package com.optix.android.domain.model

// ---------------------------------------------------------------------------
// Structured, filterable finding models produced by the parsing layer.
//
// Improvement #12: tools that previously dumped raw text lines now run their
// output through pure parser functions (see com.optix.android.tools.parser)
// which produce these typed objects. They are emitted via the existing
// ToolEvent.Result(data) mechanism, serialised through gson.toJson into
// Session.results (List<String>), and decoded back via ResultSerialization.
//
// Every model here is a plain Kotlin data class with no Android dependency so
// the parsers that build them stay unit-testable (item #7).
// ---------------------------------------------------------------------------

/** Severity levels shared across structured findings. Ordered from low to high. */
enum class Severity {
    INFO, LOW, MEDIUM, HIGH, CRITICAL;

    companion object {
        /** Lenient parse from arbitrary text (nmap/nuclei/ssh output). */
        fun from(raw: String?): Severity = when (raw?.trim()?.lowercase()) {
            "critical", "crit" -> CRITICAL
            "high" -> HIGH
            "medium", "med", "moderate" -> MEDIUM
            "low" -> LOW
            else -> INFO
        }
    }
}

/**
 * A single open port parsed from a scanner's raw output (e.g. nmap grepable /
 * normal output). Richer than [PortResult] because it carries the host and the
 * detected product/version string when available.
 */
data class OpenPort(
    val host: String,
    val port: Int,
    val protocol: String = "tcp",     // "tcp" | "udp"
    val state: String = "open",       // "open" | "filtered" | "closed"
    val service: String = "unknown",
    val product: String? = null,      // e.g. "OpenSSH"
    val version: String? = null,      // e.g. "8.9p1 Ubuntu-3ubuntu0.6"
)

/**
 * Service / banner detail parsed from a tool (SSH banner, HTTP Server header,
 * nmap service version line, etc.).
 */
data class ServiceInfo(
    val host: String,
    val port: Int? = null,
    val service: String,              // e.g. "ssh", "http"
    val product: String? = null,      // e.g. "OpenSSH", "nginx"
    val version: String? = null,
    val banner: String? = null,
    val extra: String? = null,
)

/**
 * A vulnerability / weakness finding parsed from any tool. This is the primary
 * structured object for SSH audit, HTTP header audit, nuclei, and nmap NSE
 * vuln scripts, so the UI can render a severity chip and filter by severity.
 */
data class VulnerabilityFinding(
    val tool: String,                 // e.g. "nuclei", "ssh_audit", "http_inspector"
    val target: String,               // host / url the finding applies to
    val severity: Severity,
    val title: String,                // short label, e.g. "Missing HSTS header"
    val detail: String = "",          // longer description / evidence
    val reference: String? = null,    // CVE id, template id, or URL
    val cvss: Double = 0.0,
)
