/**
 * @fileoverview Malware Detection Constants
 * @module rules/malware/constants
 * 
 * Central repository for all constants used in malware detection.
 */

import { MalwareSeverity, ConfidenceLevel, MitreTactic } from '../types';

// ============================================================================
// SCORING THRESHOLDS
// ============================================================================

/**
 * Score thresholds for severity calculation
 */
export const SCORE_THRESHOLDS = {
  CRITICAL: 85,
  HIGH: 65,
  MEDIUM: 40,
  LOW: 20,
  INFO: 0
} as const;

/**
 * Risk level thresholds
 */
export const RISK_LEVELS = {
  CRITICAL: { min: 85, label: 'critical' as const },
  HIGH: { min: 65, label: 'high' as const },
  MEDIUM: { min: 40, label: 'medium' as const },
  LOW: { min: 20, label: 'low' as const },
  MINIMAL: { min: 0, label: 'minimal' as const }
} as const;

/**
 * Default scoring weights
 */
export const DEFAULT_SCORING_WEIGHTS = {
  patternCount: 0.25,
  obfuscation: 0.20,
  networkAccess: 0.15,
  commandExecution: 0.15,
  persistence: 0.15,
  dataAccess: 0.10
} as const;

// ============================================================================
// ENTROPY THRESHOLDS
// ============================================================================

/**
 * Entropy thresholds for obfuscation detection
 */
export const ENTROPY_THRESHOLDS = {
  NORMAL: 4.5,           // Normal code
  SUSPICIOUS: 5.5,       // Potentially obfuscated
  HIGH_OBFUSCATION: 6.5, // Likely obfuscated
  BINARY_DATA: 7.5       // Embedded binary/encrypted data
} as const;

// ============================================================================
// PERFORMANCE LIMITS
// ============================================================================

/**
 * Performance and safety limits
 */
export const LIMITS = {
  /** Maximum execution time for a single regex in ms */
  REGEX_TIMEOUT: 1000,
  /** Maximum execution time for a single rule in ms */
  RULE_TIMEOUT: 5000,
  /** Maximum execution time for a single file in ms */
  FILE_TIMEOUT: 30000,
  /** Maximum matches per pattern before stopping */
  MAX_MATCHES_PER_PATTERN: 100,
  /** Maximum findings per file */
  MAX_FINDINGS_PER_FILE: 500,
  /** Maximum file size to analyze in bytes */
  MAX_FILE_SIZE: 10 * 1024 * 1024, // 10MB
  /** Maximum pattern matches to store for a finding */
  MAX_PATTERN_MATCHES_PER_FINDING: 50,
  /** Maximum code snippet length */
  MAX_SNIPPET_LENGTH: 500,
  /** Lines of context before/after match */
  CONTEXT_LINES: 3
} as const;

// ============================================================================
// OBFUSCATION INDICATORS
// ============================================================================

/**
 * Common obfuscation patterns and their weights
 */
export const OBFUSCATION_INDICATORS = {
  /** Hex escape sequences */
  HEX_ESCAPES: { pattern: /\\x[0-9a-f]{2}/gi, weight: 0.1 },
  /** Unicode escape sequences */
  UNICODE_ESCAPES: { pattern: /\\u[0-9a-f]{4}/gi, weight: 0.1 },
  /** Long base64 strings */
  BASE64_STRINGS: { pattern: /[A-Za-z0-9+/]{50,}={0,2}/g, weight: 0.15 },
  /** String concatenation obfuscation */
  STRING_CONCAT: { pattern: /['"][a-z]['"](?:\s*\+\s*['"][a-z]['"]){3,}/gi, weight: 0.2 },
  /** Array access obfuscation */
  ARRAY_ACCESS: { pattern: /\[['"]\w+['"]\]/g, weight: 0.05 },
  /** Obfuscator variable names */
  OBFUSCATOR_VARS: { pattern: /_0x[a-f0-9]{4,}/gi, weight: 0.3 },
  /** JSFuck-style obfuscation */
  JSFUCK: { pattern: /\[\]!+/g, weight: 0.4 },
  /** Long single-line functions */
  LONG_LINES: { threshold: 500, weight: 0.1 },
  /** High character diversity */
  CHAR_DIVERSITY: { threshold: 0.7, weight: 0.15 }
} as const;

// ============================================================================
// SUSPICIOUS DOMAINS & IPS
// ============================================================================

/**
 * Known malicious TLDs
 */
export const SUSPICIOUS_TLDS = [
  '.onion',
  '.bit',
  '.i2p',
  '.bazar',
  '.coin',
  '.lib',
  '.emc'
] as const;

/**
 * Known malicious hosting services
 */
export const SUSPICIOUS_HOSTS = [
  'pastebin.com',
  'hastebin.com',
  'ghostbin.com',
  'rentry.co',
  'dpaste.org',
  'ngrok.io',
  'serveo.net',
  'localhost.run',
  'localtunnel.me',
  'webhook.site',
  'requestbin.com',
  'pipedream.com'
] as const;

/**
 * Private IP ranges (for reverse shell detection)
 */
export const PRIVATE_IP_RANGES = [
  /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/,
  /^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}$/,
  /^192\.168\.\d{1,3}\.\d{1,3}$/,
  /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
] as const;

// ============================================================================
// MINING INDICATORS
// ============================================================================

/**
 * Known cryptomining pools and software
 */
export const CRYPTO_INDICATORS = {
  POOLS: [
    'pool.minergate.com',
    'xmr.pool.minergate.com',
    'pool.supportxmr.com',
    'xmr-eu1.nanopool.org',
    'monerohash.com',
    'minexmr.com',
    'pool.hashvault.pro',
    'gulf.moneroocean.stream'
  ],
  SOFTWARE: [
    'coinhive',
    'cryptoloot',
    'coin-hive',
    'coinimp',
    'cryptonight',
    'xmrig',
    'xmr-stak',
    'minerd',
    'cgminer',
    'bfgminer'
  ],
  ALGORITHMS: [
    'CryptoNight',
    'RandomX',
    'Ethash',
    'Scrypt',
    'SHA256d'
  ],
  PROTOCOLS: [
    'stratum+tcp://',
    'stratum+ssl://',
    'stratum2+tcp://'
  ]
} as const;

// ============================================================================
// SHELL COMMANDS
// ============================================================================

/**
 * Dangerous shell commands
 */
export const DANGEROUS_COMMANDS = {
  SHELLS: ['/bin/bash', '/bin/sh', '/bin/zsh', 'cmd.exe', 'powershell.exe'],
  NETCAT: ['nc', 'ncat', 'netcat', 'socat'],
  DOWNLOADERS: ['curl', 'wget', 'Invoke-WebRequest', 'certutil'],
  EXECUTION: ['exec', 'eval', 'spawn', 'fork', 'CreateProcess']
} as const;

// ============================================================================
// FILE PATTERNS
// ============================================================================

/**
 * File patterns to ignore
 */
export const IGNORE_PATTERNS = {
  VENDOR: [
    /node_modules\//,
    /vendor\//,
    /bower_components\//,
    /\.bundle\//,
    /packages\//
  ],
  BUILD: [
    /dist\//,
    /build\//,
    /out\//,
    /\.next\//,
    /\.nuxt\//
  ],
  TEST: [
    /\.test\.[jt]sx?$/,
    /\.spec\.[jt]sx?$/,
    /__tests__\//,
    /test\//,
    /tests\//
  ],
  GENERATED: [
    /\.min\.[jt]s$/,
    /\.bundle\.[jt]s$/,
    /\.generated\./
  ]
} as const;

// ============================================================================
// SEVERITY MAPPING
// ============================================================================

/**
 * Map threat types to default severities
 */
export const THREAT_SEVERITY_MAP: Record<string, MalwareSeverity> = {
  reverse_shell: MalwareSeverity.CRITICAL,
  web_shell: MalwareSeverity.CRITICAL,
  backdoor: MalwareSeverity.CRITICAL,
  remote_access_trojan: MalwareSeverity.CRITICAL,
  keylogger: MalwareSeverity.CRITICAL,
  credential_stealer: MalwareSeverity.CRITICAL,
  token_stealer: MalwareSeverity.HIGH,
  data_exfiltration: MalwareSeverity.CRITICAL,
  cryptominer: MalwareSeverity.HIGH,
  dropper: MalwareSeverity.HIGH,
  loader: MalwareSeverity.HIGH,
  obfuscated_code: MalwareSeverity.MEDIUM,
  c2_communication: MalwareSeverity.HIGH,
  persistence: MalwareSeverity.HIGH,
  fileless: MalwareSeverity.HIGH,
  supply_chain: MalwareSeverity.CRITICAL,
  suspicious_network: MalwareSeverity.MEDIUM
};

/**
 * Confidence boost based on pattern count
 */
export const PATTERN_COUNT_CONFIDENCE_BOOST: Record<number, ConfidenceLevel> = {
  1: ConfidenceLevel.LOW,
  2: ConfidenceLevel.MEDIUM,
  3: ConfidenceLevel.HIGH,
  5: ConfidenceLevel.CONFIRMED
};

// ============================================================================
// MITRE ATT&CK MAPPINGS
// ============================================================================

/**
 * Common MITRE ATT&CK technique mappings
 */
export const MITRE_TECHNIQUES = {
  // Execution
  COMMAND_LINE: { id: 'T1059', name: 'Command and Scripting Interpreter', tactic: MitreTactic.EXECUTION },
  JAVASCRIPT: { id: 'T1059.007', name: 'JavaScript', tactic: MitreTactic.EXECUTION },
  PYTHON: { id: 'T1059.006', name: 'Python', tactic: MitreTactic.EXECUTION },
  POWERSHELL: { id: 'T1059.001', name: 'PowerShell', tactic: MitreTactic.EXECUTION },
  
  // Persistence
  WEB_SHELL: { id: 'T1505.003', name: 'Web Shell', tactic: MitreTactic.PERSISTENCE },
  SCHEDULED_TASK: { id: 'T1053', name: 'Scheduled Task/Job', tactic: MitreTactic.PERSISTENCE },
  
  // Credential Access
  KEYLOGGING: { id: 'T1056.001', name: 'Keylogging', tactic: MitreTactic.CREDENTIAL_ACCESS },
  CREDENTIAL_DUMPING: { id: 'T1003', name: 'OS Credential Dumping', tactic: MitreTactic.CREDENTIAL_ACCESS },
  
  // Defense Evasion
  OBFUSCATION: { id: 'T1027', name: 'Obfuscated Files or Information', tactic: MitreTactic.DEFENSE_EVASION },
  DEOBFUSCATE: { id: 'T1140', name: 'Deobfuscate/Decode Files or Information', tactic: MitreTactic.DEFENSE_EVASION },
  
  // Command and Control
  APP_LAYER: { id: 'T1071', name: 'Application Layer Protocol', tactic: MitreTactic.COMMAND_AND_CONTROL },
  INGRESS_TOOL: { id: 'T1105', name: 'Ingress Tool Transfer', tactic: MitreTactic.COMMAND_AND_CONTROL },
  
  // Exfiltration
  EXFIL_WEB: { id: 'T1041', name: 'Exfiltration Over C2 Channel', tactic: MitreTactic.EXFILTRATION },
  
  // Impact
  RESOURCE_HIJACKING: { id: 'T1496', name: 'Resource Hijacking', tactic: MitreTactic.IMPACT }
} as const;

// ============================================================================
// LANGUAGE SPECIFIC PATTERNS
// ============================================================================

/**
 * Language-specific dangerous function patterns
 */
export const DANGEROUS_FUNCTIONS = {
  javascript: ['eval', 'Function', 'setTimeout', 'setInterval', 'execScript'],
  typescript: ['eval', 'Function', 'setTimeout', 'setInterval'],
  python: ['eval', 'exec', 'compile', '__import__', 'execfile'],
  php: ['eval', 'exec', 'system', 'passthru', 'shell_exec', 'popen', 'proc_open', 'assert', 'preg_replace'],
  ruby: ['eval', 'exec', 'system', '`', 'spawn', 'Open3'],
  csharp: ['Process.Start', 'Assembly.Load', 'Activator.CreateInstance'],
  java: ['Runtime.exec', 'ProcessBuilder', 'ScriptEngine.eval']
} as const;

/**
 * Language-specific network functions
 */
export const NETWORK_FUNCTIONS = {
  javascript: ['fetch', 'XMLHttpRequest', 'axios', 'request', 'http.get', 'https.get'],
  typescript: ['fetch', 'XMLHttpRequest', 'axios', 'request', 'http.get', 'https.get'],
  python: ['urllib', 'requests', 'httplib', 'socket', 'http.client'],
  php: ['file_get_contents', 'curl_exec', 'fopen', 'fsockopen'],
  csharp: ['HttpClient', 'WebRequest', 'WebClient', 'TcpClient'],
  java: ['HttpURLConnection', 'URLConnection', 'Socket', 'HttpClient']
} as const;