /**
     * WAF protection levels
     */
    const WAF_PROTECTION_BASIC = 'basic';
    const WAF_PROTECTION_EXTENDED = 'extended';
    const WAF_PROTECTION_LEARNING = 'learning';

    /**
     * Traffic logging modes
     */
    const TRAFFIC_LOG_SECURITY_ONLY = 'security_only';
    const TRAFFIC_LOG_ALL = 'all';
    const TRAFFIC_LOG_DISABLED = 'disabled';

    /**
     * License types
     */
    const LICENSE_FREE = 'free';
    const LICENSE_PREMIUM = 'premium';

    /**
     * Block types
     */
    const BLOCK_TYPE_IP = 'ip';
    const BLOCK_TYPE_RANGE = 'range';
    const BLOCK_TYPE_COUNTRY = 'country';
    const BLOCK_TYPE_PATTERN = 'pattern';

    /**
     * User roles
     */
    const CAPABILITY_ADMIN = 'vmpfence_admin';
    const CAPABILITY_VIEW = 'vmpfence_view';
    const CAPABILITY_SCAN = 'vmpfence_scan';
    const CAPABILITY_BLOCK = 'vmpfence_block';

    /**
     * Event types for audit log
     */
    // --- Original constants (kept for backward compatibility) ---
    const EVENT_LOGIN_SUCCESS = 'login_success';
    const EVENT_LOGIN_FAILURE = 'login_failure';
    const EVENT_LOGIN_BLOCKED = 'login_blocked';
    const EVENT_SCAN_STARTED = 'scan_started';
    const EVENT_SCAN_COMPLETED = 'scan_completed';
    const EVENT_THREAT_DETECTED = 'threat_detected';
    const EVENT_IP_BLOCKED = 'ip_blocked';
    const EVENT_WAF_BLOCKED = 'waf_blocked';
    const EVENT_CONFIG_CHANGED = 'config_changed';
    const EVENT_PLUGIN_ACTIVATED = 'plugin_activated';
    const EVENT_PLUGIN_DEACTIVATED = 'plugin_deactivated';

    // ===================================================================
    // USER EVENTS (Observer_User — 17 events)
    // ===================================================================
    const EVENT_USER_REGISTERED        = 'user_registered';
    const EVENT_USER_ROLE_CHANGED      = 'user_role_changed';
    const EVENT_USER_DELETED           = 'user_deleted';
    const EVENT_USER_LOGOUT            = 'user_logout';
    const EVENT_USER_PROFILE_UPDATED   = 'user_profile_updated';
    const EVENT_PASSWORD_RESET         = 'password_reset';
    const EVENT_PASSWORD_RESET_REQ     = 'password_reset_requested';
    const EVENT_AUTH_COOKIE_SET        = 'auth_cookie_set';
    const EVENT_APP_PASSWORD_CREATED   = 'app_password_created';
    const EVENT_APP_PASSWORD_DELETED   = 'app_password_deleted';
    const EVENT_APP_PASSWORD_USED      = 'app_password_used';
    const EVENT_USER_CAPS_CHANGED      = 'user_capabilities_changed';
    const EVENT_USER_LEVEL_CHANGED     = 'user_level_changed';
    const EVENT_USER_MARKED_SPAM       = 'user_marked_spam';
    const EVENT_USER_UNMARKED_SPAM     = 'user_unmarked_spam';

    // ===================================================================
    // CONTENT EVENTS (Observer_Content — 15 events)
    // ===================================================================
    const EVENT_POST_PUBLISHED         = 'post_published';
    const EVENT_POST_DRAFT_CREATED     = 'post_draft_created';
    const EVENT_POST_UPDATED           = 'post_updated';
    const EVENT_POST_DELETED           = 'post_deleted';
    const EVENT_POST_TRASHED           = 'post_trashed';
    const EVENT_POST_RESTORED          = 'post_restored';
    const EVENT_COMMENT_POSTED         = 'comment_posted';
    const EVENT_COMMENT_APPROVED       = 'comment_approved';
    const EVENT_COMMENT_SPAM           = 'comment_spam';
    const EVENT_COMMENT_TRASHED        = 'comment_trashed';
    const EVENT_COMMENT_DELETED        = 'comment_deleted';
    const EVENT_MEDIA_UPLOADED         = 'media_uploaded';
    const EVENT_MEDIA_EDITED           = 'media_edited';
    const EVENT_MEDIA_DELETED          = 'media_deleted';
    const EVENT_TERM_CREATED           = 'term_created';
    const EVENT_TERM_EDITED            = 'term_edited';
    const EVENT_TERM_DELETED           = 'term_deleted';

    // ===================================================================
    // SITE EVENTS (Observer_Site — 37 events)
    // ===================================================================
    // WP Option changes (15)
    const EVENT_OPTION_SITEURL         = 'option_siteurl_changed';
    const EVENT_OPTION_HOME            = 'option_home_changed';
    const EVENT_OPTION_ADMIN_EMAIL     = 'option_admin_email_changed';
    const EVENT_OPTION_DEFAULT_ROLE    = 'option_default_role_changed';
    const EVENT_OPTION_REGISTRATION    = 'option_registration_changed';
    const EVENT_OPTION_ACTIVE_PLUGINS  = 'option_active_plugins_changed';
    const EVENT_OPTION_TEMPLATE        = 'option_template_changed';
    const EVENT_OPTION_STYLESHEET      = 'option_stylesheet_changed';
    const EVENT_OPTION_BLOGNAME        = 'option_blogname_changed';
    const EVENT_OPTION_DESCRIPTION     = 'option_description_changed';
    const EVENT_OPTION_PERMALINK       = 'option_permalink_changed';
    const EVENT_OPTION_SEARCH_VIS      = 'option_search_visibility_changed';
    const EVENT_OPTION_COMMENT_REG     = 'option_comment_reg_changed';
    const EVENT_OPTION_DEFAULT_COMMENTS = 'option_default_comments_changed';
    const EVENT_OPTION_COMMENT_MOD     = 'option_comment_moderation_changed';
    // Plugin/Theme/Core lifecycle (22)
    const EVENT_PLUGIN_INSTALLED       = 'plugin_installed';
    const EVENT_PLUGIN_UPDATED         = 'plugin_updated';
    const EVENT_PLUGIN_DELETED         = 'plugin_deleted';
    const EVENT_THEME_CHANGED          = 'theme_changed';
    const EVENT_THEME_INSTALLED        = 'theme_installed';
    const EVENT_THEME_UPDATED          = 'theme_updated';
    const EVENT_THEME_DELETED          = 'theme_deleted';
    const EVENT_CORE_UPDATED           = 'core_updated';
    const EVENT_AUTO_UPDATES           = 'auto_updates_completed';
    const EVENT_MENU_CREATED           = 'menu_created';
    const EVENT_MENU_UPDATED           = 'menu_updated';
    const EVENT_MENU_DELETED           = 'menu_deleted';
    const EVENT_CUSTOMIZER_SAVED       = 'customizer_saved';
    const EVENT_FILE_EDITOR_USED       = 'file_editor_used';
    const EVENT_ROLE_CAPS_CHANGED      = 'role_capabilities_changed';
    const EVENT_ADMIN_PAGE_DENIED      = 'admin_page_denied';
    const EVENT_SITE_DATA_EXPORTED     = 'site_data_exported';
    const EVENT_RECOVERY_KEY           = 'recovery_key_generated';
    const EVENT_MAIL_SENT              = 'mail_sent';
    const EVENT_MAIL_FAILED            = 'mail_failed';

    // ===================================================================
    // VMPFENCE CONFIG EVENTS (Observer_VMPFence — direct + dynamic)
    // ===================================================================
    // Generic fallback
    const EVENT_VMPFENCE_CONFIG_CHANGED          = 'vmpfence_config_changed';
    // WAF events
    const EVENT_WAF_MODE_CHANGED                 = 'vmpfence_waf_mode_changed';
    const EVENT_WAF_BLOCKLIST_TOGGLED            = 'vmpfence_waf_blocklist_toggled';
    const EVENT_WAF_AUTO_UPDATE_TOGGLED          = 'vmpfence_waf_auto_update_toggled';
    const EVENT_WAF_RULE_CREATED                 = 'vmpfence_waf_rule_created';
    const EVENT_WAF_RULE_DELETED                 = 'vmpfence_waf_rule_deleted';
    const EVENT_WAF_RULE_TOGGLED                 = 'vmpfence_waf_rule_toggled';
    const EVENT_WAF_CATEGORY_TOGGLED             = 'vmpfence_waf_category_toggled';
    const EVENT_WAF_ALLOW_ENTRY_CREATED          = 'vmpfence_waf_allow_entry_created';
    const EVENT_WAF_ALLOW_ENTRY_DELETED          = 'vmpfence_waf_allow_entry_deleted';
    const EVENT_WAF_ALLOW_ENTRY_TOGGLED          = 'vmpfence_waf_allow_entry_toggled';
    // Brute force / login security
    const EVENT_BRUTE_FORCE_TOGGLED              = 'vmpfence_brute_force_toggled';
    const EVENT_BRUTE_FORCE_LOCKOUT              = 'brute_force_lockout';
    const EVENT_LOGIN_THRESHOLD_CHANGED          = 'vmpfence_login_threshold_changed';
    const EVENT_FORGOT_PASSWORD_THRESHOLD        = 'vmpfence_forgot_password_threshold_changed';
    const EVENT_LOGIN_SECURITY_PERIOD            = 'vmpfence_login_security_period_changed';
    const EVENT_LOCKOUT_DURATION_CHANGED         = 'vmpfence_lockout_duration_changed';
    const EVENT_BLOCK_DURATION_CHANGED           = 'vmpfence_block_duration_changed';
    const EVENT_CUSTOM_BLOCK_TEXT_CHANGED         = 'vmpfence_custom_block_text_changed';
    const EVENT_LOCK_INVALID_USERNAMES           = 'vmpfence_lock_invalid_usernames_toggled';
    const EVENT_BANNED_USERNAMES_UPDATED         = 'vmpfence_banned_usernames_updated';
    const EVENT_BREACHED_PASSWORDS_TOGGLED       = 'vmpfence_breached_passwords_toggled';
    const EVENT_STRONG_PASSWORDS_TOGGLED         = 'vmpfence_strong_passwords_toggled';
    const EVENT_MASK_LOGIN_ERRORS_TOGGLED        = 'vmpfence_mask_login_errors_toggled';
    const EVENT_PREVENT_ADMIN_USERNAME           = 'vmpfence_prevent_admin_username_toggled';
    const EVENT_BLOCK_AUTHOR_SCAN                = 'vmpfence_block_author_scan_toggled';
    const EVENT_APP_PASSWORDS_TOGGLED            = 'vmpfence_app_passwords_toggled';
    const EVENT_BLOCK_BAD_POST_TOGGLED           = 'vmpfence_block_bad_post_toggled';
    const EVENT_CHECK_PASSWORD_STRENGTH          = 'vmpfence_check_password_strength_toggled';
    const EVENT_SECURITY_NETWORK_TOGGLED         = 'vmpfence_security_network_toggled';
    // Rate limiting / blocking
    const EVENT_RATE_LIMITING_TOGGLED            = 'vmpfence_rate_limiting_toggled';
    const EVENT_IP_SOURCE_CHANGED                = 'vmpfence_ip_source_changed';
    const EVENT_TRUSTED_PROXIES_CHANGED          = 'vmpfence_trusted_proxies_changed';
    const EVENT_TRUSTED_PROXY_PRESET_CHANGED     = 'vmpfence_trusted_proxy_preset_changed';
    const EVENT_ALLOWED_IPS_UPDATED              = 'vmpfence_allowed_ips_updated';
    const EVENT_BANNED_URLS_UPDATED              = 'vmpfence_banned_urls_updated';
    const EVENT_IP_UNBLOCKED                     = 'vmpfence_ip_unblocked';
    // Country blocking
    const EVENT_COUNTRY_BLOCKED                  = 'vmpfence_country_blocked';
    const EVENT_COUNTRY_UNBLOCKED                = 'vmpfence_country_unblocked';
    const EVENT_COUNTRY_BLOCK_ACTION_CHANGED     = 'vmpfence_country_block_action_changed';
    const EVENT_COUNTRY_BLOCK_LOGGED_IN_CHANGED  = 'vmpfence_country_block_logged_in_changed';
    // Custom patterns
    const EVENT_CUSTOM_PATTERN_ADDED             = 'vmpfence_custom_pattern_added';
    const EVENT_CUSTOM_PATTERN_DELETED           = 'vmpfence_custom_pattern_deleted';
    const EVENT_CUSTOM_PATTERN_TOGGLED           = 'vmpfence_custom_pattern_toggled';
    // Scan settings
    const EVENT_SCAN_TYPE_CHANGED                = 'vmpfence_scan_type_changed';
    const EVENT_SCAN_SCHEDULE_TOGGLED            = 'vmpfence_scan_schedule_toggled';
    const EVENT_SCAN_SCHEDULE_CHANGED            = 'vmpfence_scan_schedule_changed';
    const EVENT_SCAN_LOW_RESOURCE_TOGGLED        = 'vmpfence_scan_low_resource_toggled';
    // 2FA settings
    const EVENT_2FA_REQUIRED_ROLES_CHANGED       = 'vmpfence_2fa_required_roles_changed';
    const EVENT_2FA_GRACE_PERIOD_CHANGED         = 'vmpfence_2fa_grace_period_changed';
    const EVENT_2FA_REMEMBER_DEVICE_TOGGLED      = 'vmpfence_2fa_remember_device_toggled';
    const EVENT_XMLRPC_2FA_TOGGLED               = 'vmpfence_xmlrpc_2fa_toggled';
    const EVENT_XMLRPC_TOGGLED                   = 'vmpfence_xmlrpc_toggled';
    const EVENT_WOOCOMMERCE_2FA_TOGGLED          = 'vmpfence_woocommerce_2fa_toggled';
    const EVENT_2FA_SHORTCODE_TOGGLED            = 'vmpfence_2fa_shortcode_toggled';
    const EVENT_2FA_BYPASS_IPS_CHANGED           = 'vmpfence_2fa_bypass_ips_changed';
    // CAPTCHA
    const EVENT_CAPTCHA_TOGGLED                  = 'vmpfence_captcha_toggled';
    const EVENT_CAPTCHA_THRESHOLD_CHANGED        = 'vmpfence_captcha_threshold_changed';
    // License / API
    const EVENT_LICENSE_CHANGED                  = 'vmpfence_license_changed';
    const EVENT_API_KEY_CHANGED                  = 'vmpfence_api_key_changed';
    // Import / Export / Backup
    const EVENT_CONFIG_IMPORTED                  = 'config_imported';
    const EVENT_CONFIG_EXPORTED                  = 'config_exported';
    const EVENT_CONFIG_RESET                     = 'config_reset';
    const EVENT_CONFIG_DELETED                   = 'config_deleted';
    const EVENT_BACKUP_CREATED                   = 'backup_created';
    const EVENT_BACKUP_RESTORED                  = 'backup_restored';
    const EVENT_BACKUP_DELETED                   = 'backup_deleted';
    // Database
    const EVENT_DATABASE_UPDATED                 = 'database_updated';
    const EVENT_DATABASE_CLEANUP                 = 'database_cleanup';
    // Audit log mode
    const EVENT_AUDIT_LOG_MODE_CHANGED           = 'vmpfence_audit_log_mode_changed';
    // Support / Feedback
    const EVENT_SUPPORT_TICKET_SUBMITTED         = 'support_ticket_submitted';
    const EVENT_FEEDBACK_SUBMITTED               = 'feedback_submitted';
    // WP option changes tracked by VMPFence observer
    const EVENT_TRAFFIC_LOGGING_MODE             = 'vmpfence_traffic_logging_mode_changed';
    const EVENT_TRAFFIC_IGNORE_SETTING           = 'vmpfence_traffic_ignore_setting_changed';
    const EVENT_TRAFFIC_LIMIT_CHANGED            = 'vmpfence_traffic_limit_changed';
    const EVENT_COUNTRY_REDIRECT_CHANGED         = 'vmpfence_country_block_redirect_changed';
    const EVENT_COUNTRY_BYPASS_CHANGED           = 'vmpfence_country_bypass_changed';
    const EVENT_DEACTIVATION_CHOICE              = 'vmpfence_deactivation_choice_changed';
    const EVENT_DATA_PRESERVATION                = 'vmpfence_data_preservation_changed';
    const EVENT_API_KEY_OPTION_CHANGED           = 'vmpfence_api_key_option_changed';
    const EVENT_LICENSE_EMAIL_CHANGED            = 'vmpfence_license_email_changed';
    const EVENT_LICENSE_KEY_OPTION_CHANGED        = 'vmpfence_license_key_option_changed';
    const EVENT_LICENSE_TYPE_CHANGED             = 'vmpfence_license_type_changed';
    const EVENT_CENTRAL_API_KEY_CHANGED          = 'vmpfence_central_api_key_changed';
    const EVENT_EMAIL_ALERTS_TOGGLED             = 'vmpfence_email_alerts_toggled';
    const EVENT_SCAN_PERF_OPTIONS_CHANGED        = 'vmpfence_scan_perf_options_changed';
    const EVENT_YARA_WHITELIST_CHANGED           = 'vmpfence_yara_whitelist_changed';
    const EVENT_YARA_THREATS_CHANGED             = 'vmpfence_yara_threats_changed';
    const EVENT_SCAN_ISSUES_IGNORED              = 'vmpfence_scan_issues_ignored';
    const EVENT_SCAN_ISSUES_FIXED                = 'vmpfence_scan_issues_fixed';
    // Hooks kept in class-hooks.php (unique security events)
    const EVENT_XMLRPC_CALL                      = 'xmlrpc_call';
    const EVENT_REST_API_ACCESS                  = 'rest_api_access';
    const EVENT_WP_DIE_CALLED                    = 'wp_die_called';
    // Hooks kept in class-security-core.php
    const EVENT_SCHEDULED_SCAN_STARTED           = 'scheduled_scan_started';

    // ===================================================================
    // MULTISITE EVENTS (Observer_Multisite — 22 events)
    // ===================================================================
    const EVENT_MS_SITE_CREATED                  = 'multisite_site_created';
    const EVENT_MS_SITE_DELETED                  = 'multisite_site_deleted';
    const EVENT_MS_SITE_UPDATED                  = 'multisite_site_updated';
    const EVENT_MS_SITE_ACTIVATED                = 'multisite_site_activated';
    const EVENT_MS_SITE_DEACTIVATED              = 'multisite_site_deactivated';
    const EVENT_MS_SITE_ARCHIVED                 = 'multisite_site_archived';
    const EVENT_MS_SITE_UNARCHIVED               = 'multisite_site_unarchived';
    const EVENT_MS_SITE_TRASHED                  = 'multisite_site_trashed';
    const EVENT_MS_SITE_RESTORED                 = 'multisite_site_restored';
    const EVENT_MS_SITE_VISIBILITY_CHANGED       = 'multisite_site_visibility_changed';
    const EVENT_MS_SITE_SPAM                     = 'multisite_site_spam';
    const EVENT_MS_SITE_UNSPAM                   = 'multisite_site_unspam';
    const EVENT_MS_BLOG_SIGNUP                   = 'multisite_blog_signup';
    const EVENT_MS_USER_ADDED                    = 'multisite_user_added';
    const EVENT_MS_USER_REMOVED                  = 'multisite_user_removed';
    const EVENT_MS_USER_CREATED                  = 'multisite_user_created';
    const EVENT_MS_USER_DELETED                  = 'multisite_user_deleted';
    const EVENT_MS_USER_ACTIVATED                = 'multisite_user_activated';
    const EVENT_MS_USER_INVITED                  = 'multisite_user_invited';
    const EVENT_MS_USER_SIGNED_UP                = 'multisite_user_signed_up';
    const EVENT_MS_SUPER_ADMIN_GRANTED           = 'multisite_super_admin_granted';
    const EVENT_MS_SUPER_ADMIN_REVOKED           = 'multisite_super_admin_revoked';

    /**
     * Preview Mode Sampling Flag (code-level only, no DB config)
     *
     * false (default): Preview mode records ALL events to the audit log.
     * true: Preview mode only records ~30 critical events.
     *
     * To change: edit this constant directly in this file.
     */
    const PREVIEW_MODE_SAMPLING = true;

    /**
     * Threat severity levels
     */
    const SEVERITY_LOW = 1;
    const SEVERITY_MEDIUM = 2;
    const SEVERITY_HIGH = 3;
    const SEVERITY_CRITICAL = 4;

    /**
     * File status types
     */
    const FILE_STATUS_UNKNOWN = 0;
    const FILE_STATUS_CLEAN = 1;
    const FILE_STATUS_INFECTED = 2;
    const FILE_STATUS_SUSPICIOUS = 3;
    const FILE_STATUS_QUARANTINED = 4;

    /**
     * API endpoints
     */
    const API_BASE_URL = 'https://api.vmpfence.com/v1/';
    const API_THREAT_INTEL = 'threat-intel/';
    const API_UPDATES = 'updates/';

    /**
     * Database table suffixes
     */
    const TABLE_CONFIG = 'vmpfence_config';
    const TABLE_LS_SETTINGS = 'vmpfence_ls_settings';
    const TABLE_HITS = 'vmpfence_hits';
    const TABLE_LOGINS = 'vmpfence_logins';
    const TABLE_LOCKED_OUT = 'vmpfence_locked_out';
    const TABLE_BLOCKS = 'vmpfence_blocks';
    const TABLE_BLOCKED_IPS = 'vmpfence_blocked_ips';
    const TABLE_BLOCKED_COUNTRIES = 'vmpfence_blocked_countries';
    const TABLE_SECURITY_ATTEMPTS = 'vmpfence_security_attempts';
    const TABLE_WAF_LOG = 'vmpfence_waf_log';
    const TABLE_EVENTS = 'vmpfence_events';
    const TABLE_API_LOGS = 'vmpfence_api_logs';
    const TABLE_AUDIT_LOG = 'vmpfence_audit_log';
    const TABLE_SCAN_RESULTS = 'vmpfence_scan_results';
    const TABLE_SCAN_ISSUES = 'vmpfence_scan_issues';
    const TABLE_ISSUES = 'vmpfence_scan_issues'; // Alias for backward compatibility
    const TABLE_FILE_MODS = 'vmpfence_file_mods';
    const TABLE_KNOWN_FILES = 'vmpfence_known_files';
    const TABLE_FILE_CHANGES = 'vmpfence_file_changes';
    const TABLE_LIVE_TRAFFIC_HUMAN = 'vmpfence_live_traffic_human';
    const TABLE_CRAWLERS = 'vmpfence_crawlers';
    const TABLE_REVERSE_CACHE = 'vmpfence_reverse_cache';
    const TABLE_STATUS = 'vmpfence_status';
    const TABLE_TRAFFIC_RATES = 'vmpfence_traffic_rates';
    const TABLE_2FA = 'vmpfence_2fa';
    const TABLE_LS_2FA_SECRETS = 'vmpfence_ls_2fa_secrets';
    const TABLE_LS_ROLE_COUNTS = 'vmpfence_ls_role_counts';
    const TABLE_NOTIFICATIONS = 'vmpfence_notifications';
    const TABLE_PENDING_ISSUES = 'vmpfence_pending_issues';
    const TABLE_SNIP_CACHE = 'vmpfence_snip_cache';
    const TABLE_WHOIS = 'vmpfence_whois';
    const TABLE_WAF_FAILURES = 'vmpfence_waf_failures';
    const TABLE_DOWNLOAD_TOKENS = 'vmpfence_download_tokens';
    const TABLE_WAF_RULES = 'vmpfence_waf_rules';
    const TABLE_COUNTRY_BLOCK_LOGS = 'vmpfence_country_block_logs';
    const TABLE_CUSTOM_PATTERNS = 'vmpfence_custom_patterns';

    // SIEM Sync Tables (DB v2.3.0)
    const TABLE_LOCKOUT_STATE = 'vmpfence_lockout_state';
    const TABLE_TEMPORARY_BLOCKS = 'vmpfence_temporary_blocks';
    const TABLE_WHOIS_ENHANCED = 'vmpfence_whois_enhanced';
    const TABLE_FILE_MODIFICATIONS = 'vmpfence_file_modifications';

    // SIEM Cron Hooks (DB v2.3.0)
    const CRON_SIEM_SYNC = 'vmpfence_siem_sync';
    const CRON_SIEM_SYNC_INTERVAL = 'vmpfence_5min';

    // SIEM Installation Options (DB v2.3.0)
    const OPTION_SITE_UUID = 'vmpfence_installation_uuid';
    const OPTION_SITE_HASH = 'vmpfence_installation_hash';
    const OPTION_SITE_UUID_TEMP = 'vmpfence_installation_uuid_temp';

    /**
     * Option names
     */
    const OPTION_CONFIG = 'vmpfence_config';
    const OPTION_VERSION = 'vmpfence_version';
    const OPTION_DB_VERSION = 'vmpfence_db_version';
    const OPTION_ACTIVATION_TIME = 'vmpfence_activation_time';

    /**
     * Transient names
     */
    const TRANSIENT_SCAN_LOCK = 'vmpfence_scan_lock';
    const TRANSIENT_THREAT_INTEL = 'vmpfence_threat_intel';

    /**
     * Cron hook names
     */
    const CRON_DAILY_SCAN = 'vmpfence_daily_scan';
    const CRON_CLEANUP = 'vmpfence_cleanup';

    /**
     * Upload directory structure
     */
    const UPLOAD_DIR = 'vmpfence';
    const QUARANTINE_DIR = 'quarantine';
    const LOGS_DIR = 'logs';
    const CACHE_DIR = 'cache';

    /**
     * File types for scanning
     */
    const SCANNABLE_EXTENSIONS = array(
        'php', 'php3', 'php4', 'php5', 'phtml', 'phps',
        'js', 'html', 'htm', 'css', 'txt', 'htaccess',
        'sql', 'xml', 'json', 'ini', 'log'
    );

    /**
     * Image extensions that can contain malware
     */
    const IMAGE_EXTENSIONS = array(
        'jpg', 'jpeg', 'png', 'gif', 'bmp', 'tiff',
        'webp', 'svg', 'ico'
    );

    /**
     * Maximum values
     */
    const MAX_SCAN_TIME = 7200; // 2 hours
    const MAX_FILE_SIZE = 52428800; // 50MB

    /**
     * Rate limiting defaults
     */
    const RATE_LIMIT_WINDOW = 300; // 5 minutes
    const RATE_LIMIT_REQUESTS = 30;
    const RATE_LIMIT_404_REQUESTS = 20;

    /**
     * Get table name with WordPress prefix
     *
     * @since 1.0.0
     * @param string $table Table suffix
     * @return string Full table name
     */
    public static function get_table_name($table) {
        global $wpdb;
        return $wpdb->prefix . $table;
    }

    /**
     * Get upload directory path
     *
     * @since 1.0.0
     * @param string $subdir Subdirectory
     * @return string Full path
     */
    public static function get_upload_dir($subdir = '') {
        $upload_dir = wp_upload_dir();
        $path = $upload_dir['basedir'] . '/' . self::UPLOAD_DIR;
        
        if (!empty($subdir)) {
            $path .= '/' . $subdir;
        }

        return $path;
    }

    /**
     * Get upload directory URL
     *
     * @since 1.0.0
     * @param string $subdir Subdirectory
     * @return string Full URL
     */
    public static function get_upload_url($subdir = '') {
        $upload_dir = wp_upload_dir();
        $url = $upload_dir['baseurl'] . '/' . self::UPLOAD_DIR;
        
        if (!empty($subdir)) {
            $url .= '/' . $subdir;
        }

        return $url;
    }

    /**
     * Check if file extension is scannable
     *
     * @since 1.0.0
     * @param string $file File path
     * @return bool
     */
    public static function is_scannable_file($file) {
        $extension = strtolower(pathinfo($file, PATHINFO_EXTENSION));
        return in_array($extension, self::SCANNABLE_EXTENSIONS);
    }

    /**
     * Check if file is an image
     *
     * @since 1.0.0
     * @param string $file File path
     * @return bool
     */
    public static function is_image_file($file) {
        $extension = strtolower(pathinfo($file, PATHINFO_EXTENSION));
        return in_array($extension, self::IMAGE_EXTENSIONS);
    }
      
    /**
     * Cron hooks for scheduled scanning
     */
    const CRON_SCHEDULED_SCAN = 'vmpfence_scheduled_scan';
    const CRON_SCHEDULE_GENERATOR = 'vmpfence_schedule_generator';
    
    /**
     * Scheduling modes
     */
    const SCAN_SCHEDULING_MODE_AUTOMATIC = 'auto';
    const SCAN_SCHEDULING_MODE_MANUAL = 'manual';
    
    /**
     * Manual scheduling patterns (7 types)
     */
    const MANUAL_SCHEDULING_ONCE_DAILY = 'onceDaily';
    const MANUAL_SCHEDULING_TWICE_DAILY = 'twiceDaily';
    const MANUAL_SCHEDULING_EVERY_OTHER_DAY = 'everyOtherDay';
    const MANUAL_SCHEDULING_WEEKDAYS = 'weekdays';
    const MANUAL_SCHEDULING_WEEKENDS = 'weekends';
    const MANUAL_SCHEDULING_ODD_DAYS_WEEKENDS = 'oddDaysWE';
    const MANUAL_SCHEDULING_CUSTOM = 'custom';
}
