package com.optix.android.ui.components

/**
 * Plain-English educational tooltips for every tool.
 * Shown to beginners in the ToolConfigForm as a collapsible "What does this do?" card.
 */
data class ToolTip(
    val whatItDoes: String,
    val whatToLookFor: String,
    val exampleValue: String? = null,
)

object ToolTips {
    val tips: Map<String, ToolTip> = mapOf(

        // ── Network & Scanning ────────────────────────────────────────────
        "network_scanner" to ToolTip(
            whatItDoes = "Sends a quick 'ping' to every device in a range of IP addresses to find out which ones are online. Think of it like knocking on every door in a neighborhood to see who answers.",
            whatToLookFor = "Any IP listed as 'UP' is a live device. The 'openPorts' list tells you which services it's running (e.g. port 80 = website, port 22 = remote login).",
            exampleValue = "192.168.1.0/24  ← scans your whole home network",
        ),
        "port_scanner" to ToolTip(
            whatItDoes = "Checks which 'doors' (ports) on a specific device are open. Every internet service uses a numbered port — like a door number on a building. Port 80 = web server, 22 = SSH, 443 = HTTPS.",
            whatToLookFor = "Open ports tell you what software is running on that device. An unexpected open port could be a security risk.",
            exampleValue = "192.168.1.1  ← your router's IP address",
        ),
        "lan_scanner" to ToolTip(
            whatItDoes = "Scans all 254 possible device addresses (.1 through .254) on your local Wi-Fi subnet to discover every connected device — phones, laptops, smart TVs, printers, etc.",
            whatToLookFor = "Compare the results to devices you recognize. Any unknown IP could be an unauthorized device on your network.",
            exampleValue = "192.168.1  ← the first 3 numbers of your home network",
        ),
        "netbios_scanner" to ToolTip(
            whatItDoes = "Asks a Windows-style device for its 'computer name' using an old protocol called NetBIOS. Common on home networks and office Windows machines.",
            whatToLookFor = "The hostname (e.g. 'DESKTOP-ABC123') tells you what Windows machine is at that IP.",
            exampleValue = "192.168.1.10",
        ),
        "wifi_scanner" to ToolTip(
            whatItDoes = "Lists all Wi-Fi access points your phone can currently detect — including SSID (network name), BSSID (router hardware ID), signal strength, and security type.",
            whatToLookFor = "Look for networks with 'Open' or no security — those have no password and anyone can join. WPA2/WPA3 networks are encrypted.",
            exampleValue = "No input needed — just tap Run",
        ),
        "traceroute" to ToolTip(
            whatItDoes = "Maps the path your internet traffic takes from your phone to a destination. Each 'hop' is a router along the way — like tracing a package from sender to delivery.",
            whatToLookFor = "High latency at a specific hop can pinpoint where network slowdowns occur. A '*' means that router didn't respond (normal for some ISP routers).",
            exampleValue = "google.com  or  8.8.8.8",
        ),
        "packet_sniffer" to ToolTip(
            whatItDoes = "Captures raw network traffic flowing through your device's network interface. Think of it as a wiretap on your own connection — useful for debugging and security research. Requires root.",
            whatToLookFor = "Look for unusual destinations, unencrypted data (HTTP), or repeated connection attempts which could indicate malware.",
            exampleValue = "wlan0  ← your Wi-Fi interface",
        ),
        "rping3_termux" to ToolTip(
            whatItDoes = "A powerful packet crafting tool that lets you send custom TCP/UDP/ICMP packets. Used for network testing, firewall probing, and latency measurement. More precise than a regular ping. Requires Termux.",
            whatToLookFor = "SYN responses (SA flags) mean the port is open. RST flags mean closed. No response could mean a firewall is dropping packets.",
            exampleValue = "192.168.1.1",
        ),
        "nmap_termux" to ToolTip(
            whatItDoes = "The gold standard of network scanners. Performs OS detection, service versioning, and runs NSE scripts to find vulnerabilities. Requires Termux + root.",
            whatToLookFor = "Service versions (e.g. Apache 2.4.41). If a version is outdated, check for CVEs. NSE scripts will flag specific vulnerabilities like 'smb-vuln-ms17-010'.",
            exampleValue = "target: 192.168.1.1  scan_type: -sV",
        ),
        "masscan_termux" to ToolTip(
            whatItDoes = "The fastest port scanner ever created. Can scan the entire internet in 6 minutes. In Ori-on Optix, it's used to quickly sweep huge local networks (like a /16) for open ports. Requires Termux + root.",
            whatToLookFor = "High-speed discovery of open ports. Use Masscan for the initial 'sweep' and then Nmap for deeper inspection of found targets.",
            exampleValue = "target: 192.168.1.0/24  ports: 80,443",
        ),
        "arp_scan" to ToolTip(
            whatItDoes = "Uses ARP (Address Resolution Protocol) to find every device on your local Wi-Fi. Unlike ping, which many devices block, ARP is required for local communication, so it's much harder to hide from.",
            whatToLookFor = "Every IP and MAC address responding on your network. Useful for finding 'ghost' devices that don't respond to regular pings.",
            exampleValue = "interface: wlan0",
        ),
        "ssh_audit" to ToolTip(
            whatItDoes = "Connects to an SSH server and audits its security configuration — checking for weak encryption algorithms, outdated versions, and common misconfigurations.",
            whatToLookFor = "Look for 'WEAK' or 'CRITICAL' flags. Using old algorithms like 'ssh-dss' or weak ciphers makes the connection vulnerable to decryption.",
            exampleValue = "target: 192.168.1.10",
        ),

        // ── DNS & Web ─────────────────────────────────────────────────────
        "dns_recon" to ToolTip(
            whatItDoes = "Looks up DNS records for a domain — these are like a phone book entry that map domain names (google.com) to IP addresses, mail servers, and other services.",
            whatToLookFor = "A records = IP addresses. MX records = email servers. TXT records often contain security policies (SPF, DKIM). NS records = who controls the domain's DNS.",
            exampleValue = "google.com",
        ),
        "subdomain_enum" to ToolTip(
            whatItDoes = "Tries to discover hidden subdomains of a website (like mail.example.com, dev.example.com, admin.example.com) by testing common names against the domain's DNS.",
            whatToLookFor = "Subdomains like 'dev', 'staging', 'test', or 'admin' are often less secure than the main site and make interesting targets for research.",
            exampleValue = "example.com",
        ),
        "http_inspector" to ToolTip(
            whatItDoes = "Makes an HTTP request to a URL and shows you everything the server sends back — status codes, response headers, server software version, cookies, and security headers.",
            whatToLookFor = "Missing headers like X-Frame-Options or Content-Security-Policy = potential vulnerabilities. The 'Server' header reveals what software is running.",
            exampleValue = "https://example.com",
        ),
        "directory_fuzzer" to ToolTip(
            whatItDoes = "Tries hundreds of common folder and file names on a web server (like /admin, /login, /backup) to find hidden pages that aren't linked anywhere publicly.",
            whatToLookFor = "Any path returning a 200 OK response = the page exists. 403 Forbidden = it exists but is protected. 404 = doesn't exist.",
            exampleValue = "https://example.com",
        ),
        "sqli_tester" to ToolTip(
            whatItDoes = "Tests a web URL's parameters for SQL Injection — a classic vulnerability where attackers can manipulate a website's database by entering malicious code in a form or URL.",
            whatToLookFor = "Error messages containing database terms (MySQL, syntax error, ORA-) usually indicate the site is vulnerable to SQL injection.",
            exampleValue = "https://example.com/page?id=1",
        ),
        "xss_scanner" to ToolTip(
            whatItDoes = "Tests a URL for Cross-Site Scripting (XSS) — a vulnerability where an attacker can inject JavaScript into a webpage that runs in other users' browsers (used for cookie theft, phishing).",
            whatToLookFor = "If the test payload <script>alert('xss')</script> appears in the response unmodified, the site is likely vulnerable.",
            exampleValue = "https://example.com/search?q=test",
        ),
        "nikto_termux" to ToolTip(
            whatItDoes = "Comprehensive web server scanner that checks for 6700+ dangerous files, outdated server versions, and server-specific problems like open directory listings. Requires Termux.",
            whatToLookFor = "Reports on interesting files (like /config.php.bak), outdated server versions, and missing security headers. Often used as the first step in web pentesting.",
            exampleValue = "target: https://example.com",
        ),
        "sqlmap_termux" to ToolTip(
            whatItDoes = "The most powerful tool for detecting and exploiting SQL injection. It can automatically dump entire databases once a vulnerability is found. Requires Termux.",
            whatToLookFor = "The tool will tell you if a parameter is 'injectable'. If so, you can use it to view database tables, users, and passwords.",
            exampleValue = "url: http://example.com/item.php?id=1",
        ),
        "cors_checker" to ToolTip(
            whatItDoes = "Tests for Cross-Origin Resource Sharing (CORS) misconfigurations. Checks if a website is too trusting of other domains, which could allow an attacker to steal user data.",
            whatToLookFor = "If 'evil.com' is allowed to access the site with credentials, the site is vulnerable to cross-origin data theft.",
            exampleValue = "url: https://api.example.com",
        ),
        "security_headers" to ToolTip(
            whatItDoes = "Audits the security headers a website sends. These headers tell the browser how to protect the user from XSS, clickjacking, and other attacks.",
             whatToLookFor = "Missing headers like 'Content-Security-Policy' or 'Strict-Transport-Security' decrease the safety of the site's users.",
            exampleValue = "url: https://google.com",
        ),
        "jwt_analyzer" to ToolTip(
            whatItDoes = "Decodes and analyzes JSON Web Tokens (JWT). Checks if they are expired, what information they contain (like your user ID), and if the encryption is weak.",
            whatToLookFor = "Look for 'alg: none' (a critical flaw) or sensitive data like passwords stored inside the token itself.",
            exampleValue = "token: eyJhbGciOiJIUzI1NiI...",
        ),

        // ── OSINT ─────────────────────────────────────────────────────────
        "whois_lookup" to ToolTip(
            whatItDoes = "Looks up public registration records for a domain — who owns it, when it was registered, when it expires, and which company hosts it.",
            whatToLookFor = "Registrar, creation date, expiry date, and name servers. Privacy-protected domains will show a proxy service instead of the real owner.",
            exampleValue = "google.com",
        ),
        "ip_geolocation" to ToolTip(
            whatItDoes = "Attempts to find the approximate geographic location of an IP address — country, city, ISP, and organization. Note: this is an estimate, not GPS-accurate.",
            whatToLookFor = "Country and ISP are usually accurate. City-level data can be off by 50+ miles. Useful for identifying whether traffic comes from expected regions.",
            exampleValue = "8.8.8.8  ← Google's DNS server",
        ),
        "ssl_inspector" to ToolTip(
            whatItDoes = "Examines the HTTPS/TLS certificate on a website — who issued it, whether it's valid, when it expires, and what encryption it uses.",
            whatToLookFor = "Expired certs = security risk. Self-signed certs on public sites = suspicious. Weak cipher suites (RC4, 3DES) = outdated security.",
            exampleValue = "google.com",
        ),
        "cve_lookup" to ToolTip(
            whatItDoes = "Searches the National Vulnerability Database (NVD) for known security flaws (CVEs — Common Vulnerabilities and Exposures) by software name or CVE ID.",
            whatToLookFor = "CVSS Score 9-10 = Critical. 7-8.9 = High. Lower scores = less urgent. Look for whether a patch is available.",
            exampleValue = "Apache 2.4  or  CVE-2021-44228",
        ),
        "breach_check" to ToolTip(
            whatItDoes = "Checks if an email address has appeared in known data breaches — leaked databases from hacked services like LinkedIn, Adobe, or Collection #1.",
            whatToLookFor = "Which services were breached and when. Old passwords from these leaks are often tried in credential stuffing attacks.",
            exampleValue = "yourname@email.com",
        ),
        "shodan_search" to ToolTip(
            whatItDoes = "Searches Shodan — the 'search engine for the internet of things'. It indexes exposed devices worldwide: cameras, routers, industrial systems, and servers with open ports. Requires an API key.",
            whatToLookFor = "Results show devices with open ports, banners (software version info), and geolocation. Default credentials on IoT devices are a common finding.",
            exampleValue = "webcam  or  apache  or  port:22",
        ),
        "username_search" to ToolTip(
            whatItDoes = "Checks dozens of social media and online platforms to see if a specific username exists — useful for finding someone's online footprint.",
            whatToLookFor = "Platforms where the username exists. This can reveal someone's real identity if they use the same username across personal and professional accounts.",
            exampleValue = "johndoe123",
        ),

        // ── Exploitation ──────────────────────────────────────────────────
        "brute_force" to ToolTip(
            whatItDoes = "Systematically tries username and password combinations against a login service until one works. This is how weak or default passwords get discovered. Only use on systems you own.",
            whatToLookFor = "A successful login attempt will be highlighted. Even failed attempts are useful — they confirm the service is running and accepting connections.",
            exampleValue = "target: 192.168.1.1  service: ssh",
        ),
        "hydra_termux" to ToolTip(
            whatItDoes = "THC-Hydra is one of the fastest online password crackers, supporting 50+ protocols. It runs via your Termux environment. Needs root and Termux with hydra installed.",
            whatToLookFor = "[DATA] lines show attempts. A result like '[22][ssh] login: admin password: 1234' means a successful crack.",
            exampleValue = "target: 192.168.1.1  service: ssh",
        ),
        "arp_spoofer" to ToolTip(
            whatItDoes = "Performs an ARP poisoning attack on your local network — tricks devices into routing their traffic through your phone so you can monitor it. Classic man-in-the-middle technique. Requires root. Only use on your own network.",
            whatToLookFor = "Successful ARP replies confirm the attack is running. Use with packet_sniffer to capture traffic from the target device.",
            exampleValue = "target: 192.168.1.50  gateway: 192.168.1.1",
        ),
        "metasploit_termux" to ToolTip(
            whatItDoes = "The world's most used penetration testing framework. It contains thousands of ready-to-use exploits for almost every known vulnerability. Requires Termux.",
            whatToLookFor = "Succesful 'exploit' results mean you have gained control over the target. Use with 'auxiliary' modules for scanning and 'post' modules for gathering info.",
            exampleValue = "module: auxiliary/scanner/portscan/tcp",
        ),
        "msfvenom_termux" to ToolTip(
            whatItDoes = "Generates custom 'payloads' (malicious files) for Metasploit. Can create APKs for Android, EXEs for Windows, or scripts for Linux that give you a remote shell. Requires Termux.",
            whatToLookFor = "The generated file will be saved to your device. When opened on a target, it will connect back to your Metasploit listener.",
            exampleValue = "payload: android/meterpreter/reverse_tcp",
        ),
        "evil_twin" to ToolTip(
            whatItDoes = "Creates a fake Wi-Fi network with the same name as a real one to trick people into connecting. Used to capture Wi-Fi passwords. Requires an external USB Wi-Fi adapter.",
            whatToLookFor = "Victims connecting to your fake AP. Once connected, their device will try to send data through your phone.",
            exampleValue = "ssid: TargetGuestWiFi",
        ),
        "deauth_attack" to ToolTip(
            whatItDoes = "Sends a 'disconnect' command to a device on Wi-Fi, kicking it off the network. Often used to force a device to reconnect so a password can be captured. Requires external USB Wi-Fi.",
            whatToLookFor = "The target device losing its Wi-Fi connection. Useful for testing how devices handle network drops.",
            exampleValue = "bssid: AA:BB:CC:DD:EE:FF",
        ),
        "asn_lookup" to ToolTip(
            whatItDoes = "Looks up the Autonomous System Number (ASN) of an IP. This tells you which major organization (like Google, Comcast, or Amazon) actually owns that piece of the internet.",
            whatToLookFor = "Company name and global routing information. Helps identify if an IP belongs to a home user, a data center, or a government agency.",
            exampleValue = "target: 8.8.8.8",
        ),
        "dns_brute" to ToolTip(
            whatItDoes = "Guesses subdomains of a website (like dev.site.com, admin.site.com) using a huge list of common words. Faster and more private than online scanners.",
            whatToLookFor = "New subdomains that might host private parts of a company's network or forgot-about test sites.",
            exampleValue = "domain: example.com",
        ),
        "tech_stack_detector" to ToolTip(
            whatItDoes = "Fingerprints the technologies used by a website — what server software, what programming language, and what CMS (like WordPress) it's running.",
            whatToLookFor = "Specific versions of software. If you find 'WordPress 4.0', you can then search for exploits that work specifically on that version.",
            exampleValue = "url: https://example.com",
        ),
        "linkedin_recon" to ToolTip(
            whatItDoes = "Uses public search engine dorks to find employees and company info on LinkedIn. Essential for 'social engineering' research (learning who works where).",
            whatToLookFor = "Names, roles, and company structure. Useful for knowing who the IT manager or CTO is before a security audit.",
            exampleValue = "company: Tesla",
        ),
        "network_topology" to ToolTip(
            whatItDoes = "Maps the physical path of your data across the world. It shows every router ('hop') and which country/company it belongs to using ASN data.",
            whatToLookFor = "Strange routing paths (e.g. data going to another country before your destination) which could indicate traffic interception.",
            exampleValue = "target: target-bank.com",
        ),

        // ── Payloads & Utilities ──────────────────────────────────────────
        "payload_generator" to ToolTip(
            whatItDoes = "Generates reverse shell payloads or exploit code for common platforms (bash, python, powershell). Used in CTF challenges and penetration testing to establish a foothold.",
            whatToLookFor = "Copy the generated command and run it on the target system (in a lab/CTF environment). It will connect back to your listener.",
            exampleValue = "type: bash  ip: 192.168.1.100  port: 4444",
        ),
        "hash_cracker" to ToolTip(
            whatItDoes = "Attempts to reverse a cryptographic hash (like MD5 or SHA-1) back to its original plaintext by checking it against online rainbow table databases.",
            whatToLookFor = "If a match is found, the original password is displayed. MD5/SHA-1 hashes of common passwords crack almost instantly.",
            exampleValue = "5f4dcc3b5aa765d61d8327deb882cf99  ← MD5 of 'password'",
        ),
        "password_generator" to ToolTip(
            whatItDoes = "Generates cryptographically random, strong passwords. Good passwords should be long (16+ characters) and use a mix of uppercase, lowercase, numbers, and symbols.",
            whatToLookFor = "Use the output as a new password and store it in a password manager. Never reuse passwords across sites.",
            exampleValue = "No input needed — just tap Run",
        ),
        "encoder_tool" to ToolTip(
            whatItDoes = "Encodes or decodes text using common formats: Base64, URL encoding, and hex. These are frequently used to obfuscate data in web requests, emails, and malware.",
            whatToLookFor = "Base64 encoded strings always end with '=' padding. URL encoded strings replace special characters with %XX percent codes.",
            exampleValue = "type: base64  data: Hello World",
        ),
        "reverse_shell_gen" to ToolTip(
            whatItDoes = "Generates one-liner commands that make a remote machine connect back to you with a shell prompt — giving you command-line control. Used in CTFs and authorized penetration tests.",
            whatToLookFor = "Run the generated command on the target machine (in a lab). Then start a listener on your machine with 'nc -lvnp <port>'.",
            exampleValue = "type: python3  ip: 192.168.1.100  port: 9001",
        ),
        "subnet_calculator" to ToolTip(
            whatItDoes = "Calculates the math for IP subnets. Tells you the network address, the broadcast address, and how many devices can fit in a specific range.",
            whatToLookFor = "The 'Total Usable Hosts'. For example, a /24 network can hold 254 devices.",
            exampleValue = "cidr: 192.168.1.0/24",
        ),
        "hash_generator" to ToolTip(
            whatItDoes = "Creates a 'digital fingerprint' (hash) of any text. Hashes are one-way, meaning you can't get the original text back from the hash, but you can check if they match.",
            whatToLookFor = "The generated hash. SHA-256 is the modern standard; MD5 is older and less secure.",
            exampleValue = "input: secretpassword",
        ),
        "cipher_tool" to ToolTip(
            whatItDoes = "Encrypts or decrypts text using classic ciphers like Caesar, ROT13, and Vigenère. Fun for learning how encryption works and for solving CTF puzzles.",
            whatToLookFor = "Deciphered text. If you find a string of nonsense text, try different ciphers to see if a readable message appears.",
            exampleValue = "text: grkg  mode: rot13",
        ),
        "regex_tester" to ToolTip(
            whatItDoes = "Tests Regular Expressions (patterns used to search text). Used by researchers to extract things like emails or IP addresses from huge amounts of data.",
            whatToLookFor = "Matching text highlighted in the console. If your pattern matches, you'll see exactly which parts of the text were 'captured'.",
            exampleValue = "pattern: \\d+  text: found 52 hosts",
        ),
    )

    fun get(toolName: String): ToolTip? = tips[toolName]
}
