import {Request} from '@loopback/rest';
import {DEFAULT_XSS_CONFIG} from '../constants/security-defaults';
import {XssConfig} from '../types';
import {SecurityError} from '../utils/security-error';
import {SecurityLogger} from '../utils/security-logger';

/**
 * XSS detector that scans for cross-site scripting attack patterns
 */
export class XssDetector {
  private readonly defaultPatterns: RegExp[] = [
    // Script tags
    /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
    /<script[^>]*>[\s\S]*?<\/script>/gi,
    /<script[^>]*\/>/gi,

    // Iframe tags
    /<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe>/gi,
    /<iframe[^>]*>[\s\S]*?<\/iframe>/gi,
    /<iframe[^>]*\/>/gi,

    // JavaScript protocols
    /javascript:/gi,
    /vbscript:/gi,
    /data:text\/html/gi,
    /data:application\/javascript/gi,

    // Event handlers
    /on\w+\s*=\s*["'][^"']*["']/gi,
    /on(load|error|click|focus|blur|change|submit|reset|select|keyup|keydown|keypress|mouseover|mouseout|mouseup|mousedown)=/gi,

    // Malicious image sources
    /<img\b[^>]*src\s*=\s*["']javascript:[^"']*["'][^>]*>/gi,
    /<img[^>]*src\s*=\s*["']data:text\/html[^"']*["'][^>]*>/gi,

    // Object and embed tags
    /<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object>/gi,
    /<embed\b[^>]*>/gi,
    /<applet\b[^<]*(?:(?!<\/applet>)<[^<]*)*<\/applet>/gi,

    // Form tags with malicious actions
    /<form[^>]*action\s*=\s*["']javascript:[^"']*["'][^>]*>/gi,

    // Meta refresh redirects
    /<meta[^>]*http-equiv\s*=\s*["']refresh["'][^>]*>/gi,

    // Style tags with expressions
    /<style[^>]*>[\s\S]*?expression\s*\([^)]*\)[\s\S]*?<\/style>/gi,
    /<[^>]*style\s*=\s*["'][^"']*expression\s*\([^)]*\)[^"']*["'][^>]*>/gi,

    // Link tags with malicious hrefs
    /<link[^>]*href\s*=\s*["']javascript:[^"']*["'][^>]*>/gi,

    // Base tag manipulations
    /<base[^>]*href\s*=\s*["'][^"']*["'][^>]*>/gi,

    // Comments that might hide malicious code
    /<!--[\s\S]*?-->/gi,

    // Common XSS payloads
    /alert\s*\(/gi,
    /confirm\s*\(/gi,
    /prompt\s*\(/gi,
    /document\.cookie/gi,
    /document\.write/gi,
    /eval\s*\(/gi,
    /setTimeout\s*\(/gi,
    /setInterval\s*\(/gi,
    /window\.location/gi,
    /location\.href/gi,
    /location\.replace/gi,
    /location\.assign/gi,

    // SVG-based XSS
    /<svg[^>]*>[\s\S]*?<\/svg>/gi,
    /<svg[^>]*onload\s*=/gi,

    // Math ML XSS
    /<math[^>]*>[\s\S]*?<\/math>/gi,

    // Encoded characters that might bypass filters
    /&#x[0-9a-fA-F]+;?/gi,
    /&#[0-9]+;?/gi,
    /%3C%73%63%72%69%70%74/gi, // <script in URL encoding
    /\\u003c\\u0073\\u0063\\u0072\\u0069\\u0070\\u0074/gi, // Unicode encoded <script

    // Expression-based attacks
    /expression\s*\(/gi,
    /binding\s*:/gi,
    /-moz-binding\s*:/gi,

    // Import statements
    /@import\s*["']?javascript:/gi
  ];

  private patterns: RegExp[];
  private allowedTags: Set<string>;
  private allowedAttributes: Set<string>;
  private skipFields: string[];

  constructor(
    private config?: XssConfig,
    private logger?: SecurityLogger,
    skipFields?: string[]
  ) {
    // Merge with default configuration
    this.config = {
      ...DEFAULT_XSS_CONFIG,
      ...config
    };

    // Combine default patterns with custom patterns
    this.patterns = [
      ...this.defaultPatterns,
      ...(this.config?.customPatterns ?? [])
    ];

    // Set up allowed tags and attributes for lenient mode
    this.allowedTags = new Set(this.config?.allowedTags?.map(tag => tag.toLowerCase()) ?? []);
    this.allowedAttributes = new Set(this.config?.allowedAttributes?.map(attr => attr.toLowerCase()) ?? []);

    // Set skip fields
    this.skipFields = skipFields ?? [];

    this.logger?.logSecurityEvent({}, {
      timestamp: new Date().toISOString(),
      eventType: 'SECURITY_CHECK_PASSED',
      severity: 'LOW',
      metadata: {
        component: 'XssDetector',
        patternsLoaded: this.patterns.length,
        allowedTags: this.allowedTags.size,
        allowedAttributes: this.allowedAttributes.size
      }
    });
  }

  /**
   * Detect XSS attacks in the request
   */
  async detectXssAttacks(req: Request): Promise<void> {
    if (this.config?.enableProtection === false) {
      return;
    }

    try {
      // Check query parameters
      if (req.query) {
        await this.scanObject(req.query, 'query parameters', req);
      }

      // Check request body
      if (req.body) {
        await this.scanObject(req.body, 'request body', req);
      }

      // Check URL parameters
      if (req.params) {
        await this.scanObject(req.params, 'URL parameters', req);
      }

      // Check headers for XSS (always enabled for security)
      if (req.headers) {
        await this.scanHeaders(req.headers, req);
      }

    } catch (error) {
      if (error instanceof SecurityError) {
        throw error;
      }

      // Log unexpected errors
      this.logger?.logSecurityViolation(req, error instanceof Error ? error : String(error), {
        component: 'XssDetector',
        method: 'detectXssAttacks'
      });

      throw SecurityError.fromError(error);
    }
  }

  /**
   * Check if a field should be skipped from XSS detection
   */
  private shouldSkipField(fieldName: string): boolean {
    if (!this.skipFields || this.skipFields.length === 0) {
      return false;
    }

    const lowerFieldName = fieldName.toLowerCase();
    return this.skipFields.some(skipField => 
      lowerFieldName.includes(skipField.toLowerCase())
    );
  }

  /**
   * Scan object recursively for XSS patterns
   */
  private async scanObject(
    obj: Record<string, unknown>,
    location: string,
    req: Request,
    path = ''
  ): Promise<void> {
    if (!obj || typeof obj !== 'object') {
      return;
    }

    for (const [key, value] of Object.entries(obj)) {
      const currentPath = path ? `${path}.${key}` : key;

      // Skip XSS detection for fields that are in the skip list
      if (this.shouldSkipField(key)) {
        this.logger?.logSecurityEvent(req, {
          timestamp: new Date().toISOString(),
          eventType: 'SECURITY_CHECK_PASSED',
          severity: 'LOW',
          metadata: {
            component: 'XssDetector',
            action: 'FIELD_SKIPPED',
            fieldName: key,
            location: `${location}.${currentPath}`,
            reason: 'Field in skip list'
          }
        });
        continue;
      }

      if (typeof value === 'string') {
        await this.scanStringValue(value, `${location}.${currentPath}`, req);
      } else if (Array.isArray(value)) {
        for (let i = 0; i < value.length; i++) {
          if (typeof value[i] === 'string') {
            await this.scanStringValue(value[i] as string, `${location}.${currentPath}[${i}]`, req);
          } else if (typeof value[i] === 'object' && value[i] !== null) {
            await this.scanObject(value[i] as Record<string, unknown>, location, req, `${currentPath}[${i}]`);
          }
        }
      } else if (typeof value === 'object' && value !== null) {
        await this.scanObject(value as Record<string, unknown>, location, req, currentPath);
      }
    }
  }

  /**
   * Scan headers for XSS attempts
   */
  private async scanHeaders(headers: Record<string, unknown>, req: Request): Promise<void> {
    // Headers that should never be scanned due to their nature
    const headersToCompletelySkip = new Set([
      'content-length',   // Always numeric
      'connection',       // Connection types only
      'upgrade-insecure-requests', // Browser security (0 or 1)
      'sec-fetch-site',   // Browser security (controlled values)
      'sec-fetch-mode',   // Browser security (controlled values)
      'sec-fetch-dest',   // Browser security (controlled values)
      'sec-fetch-user',   // Browser security (controlled values)
    ]);

    // Headers that need careful validation (check for obvious XSS but allow legitimate content)
    const headersNeedingCarefulValidation = new Set([
      'user-agent',       // Can contain legitimate special chars but shouldn't have obvious XSS
      'accept',           // MIME types with parameters
      'accept-language',  // Language codes
      'accept-encoding',  // Encoding types
      'content-type',     // MIME types with parameters
      'cookie',          // Session data
      'cache-control',   // Cache directives
      'host',            // Hostname (validated elsewhere but can be manipulated)
    ]);

    for (const [headerName, headerValue] of Object.entries(headers)) {
      const normalizedHeaderName = headerName.toLowerCase();

      // Skip headers that should never be checked
      if (headersToCompletelySkip.has(normalizedHeaderName)) {
        continue;
      }

      if (typeof headerValue === 'string') {
        // For headers that need careful validation, use more restrictive patterns
        if (headersNeedingCarefulValidation.has(normalizedHeaderName)) {
          await this.scanHeaderValueCarefully(headerValue, `header.${headerName}`, req, normalizedHeaderName);
        } else {
          // For custom headers and other headers, use full validation
          await this.scanStringValue(headerValue, `header.${headerName}`, req);
        }
      }
    }
  }

  /**
   * Scan header values with more restrictive patterns to avoid false positives
   * while still catching obvious XSS attempts
   */
  private async scanHeaderValueCarefully(value: string, location: string, req: Request, headerName: string): Promise<void> {
    // Skip empty strings
    if (!value.trim()) {
      return;
    }

    // High-confidence XSS patterns that are likely malicious even in headers
    const highConfidenceXssPatterns: RegExp[] = [
      // Script tags with obvious XSS intent
      /<script[^>]*>[\s\S]*?<\/script>/gi,
      /<script[^>]*\/>/gi,

      // JavaScript protocols (clearly malicious)
      /javascript\s*:/gi,
      /vbscript\s*:/gi,

      // Obvious event handlers with dangerous content
      /on\w+\s*=\s*["'][^"']*(?:alert|confirm|prompt|eval)[^"']*["']/gi,

      // Data URLs with HTML/JS content
      /data:text\/html[^;]*;[^,]*,[\s\S]*<script/gi,
      /data:application\/javascript/gi,

      // Common XSS payloads
      /alert\s*\(\s*["']?[^"']*["']?\s*\)/gi,
      /confirm\s*\(\s*["']?[^"']*["']?\s*\)/gi,
      /prompt\s*\(\s*["']?[^"']*["']?\s*\)/gi,

      // Malicious image tags
      /<img[^>]*src\s*=\s*["']?javascript:/gi,
      /<img[^>]*onerror\s*=\s*["'][^"']*(?:alert|eval)[^"']*["']/gi,

      // iframe with javascript
      /<iframe[^>]*src\s*=\s*["']?javascript:/gi,
    ];

    // Special handling for specific headers
    if (headerName === 'user-agent') {
      // For user-agent, only check for very obvious XSS patterns
      const userAgentXssPatterns = [
        /<script[^>]*>/gi,
        /javascript\s*:/gi,
        /on\w+\s*=\s*["'][^"']*alert/gi,
      ];

      for (const pattern of userAgentXssPatterns) {
        pattern.lastIndex = 0;
        if (pattern.test(value)) {
          this.logAndThrowXss(value, location, req, pattern);
          return;
        }
      }
      return;
    }

    if (headerName === 'cookie') {
      // For cookies, be more careful - skip if it looks like a legitimate session
      if (/^[a-zA-Z0-9+/=_-]+$/.test(value) && value.length > 20) {
        return; // Likely a legitimate session token
      }
    }

    if (headerName === 'accept' || headerName === 'content-type') {
      // For MIME type headers, only check for the most obvious attacks
      const mimeXssPatterns = [
        /<script/gi,
        /javascript\s*:/gi,
        /on\w+\s*=/gi,
      ];

      for (const pattern of mimeXssPatterns) {
        pattern.lastIndex = 0;
        if (pattern.test(value)) {
          this.logAndThrowXss(value, location, req, pattern);
          return;
        }
      }
      return;
    }

    // Check against high-confidence patterns for other carefully validated headers
    for (const pattern of highConfidenceXssPatterns) {
      pattern.lastIndex = 0;
      if (pattern.test(value)) {
        this.logAndThrowXss(value, location, req, pattern);
        return;
      }
    }
  }

  /**
   * Helper method to log and throw XSS detection
   */
  private logAndThrowXss(value: string, location: string, req: Request, pattern: RegExp): void {
    // Log the detection
    this.logger?.logMaliciousActivity(req, 'XSS_ATTACK_ATTEMPT',
      `XSS pattern detected in ${location}`, {
      pattern: pattern.toString(),
      value: this.sanitizeLogValue(value),
      location
    }, 'XssDetector', 'scanValue');

    // Block the request
    if (this.config?.strictMode || this.isHighRiskPattern(pattern)) {
      throw SecurityError.xssAttackDetected(location, pattern.toString(), {
        originalValue: this.sanitizeLogValue(value),
        patternMatched: pattern.toString()
      });
    }

    // In non-strict mode, still block for XSS (it's always dangerous)
    throw SecurityError.xssAttackDetected(location, pattern.toString());
  }

  /**
   * Scan individual string value for XSS patterns
   */
  private async scanStringValue(value: string, location: string, req: Request): Promise<void> {
    // Skip empty strings
    if (!value.trim()) {
      return;
    }

    // Decode various encodings for better detection
    const decodedValues = this.decodeValue(value);
    const valuesToScan = [value, ...decodedValues];

    // Check against all patterns
    for (const testValue of valuesToScan) {
      for (const pattern of this.patterns) {
        // Reset regex lastIndex to ensure consistent matching
        pattern.lastIndex = 0;

        if (pattern.test(testValue)) {
          // Check if this might be allowed content
          if (this.isAllowedContent(testValue, pattern)) {
            continue;
          }

          // Log the detection
          this.logger?.logMaliciousActivity(req, 'XSS_ATTACK_ATTEMPT',
            `XSS pattern detected in ${location}`, {
            pattern: pattern.toString(),
            value: this.sanitizeLogValue(testValue),
            location,
            originalValue: value !== testValue ? this.sanitizeLogValue(value) : undefined
          });

          // Sanitize input if configured to do so
          if (this.config?.sanitizeInput && req.body && location.includes('request body')) {
            this.sanitizeRequestData(req, location, testValue);
            return; // Continue after sanitization
          }

          // Block the request if strict mode is enabled or high-risk pattern
          if (this.config?.strictMode || this.isHighRiskPattern(pattern)) {
            throw SecurityError.xssAttackDetected(location, pattern.toString(), {
              originalValue: this.sanitizeLogValue(value),
              detectedValue: value !== testValue ? this.sanitizeLogValue(testValue) : undefined,
              patternMatched: pattern.toString()
            });
          }

          // In non-strict mode, might still block based on pattern severity
          if (this.shouldBlockPattern(pattern)) {
            throw SecurityError.xssAttackDetected(location, pattern.toString());
          }
        }
      }
    }
  }

  /**
   * Decode various encodings to catch evasion attempts
   */
  private decodeValue(value: string): string[] {
    const decoded: string[] = [];

    try {
      // URL decode
      const urlDecoded = decodeURIComponent(value);
      if (urlDecoded !== value) {
        decoded.push(urlDecoded);
      }

      // HTML entity decode
      const htmlDecoded = value
        .replace(/&lt;/gi, '<')
        .replace(/&gt;/gi, '>')
        .replace(/&quot;/gi, '"')
        .replace(/&#x27;/gi, "'")
        .replace(/&#x2F;/gi, '/')
        .replace(/&amp;/gi, '&')
        .replace(/&#x3C;/gi, '<')
        .replace(/&#x3E;/gi, '>')
        .replace(/&#60;/gi, '<')
        .replace(/&#62;/gi, '>')
        .replace(/&#34;/gi, '"')
        .replace(/&#39;/gi, "'");

      if (htmlDecoded !== value) {
        decoded.push(htmlDecoded);
      }

      // Unicode decode
      const unicodeDecoded = value.replace(/\\u([0-9a-fA-F]{4})/g, (match, hex) =>
        String.fromCharCode(parseInt(hex, 16))
      );
      if (unicodeDecoded !== value) {
        decoded.push(unicodeDecoded);
      }

      // Hex decode
      const hexDecoded = value.replace(/%([0-9a-fA-F]{2})/g, (match, hex) =>
        String.fromCharCode(parseInt(hex, 16))
      );
      if (hexDecoded !== value) {
        decoded.push(hexDecoded);
      }

      // Double decode (in case of double encoding)
      const doubleDecoded = decoded.flatMap(val => this.decodeValue(val));
      decoded.push(...doubleDecoded.filter(val => !decoded.includes(val)));

    } catch (error) {
      // If decoding fails, continue with original value
      this.logger?.logSecurityEvent({}, {
        timestamp: new Date().toISOString(),
        eventType: 'SECURITY_CHECK_PASSED',
        severity: 'LOW',
        metadata: {
          component: 'XssDetector',
          warning: 'Decoding failed',
          error: error instanceof Error ? error.message : String(error)
        }
      });
    }

    return decoded;
  }

  /**
   * Check if content might be allowed based on configuration
   */
  private isAllowedContent(value: string, pattern: RegExp): boolean {
    if (this.allowedTags.size === 0 && this.allowedAttributes.size === 0) {
      return false;
    }

    // Simple heuristic: if the pattern matches allowed tags/attributes, it might be ok
    // This is a simplified check - in production, you'd want a proper HTML parser
    const tagMatches = value.match(/<(\w+)[\s>]/gi);
    const attrMatches = value.match(/(\w+)\s*=/gi);

    if (tagMatches) {
      for (const tagMatch of tagMatches) {
        const tag = tagMatch.replace(/<(\w+)[\s>]/, '$1').toLowerCase();
        if (!this.allowedTags.has(tag)) {
          return false;
        }
      }
    }

    if (attrMatches) {
      for (const attrMatch of attrMatches) {
        const attr = attrMatch.replace(/(\w+)\s*=/, '$1').toLowerCase();
        if (!this.allowedAttributes.has(attr)) {
          return false;
        }
      }
    }

    return true;
  }

  /**
   * Determine if pattern represents high-risk XSS attempt
   */
  private isHighRiskPattern(pattern: RegExp): boolean {
    const highRiskPatterns = [
      /<script/gi,
      /javascript:/gi,
      /document\.cookie/gi,
      /document\.write/gi,
      /eval\s*\(/gi,
      /alert\s*\(/gi
    ];

    return highRiskPatterns.some(highRiskPattern =>
      pattern.toString().includes(highRiskPattern.source)
    );
  }

  /**
   * Determine if pattern should be blocked even in non-strict mode
   */
  private shouldBlockPattern(pattern: RegExp): boolean {
    // Always block dangerous patterns
    const alwaysBlockPatterns = [
      /<script/gi,
      /javascript:/gi,
      /vbscript:/gi,
      /document\.cookie/gi,
      /eval\s*\(/gi
    ];

    return alwaysBlockPatterns.some(blockPattern =>
      pattern.toString().includes(blockPattern.source)
    );
  }

  /**
   * Sanitize request data in place
   */
  private sanitizeRequestData(req: Request, location: string, dangerousValue: string): void {
    // This is a simplified sanitization - in production, use a library like DOMPurify
    const sanitized = dangerousValue
      .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
      .replace(/<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe>/gi, '')
      .replace(/javascript:/gi, 'removed:')
      .replace(/vbscript:/gi, 'removed:')
      .replace(/on\w+\s*=/gi, 'data-removed=')
      .replace(/<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object>/gi, '')
      .replace(/<embed\b[^>]*>/gi, '')
      .replace(/<applet\b[^<]*(?:(?!<\/applet>)<[^<]*)*<\/applet>/gi, '');

    // Apply sanitization back to request (simplified approach)
    if (req.body && typeof req.body === 'object') {
      this.applySanitization(req.body, dangerousValue, sanitized);
    }

    this.logger?.logSecurityEvent(req, {
      timestamp: new Date().toISOString(),
      eventType: 'SECURITY_CHECK_PASSED',
      severity: 'MEDIUM',
      metadata: {
        component: 'XssDetector',
        action: 'INPUT_SANITIZED',
        location,
        originalLength: dangerousValue.length,
        sanitizedLength: sanitized.length
      }
    });
  }

  /**
   * Apply sanitization to nested object structure
   */
  private applySanitization(obj: Record<string, unknown>, original: string, sanitized: string): void {
    for (const key in obj) {
      if (typeof obj[key] === 'string' && obj[key] === original) {
        obj[key] = sanitized;
      } else if (typeof obj[key] === 'object' && obj[key] !== null) {
        this.applySanitization(obj[key] as Record<string, unknown>, original, sanitized);
      }
    }
  }

  /**
   * Sanitize value for logging (remove sensitive content)
   */
  private sanitizeLogValue(value: string): string {
    // Truncate long values
    if (value.length > 200) {
      return value.substring(0, 200) + '...';
    }

    // Escape potentially dangerous characters for logging
    return value
      .replace(/</g, '&lt;')
      .replace(/>/g, '&gt;')
      .replace(/"/g, '&quot;')
      .replace(/'/g, '&#x27;');
  }

  /**
   * Add custom pattern to detection
   */
  addCustomPattern(pattern: RegExp): void {
    this.patterns.push(pattern);

    this.logger?.logSecurityEvent({}, {
      timestamp: new Date().toISOString(),
      eventType: 'SECURITY_CHECK_PASSED',
      severity: 'LOW',
      metadata: {
        component: 'XssDetector',
        action: 'CUSTOM_PATTERN_ADDED',
        pattern: pattern.toString()
      }
    });
  }

  /**
   * Add allowed tag
   */
  addAllowedTag(tag: string): void {
    this.allowedTags.add(tag.toLowerCase());
  }

  /**
   * Add allowed attribute
   */
  addAllowedAttribute(attribute: string): void {
    this.allowedAttributes.add(attribute.toLowerCase());
  }

  /**
   * Get detection statistics
   */
  getStats(): Record<string, unknown> {
    return {
      patternsCount: this.patterns.length,
      allowedTagsCount: this.allowedTags.size,
      allowedAttributesCount: this.allowedAttributes.size,
      strictMode: this.config?.strictMode ?? false,
      sanitizeInput: this.config?.sanitizeInput ?? false
    };
  }

  /**
   * Update configuration
   */
  updateConfig(config: Partial<XssConfig>): void {
    this.config = {...this.config, ...config};

    // Rebuild patterns if custom patterns changed
    if (config.customPatterns) {
      this.patterns = [
        ...this.defaultPatterns,
        ...config.customPatterns
      ];
    }

    // Update allowed tags and attributes
    if (config.allowedTags) {
      this.allowedTags = new Set(config.allowedTags.map(tag => tag.toLowerCase()));
    }

    if (config.allowedAttributes) {
      this.allowedAttributes = new Set(config.allowedAttributes.map(attr => attr.toLowerCase()));
    }
  }
}