import type { TwinAudit, Finding } from './types.js';

const FORBIDDEN_PATTERNS = [
  { pattern: /eval\s*\(/, category: 'code_injection', description: 'eval() usage detected — code injection risk', severity: 'critical' as const },
  { pattern: /new\s+Function\s*\(/, category: 'code_injection', description: 'new Function() detected — code injection risk', severity: 'critical' as const },
  { pattern: /exec\s*\(/, category: 'command_injection', description: 'exec() usage detected — command injection risk', severity: 'critical' as const },
  { pattern: /child_process/, category: 'command_injection', description: 'child_process import detected', severity: 'high' as const },
  { pattern: /\.env/, category: 'secret_exposure', description: '.env file reference detected', severity: 'medium' as const },
  { pattern: /password|secret|token|api_key/i, category: 'secret_exposure', description: 'Potential secret in source code', severity: 'high' as const },
  { pattern: /http:\/\//, category: 'insecure_transport', description: 'HTTP (not HTTPS) usage detected', severity: 'medium' as const },
  { pattern: /innerHTML/, category: 'xss', description: 'innerHTML usage — XSS risk', severity: 'high' as const },
  { pattern: /document\.write/, category: 'xss', description: 'document.write() — XSS risk', severity: 'medium' as const },
  { pattern: /Math\.random/, category: 'weak_randomness', description: 'Math.random() — not cryptographically secure', severity: 'low' as const },
];

export function auditSecurity(sourceFiles: { name: string; content: string }[]): TwinAudit {
  const findings: Finding[] = [];
  let idCounter = 0;

  for (const file of sourceFiles) {
    const lines = file.content.split('\n');
    for (let i = 0; i < lines.length; i++) {
      for (const { pattern, category, description, severity } of FORBIDDEN_PATTERNS) {
        if (pattern.test(lines[i])) {
          findings.push({
            id: `SEC-${String(++idCounter).padStart(3, '0')}`,
            severity,
            category,
            description: `${file.name}:${i + 1} — ${description}`,
            file: file.name,
            line: i + 1,
            remediation: `Remove or replace ${category} pattern`
          });
        }
      }
    }
  }

  const critical = findings.filter(f => f.severity === 'critical').length;
  const high = findings.filter(f => f.severity === 'high').length;
  const medium = findings.filter(f => f.severity === 'medium').length;
  const low = findings.filter(f => f.severity === 'low').length;

  const verdict = critical > 0 ? 'fail' : high > 0 || medium > 0 ? 'warn' : 'pass';

  return {
    twin: 'security',
    verdict,
    findings,
    passed: sourceFiles.length - (critical > 0 ? 1 : 0),
    failed: critical,
    warnings: high + medium + low,
    duration_ms: 0
  };
}