// Copyright (C) 2025 Keygraph, Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License version 3
// as published by the Free Software Foundation.

/**
 * Configuration type definitions
 */

export type RuleType = 'url_path' | 'subdomain' | 'domain' | 'method' | 'header' | 'parameter' | 'code_path';

export interface Rule {
  description?: string;
  type: RuleType;
  value: string;
}

export interface Rules {
  avoid?: Rule[];
  focus?: Rule[];
}

export type VulnClass = 'injection' | 'xss' | 'auth' | 'authz' | 'ssrf';

export const ALL_VULN_CLASSES: readonly VulnClass[] = ['injection', 'xss', 'auth', 'authz', 'ssrf'];

export type Severity = 'low' | 'medium' | 'high' | 'critical';
export type Confidence = 'low' | 'medium' | 'high';

export interface ReportConfig {
  min_severity?: Severity;
  min_confidence?: Confidence;
  guidance?: string;
  /**
   * Emit report.sarif alongside the markdown report. On by default for exploit runs; set 'false'
   * to opt out. Ignored when exploit is false.
   */
  sarif?: 'true' | 'false';
}

export type LoginType = 'form' | 'sso' | 'api' | 'basic';

export interface SuccessCondition {
  type: 'url_contains' | 'element_present' | 'url_equals_exactly' | 'text_contains';
  value: string;
}

export interface EmailLogin {
  address: string;
  password: string;
  totp_secret?: string;
}

export interface Credentials {
  username: string;
  password?: string;
  totp_secret?: string;
  email_login?: EmailLogin;
}

export interface Authentication {
  login_type: LoginType;
  login_url: string;
  credentials: Credentials;
  login_flow?: string[];
  success_condition: SuccessCondition;
}

export interface Config {
  rules?: Rules;
  authentication?: Authentication;
  description?: string;
  vuln_classes?: VulnClass[];
  exploit?: 'true' | 'false';
  report?: ReportConfig;
  rules_of_engagement?: string;
}

/** Report config after coercion. The YAML form of `sarif` is a string (see ReportConfig). */
export type DistributedReportConfig = Omit<ReportConfig, 'sarif'> & { sarif: boolean };

export interface DistributedConfig {
  avoid: Rule[];
  focus: Rule[];
  authentication: Authentication | null;
  description: string;
  vuln_classes: VulnClass[];
  exploit: boolean;
  report: DistributedReportConfig;
  rules_of_engagement: string;
}

/**
 * Runtime configuration for the DI container.
 *
 * Abstracts path conventions so consumers can override OSS defaults
 * without modifying source files.
 */
export interface ContainerConfig {
  /** Subdirectory for deliverables relative to repoPath. Default: '.shannon/deliverables' */
  readonly deliverablesSubdir: string;
  /** Directory for audit logs. Default: './workspaces' */
  readonly auditDir: string;
  /** Prompt directory override — when set, prompt manager loads from this path */
  readonly promptDir?: string;
}
