NexusGuard

class MessageFloodDetector:
    module = Module.MESSAGE_FLOOD
    handles = (MessageEvent,)

    def detect(self, event: MessageEvent, rule: MessageFloodRule, state: WindowStore) -> Detection | None:
        key = f"flood:{event.guild_id}:{event.author.id}"
        if state.cooling_down(key, event.at):
            return None
        hits = state.add(key, event.at, rule.window_seconds)
        count = len(hits)
        if count < rule.max_messages:
            return None
        state.clear(key)
        state.start_cooldown(key, event.at, rule.window_seconds)
        span = max((hits[-1][0] - hits[0][0]).total_seconds(), 0.1)
        severity = Severity.HIGH if span <= rule.window_seconds / 2 else Severity.MEDIUM
        return Detection(
            module=self.module,
            type=EventType.SPAM_DETECTED,
            severity=severity,
            summary=f"{count} messages in {span:.1f} s",
            user=event.author,
            channel_id=event.channel_id,
            message_id=event.message_id,
            metadata={"messages": count, "window_seconds": rule.window_seconds, "threshold": rule.max_messages,
                      "kind": "flood"},
        )