/**
 * NIST 800-53 Controls Reference Knowledge Module
 *
 * Control reference table for common security findings across
 * Access Control (AC), Identification and Authentication (IA),
 * System and Communications Protection (SC), and Audit (AU) families.
 *
 * @module agents/experts/knowledge/security/nist-controls
 * @see https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
 * (Source: Epic #643 / Issue #645 - Phase 1a)
 */

import type { KnowledgeModule } from '../types.js';

export const NIST_CONTROLS_MODULE: KnowledgeModule = {
  id: 'security-nist-controls',
  domain: 'security',
  title: 'NIST 800-53 Control Reference',
  nistControls: [
    'AC-2',
    'AC-3',
    'AC-4',
    'AC-6',
    'AC-7',
    'AC-8',
    'IA-2',
    'IA-5',
    'IA-8',
    'SC-8',
    'SC-12',
    'SC-13',
    'SC-28',
    'AU-2',
    'AU-3',
    'AU-6',
    'AU-12',
  ],
  tags: ['nist', '800-53', 'compliance', 'controls', 'reference'],
  sections: [
    {
      title: 'Access Control (AC) Family',
      content: [
        'AC-2 Account Management:',
        '  - Automate account provisioning and deprovisioning',
        '  - Disable inactive accounts after 90 days',
        '  - Review accounts quarterly; remove unauthorized',
        'AC-3 Access Enforcement:',
        '  - Enforce approved authorizations at system level',
        '  - Implement deny-by-default access control',
        '  - Validate permissions on every request, not just login',
        'AC-4 Information Flow Enforcement:',
        '  - Control data flow between security domains',
        '  - Enforce network segmentation policies',
        '  - Filter cross-boundary data transfers',
        'AC-6 Least Privilege:',
        '  - Grant minimum permissions required for function',
        '  - Separate duties for privileged operations',
        '  - Review privileged access monthly',
        'AC-7 Unsuccessful Login Attempts:',
        '  - Lock account after 5 consecutive failed attempts',
        '  - Implement exponential backoff on retries',
        '  - Alert security team on repeated failures',
      ].join('\n'),
      priority: 9,
    },
    {
      title: 'Identification and Authentication (IA) Family',
      content: [
        'IA-2 Identification and Authentication (Users):',
        '  - Uniquely identify and authenticate all users',
        '  - Require MFA for privileged accounts',
        '  - Require MFA for remote access',
        'IA-5 Authenticator Management:',
        '  - Enforce minimum password complexity (12+ chars)',
        '  - Use approved password hashing (argon2id, bcrypt)',
        '  - Protect authenticators from unauthorized disclosure',
        '  - Rotate authenticators on suspected compromise',
        'IA-8 Identification and Authentication (Non-Org Users):',
        '  - Authenticate external users and services',
        '  - Use federation (SAML, OIDC) for cross-org auth',
        '  - Apply same strength requirements as internal users',
      ].join('\n'),
      priority: 9,
    },
    {
      title: 'System and Communications Protection (SC) Family',
      content: [
        'SC-8 Transmission Confidentiality and Integrity:',
        '  - Encrypt all data in transit (TLS 1.2+ mandatory)',
        '  - Use certificate validation on all TLS connections',
        '  - Disable deprecated protocols (SSLv3, TLS 1.0, TLS 1.1)',
        'SC-12 Cryptographic Key Establishment and Management:',
        '  - Use approved key generation methods (CSPRNG)',
        '  - Protect keys at rest with hardware or software KMS',
        '  - Define key lifecycle (generation, distribution, rotation, destruction)',
        'SC-13 Cryptographic Protection:',
        '  - Use FIPS-approved algorithms (AES-256, SHA-256, RSA-2048+)',
        '  - No custom/proprietary cryptographic implementations',
        '  - Validate cryptographic module configuration',
        'SC-28 Protection of Information at Rest:',
        '  - Encrypt sensitive data at rest (AES-256-GCM)',
        '  - Use separate encryption keys per tenant/data class',
        '  - Secure key storage separate from encrypted data',
      ].join('\n'),
      priority: 9,
    },
    {
      title: 'Audit and Accountability (AU) Family',
      content: [
        'AU-2 Audit Events:',
        '  - Log: authentication attempts (success + failure)',
        '  - Log: authorization decisions (grants + denials)',
        '  - Log: data access (read/write of sensitive records)',
        '  - Log: configuration changes (settings, permissions)',
        '  - Log: system events (startup, shutdown, errors)',
        'AU-3 Content of Audit Records:',
        '  - Include: timestamp (ISO 8601, UTC), actor identity',
        '  - Include: action performed, resource affected, outcome',
        '  - Include: source IP, user agent, request ID',
        '  - Exclude: passwords, tokens, PII in log messages',
        'AU-6 Audit Review, Analysis, and Reporting:',
        '  - Review logs regularly for anomalies',
        '  - Correlate events across services (distributed tracing)',
        '  - Alert on suspicious patterns (brute force, privilege escalation)',
        'AU-12 Audit Generation:',
        '  - Generate audit records at OS, application, and database levels',
        '  - Use structured logging (JSON) for machine parsing',
        '  - Ship logs to centralized SIEM within 60 seconds',
        '  - Protect log integrity (append-only, tamper-evident)',
      ].join('\n'),
      priority: 8,
    },
    {
      title: 'Control-to-Finding Quick Reference',
      content: [
        'FINDING -> NIST CONTROL MAPPING:',
        '  Missing authentication       -> IA-2, IA-8',
        '  Weak passwords               -> IA-5',
        '  Missing MFA                   -> IA-2(1), IA-2(2)',
        '  Broken access control         -> AC-3, AC-6',
        '  Missing authorization checks  -> AC-3',
        '  Privilege escalation          -> AC-6',
        '  Data in transit unencrypted   -> SC-8',
        '  Data at rest unencrypted      -> SC-28',
        '  Weak cryptography             -> SC-13',
        '  Missing key rotation          -> SC-12',
        '  Insufficient logging          -> AU-2, AU-12',
        '  Logs missing detail           -> AU-3',
        '  No log monitoring             -> AU-6',
        '  Inactive accounts             -> AC-2',
        '  Secrets in source code        -> SC-12, SC-13',
        '  Missing input validation      -> SI-10',
      ].join('\n'),
      priority: 10,
    },
  ],
} as const;
