import type { SecurityClass } from '@hover-dev/probe-engine';

/** Per-class impact + remediation, for the report's Impact / Recommendation
 *  sections. Concise, rewritten from web-security methodology (Claude-BugHunter,
 *  MIT). Falls back to a generic line for classes not listed. */
interface VulnInfo {
  impact: string;
  recommendation: string;
}

const VULN_INFO: Partial<Record<SecurityClass, VulnInfo>> = {
  idor: {
    impact: "An authenticated user reads or modifies another user's data by changing an object id.",
    recommendation: 'Enforce per-object ownership on every read/write — scope by the session, never trust a client-supplied id.',
  },
  bola: {
    impact: "An authenticated user reaches another user's object via a guessed/substituted id.",
    recommendation: 'Authorize every object access against the caller, not just authenticate the request.',
  },
  bfla: {
    impact: 'A low-privilege user invokes an admin-only function.',
    recommendation: "Check the caller's role on every privileged endpoint, not just that they're logged in.",
  },
  'mass-assignment': {
    impact: 'A user sets a privileged field (role / verified / balance) the UI never exposes.',
    recommendation: 'Allow-list bindable fields; never bind the request body straight onto the model.',
  },
  'auth-bypass': {
    impact: 'A protected endpoint serves data with no valid credential.',
    recommendation: 'Verify the session server-side on every protected route; reject missing/tampered tokens.',
  },
  ssrf: {
    impact: 'The server fetches attacker-chosen internal URLs (cloud metadata, internal services).',
    recommendation: 'Allow-list outbound hosts; block loopback / link-local / metadata ranges; pin resolved DNS.',
  },
  'open-redirect': {
    impact: 'Users get redirected to an attacker site (phishing; OAuth token theft when chained).',
    recommendation: 'Allow-list redirect targets; never reflect a raw client URL into the Location header.',
  },
  'path-traversal': {
    impact: 'The server reads files outside the intended directory (.env, /etc/passwd, source).',
    recommendation: 'Resolve and contain the path under a fixed root; reject ../ and absolute paths.',
  },
  cors: {
    impact: 'Any origin can read authenticated responses cross-site.',
    recommendation: 'Never reflect an arbitrary Origin with credentials:true; allow-list exact origins.',
  },
  jwt: {
    impact: 'A tampered or unsigned token is accepted as another identity / role.',
    recommendation: 'Verify signature + algorithm server-side; reject alg:none and key-confusion.',
  },
  sqli: {
    impact: 'Attacker reads or modifies the database (data exfiltration, auth bypass, sometimes RCE).',
    recommendation: 'Use parameterized queries / an ORM; never concatenate input into SQL.',
  },
  xss: {
    impact: "Attacker runs script in victims' browsers (session theft, account takeover).",
    recommendation: 'Context-encode all output; set a strict CSP; sanitize stored HTML.',
  },
  ssti: {
    impact: 'Attacker executes template/server code — often full RCE.',
    recommendation: 'Never render user input as a template; use a logic-less / sandboxed engine.',
  },
  xxe: {
    impact: 'Attacker reads files or reaches internal services via the XML parser.',
    recommendation: 'Disable external entities and DTD processing in the XML parser.',
  },
  deserialization: {
    impact: 'Attacker achieves RCE via a crafted serialized object.',
    recommendation: 'Never deserialize untrusted input; use a safe format (JSON) with a schema.',
  },
  rce: {
    impact: 'Attacker executes arbitrary OS commands on the server.',
    recommendation: 'Never pass input to a shell; use safe APIs with strict allow-lists.',
  },
  csrf: {
    impact: 'An attacker site forces a state-changing action as the victim.',
    recommendation: 'Require an unpredictable per-request CSRF token + SameSite cookies.',
  },
  graphql: {
    impact: 'Field- or object-level authorization bypass, or schema abuse.',
    recommendation: 'Enforce per-field / per-object authorization; disable introspection in production.',
  },
};

const GENERIC: VulnInfo = {
  impact: 'A security control did not behave as expected for this request.',
  recommendation: 'Review the server-side check for this endpoint.',
};

export function vulnInfo(cls: SecurityClass | undefined): VulnInfo {
  return (cls && VULN_INFO[cls]) ?? GENERIC;
}
