package com.optix.android.tools.parser

import com.optix.android.domain.model.Severity
import com.optix.android.domain.model.VulnerabilityFinding

/**
 * Pure parser for HTTP response headers. Audits the presence/strength of
 * security-relevant headers and produces [VulnerabilityFinding]s the UI can
 * filter by severity.
 *
 * Header names are matched case-insensitively. The parser takes a plain map so
 * it stays free of OkHttp / Android types and remains unit-testable.
 */
object HttpHeaderParser {

    /** Missing header -> (severity, human explanation). */
    private val SECURITY_HEADERS = listOf(
        SecHeader("Strict-Transport-Security", Severity.HIGH,
            "HSTS missing — connections can be downgraded to HTTP (SSL stripping)."),
        SecHeader("Content-Security-Policy", Severity.MEDIUM,
            "CSP missing — increases risk of XSS and data injection."),
        SecHeader("X-Frame-Options", Severity.MEDIUM,
            "X-Frame-Options missing — page may be clickjacked via framing."),
        SecHeader("X-Content-Type-Options", Severity.LOW,
            "X-Content-Type-Options missing — MIME sniffing possible."),
        SecHeader("Referrer-Policy", Severity.LOW,
            "Referrer-Policy missing — referrer may leak to third parties."),
        SecHeader("Permissions-Policy", Severity.INFO,
            "Permissions-Policy missing — browser features are not restricted."),
    )

    private data class SecHeader(val name: String, val severity: Severity, val detail: String)

    /**
     * @param headers response headers as a list of (name, value) pairs (OkHttp order preserved).
     * @param target  the URL that was inspected.
     */
    fun auditSecurityHeaders(
        headers: List<Pair<String, String>>,
        target: String,
    ): List<VulnerabilityFinding> {
        val present = headers.mapTo(HashSet()) { it.first.lowercase() }
        val findings = mutableListOf<VulnerabilityFinding>()

        SECURITY_HEADERS.forEach { sec ->
            if (sec.name.lowercase() !in present) {
                findings += VulnerabilityFinding(
                    tool = "http_inspector",
                    target = target,
                    severity = sec.severity,
                    title = "Missing header: ${sec.name}",
                    detail = sec.detail,
                )
            }
        }

        // Server banner disclosure is a low-severity information leak.
        headers.firstOrNull { it.first.equals("Server", true) }?.let { (_, value) ->
            if (value.isNotBlank() && value.any { it.isDigit() }) {
                findings += VulnerabilityFinding(
                    tool = "http_inspector",
                    target = target,
                    severity = Severity.LOW,
                    title = "Server version disclosed",
                    detail = "Server header reveals version '$value' — aids targeted exploitation.",
                )
            }
        }

        return findings
    }
}
