/**
 * @fileoverview Malware Rule Engine - Core Detection Engine
 * @module rules/malware/engine
 * 
 * Orchestrates malware detection across all rule categories:
 * - Multi-pattern matching with timeout protection
 * - AST-aware analysis
 * - Dynamic scoring
 * - Rule correlation
 * - Finding aggregation and deduplication
 * - Concurrent execution with limits
 */

import {
  MalwareRule,
  MalwareFinding,
  MalwarePattern,
  MalwareScore,
  MalwareScoreBreakdown,
  AnalysisContext,
  AnalysisOptions,
  IMalwareRuleEngine,
  IPatternMatcher,
  PatternMatch,
  PatternType,
  MalwareSeverity,
  ConfidenceLevel,
  SourceLocation,
  SupportedLanguage,
  RegexPattern,
  MalwareCategory,
  MalwareThreatType
} from '../types';

import {
  calculateEntropy,
  normalizeCode,
  detectObfuscationLevel,
  safeRegexMatch,
  extractSnippet
} from '../utils';

import { MalwareScoreCalculator } from '../scoring';

import {
  LIMITS,
  ENTROPY_THRESHOLDS
} from '../constants';

// ============================================================================
// PATTERN MATCHER IMPLEMENTATION
// ============================================================================

export class PatternMatcher implements IPatternMatcher {
  private timeoutMs: number;
  private maxMatches: number;

  constructor(options?: { timeoutMs?: number; maxMatches?: number }) {
    this.timeoutMs = options?.timeoutMs ?? LIMITS.REGEX_TIMEOUT;
    this.maxMatches = options?.maxMatches ?? LIMITS.MAX_MATCHES_PER_PATTERN;
  }

  /**
   * Match patterns against content (implements IPatternMatcher)
   */
  match(
    content: string,
    patterns: MalwarePattern[],
    language: SupportedLanguage
  ): PatternMatch[] {
    const allMatches: PatternMatch[] = [];
    
    for (const pattern of patterns) {
      const matches = this.matchSinglePattern(pattern, content, language);
      allMatches.push(...matches);
    }
    
    return allMatches;
  }

  /**
   * Match with timeout protection (implements IPatternMatcher)
   */
  async matchWithTimeout(
    content: string,
    patterns: MalwarePattern[],
    language: SupportedLanguage,
    timeout: number
  ): Promise<PatternMatch[]> {
    return new Promise((resolve) => {
      const timeoutId = setTimeout(() => {
        resolve([]);
      }, timeout);

      try {
        const results = this.match(content, patterns, language);
        clearTimeout(timeoutId);
        resolve(results);
      } catch {
        clearTimeout(timeoutId);
        resolve([]);
      }
    });
  }

  /**
   * Match a single pattern against code
   */
  matchSinglePattern(
    pattern: MalwarePattern,
    code: string,
    language: SupportedLanguage
  ): PatternMatch[] {
    try {
      switch (pattern.type) {
        case PatternType.REGEX:
          return this.matchRegexPattern(pattern as RegexPattern, code);
        
        case PatternType.LITERAL:
          return this.matchLiteralPattern(pattern, code);
        
        case PatternType.AST:
          return [];
        
        case PatternType.HEURISTIC:
          return this.matchHeuristicPattern(pattern, code, language);
        
        case PatternType.SEMANTIC:
          return [];
        
        default:
          return [];
      }
    } catch (error) {
      console.error(`Pattern matching error for ${pattern.patternId}:`, error);
      return [];
    }
  }

  /**
   * Match regex pattern with timeout protection
   */
  private matchRegexPattern(
    pattern: RegexPattern,
    code: string
  ): PatternMatch[] {
    // Use the safeRegexMatch utility with the correct signature
    return safeRegexMatch(code, pattern);
  }

  /**
   * Match literal string pattern
   */
  private matchLiteralPattern(
    pattern: MalwarePattern,
    code: string
  ): PatternMatch[] {
    const matches: PatternMatch[] = [];
    
    if (pattern.type !== PatternType.LITERAL) return matches;
    
    const literalPattern = pattern as { type: PatternType.LITERAL; value: string };
    const searchString = literalPattern.value || '';
    let index = 0;

    while (index < code.length && matches.length < this.maxMatches) {
      index = code.indexOf(searchString, index);
      if (index === -1) break;

      const line = this.getLineNumber(code, index);

      matches.push({
        pattern,
        matchedText: searchString,
        location: {
          filePath: '',
          startLine: line,
          endLine: line,
          startColumn: index - code.lastIndexOf('\n', index),
          endColumn: index - code.lastIndexOf('\n', index) + searchString.length
        }
      });

      index += searchString.length;
    }

    return matches;
  }

  /**
   * Match heuristic pattern using entropy and obfuscation analysis
   */
  private matchHeuristicPattern(
    pattern: MalwarePattern,
    code: string,
    language: SupportedLanguage
  ): PatternMatch[] {
    const matches: PatternMatch[] = [];

    const entropy = calculateEntropy(code);
    const obfuscationLevel = detectObfuscationLevel(code, language);

    const heuristicPattern = pattern as { type: PatternType.HEURISTIC; heuristicName: string };

    if (heuristicPattern.heuristicName === 'entropy') {
      if (entropy > ENTROPY_THRESHOLDS.HIGH_OBFUSCATION) {
        matches.push({
          pattern,
          matchedText: `High entropy: ${entropy.toFixed(2)}`,
          location: {
            filePath: '',
            startLine: 1,
            endLine: 1,
            startColumn: 0,
            endColumn: 100
          }
        });
      }
    }

    if (heuristicPattern.heuristicName === 'obfuscation') {
      if (obfuscationLevel > 0.7) {
        matches.push({
          pattern,
          matchedText: `High obfuscation level: ${obfuscationLevel.toFixed(2)}`,
          location: {
            filePath: '',
            startLine: 1,
            endLine: 1,
            startColumn: 0,
            endColumn: 100
          }
        });
      }
    }

    return matches;
  }

  /**
   * Get line number from character index
   */
  private getLineNumber(code: string, index: number): number {
    return code.substring(0, index).split('\n').length;
  }
}

// ============================================================================
// MALWARE RULE ENGINE IMPLEMENTATION
// ============================================================================

export interface EngineOptions {
  enableHeuristics: boolean;
  enableAstAnalysis: boolean;
  timeoutMs: number;
  maxFindings: number;
  minConfidence: number;
  language?: SupportedLanguage;
}

export class MalwareRuleEngine implements IMalwareRuleEngine {
  private rules: Map<string, MalwareRule>;
  private patternMatcher: PatternMatcher;
  private scoreCalculator: MalwareScoreCalculator;
  private engineOptions: EngineOptions;

  constructor(
    rules: MalwareRule[],
    options?: Partial<EngineOptions>
  ) {
    this.rules = new Map(rules.map(rule => [rule.id, rule]));
    this.patternMatcher = new PatternMatcher();
    this.scoreCalculator = new MalwareScoreCalculator();
    this.engineOptions = {
      enableHeuristics: options?.enableHeuristics ?? true,
      enableAstAnalysis: options?.enableAstAnalysis ?? true,
      timeoutMs: options?.timeoutMs ?? LIMITS.RULE_TIMEOUT,
      maxFindings: options?.maxFindings ?? LIMITS.MAX_FINDINGS_PER_FILE,
      minConfidence: options?.minConfidence ?? 0.3,
      language: options?.language
    };
  }

  /**
   * Analyze code against all enabled rules (implements IMalwareRuleEngine)
   */
  async analyze(
    context: AnalysisContext,
    options?: AnalysisOptions
  ): Promise<MalwareFinding[]> {
    const code = context.content;
    const language = context.language ?? this.engineOptions.language ?? SupportedLanguage.JAVASCRIPT;

    const findings: MalwareFinding[] = [];
    const enabledRules = this.getEnabledRules(language);

    const normalizedCode = normalizeCode(code, language);

    for (const rule of enabledRules) {
      try {
        const ruleFinding = await this.analyzeWithRule(
          rule,
          code,
          normalizedCode,
          context
        );

        if (ruleFinding) {
          findings.push(ruleFinding);
        }

        if (findings.length >= this.engineOptions.maxFindings) {
          break;
        }
      } catch (error) {
        console.error(`Error analyzing rule ${rule.id}:`, error);
      }
    }

    findings.sort((a, b) => b.malwareScore.score - a.malwareScore.score);

    return findings;
  }

  /**
   * Convenience method to analyze code string directly
   */
  async analyzeCode(
    code: string,
    contextOptions?: Partial<{ filePath: string; language?: string }>
  ): Promise<MalwareFinding[]> {
    const language = (contextOptions?.language as SupportedLanguage) ?? 
      this.engineOptions.language ?? 
      SupportedLanguage.JAVASCRIPT;

    const context: AnalysisContext = {
      filePath: contextOptions?.filePath ?? 'unknown',
      content: code,
      language
    };

    return this.analyze(context);
  }

  /**
   * Get all rules (implements IMalwareRuleEngine)
   */
  getRules(): MalwareRule[] {
    return Array.from(this.rules.values());
  }

  /**
   * Get rules by category (implements IMalwareRuleEngine)
   */
  getRulesByCategory(category: MalwareCategory): MalwareRule[] {
    return this.getRules().filter(r => r.category === category);
  }

  /**
   * Get rules by threat type (implements IMalwareRuleEngine)
   */
  getRulesByThreatType(type: MalwareThreatType): MalwareRule[] {
    return this.getRules().filter(r => r.threatType === type);
  }

  /**
   * Enable/disable a rule (implements IMalwareRuleEngine)
   */
  setRuleEnabled(ruleId: string, enabled: boolean): void {
    const rule = this.rules.get(ruleId);
    if (rule) {
      rule.enabled = enabled;
    }
  }

  /**
   * Add a rule (implements IMalwareRuleEngine)
   */
  addRule(rule: MalwareRule): void {
    this.rules.set(rule.id, rule);
  }

  /**
   * Remove a rule (implements IMalwareRuleEngine)
   */
  removeRule(ruleId: string): void {
    this.rules.delete(ruleId);
  }

  /**
   * Get enabled rules, optionally filtered by language
   */
  private getEnabledRules(language?: SupportedLanguage): MalwareRule[] {
    let rules = Array.from(this.rules.values()).filter(r => r.enabled);

    if (language) {
      rules = rules.filter(r => 
        r.languages.length === 0 || r.languages.includes(language)
      );
    }

    return rules;
  }

  /**
   * Analyze code with a specific rule
   */
  private async analyzeWithRule(
    rule: MalwareRule,
    originalCode: string,
    normalizedCode: string,
    context: AnalysisContext
  ): Promise<MalwareFinding | null> {
    const primaryMatches = await this.patternMatcher.matchWithTimeout(
      normalizedCode,
      rule.patterns,
      context.language,
      this.engineOptions.timeoutMs
    );

    if (primaryMatches.length === 0) {
      return null;
    }

    for (const match of primaryMatches) {
      match.location.filePath = context.filePath;
    }

    if (rule.falsePositivePatterns) {
      const fpMatches = await this.patternMatcher.matchWithTimeout(
        normalizedCode,
        rule.falsePositivePatterns,
        context.language,
        this.engineOptions.timeoutMs
      );

      if (this.calculateConfidence(fpMatches) > 0.6) {
        return null;
      }
    }

    let amplifyingMatches: PatternMatch[] = [];
    if (rule.amplifyingPatterns) {
      amplifyingMatches = await this.patternMatcher.matchWithTimeout(
        normalizedCode,
        rule.amplifyingPatterns,
        context.language,
        this.engineOptions.timeoutMs
      );

      for (const match of amplifyingMatches) {
        match.location.filePath = context.filePath;
      }
    }

    const allMatches = [...primaryMatches, ...amplifyingMatches];
    const primaryConfidence = this.calculateConfidence(primaryMatches);
    const amplifyingConfidence = this.calculateConfidence(amplifyingMatches);
    const overallConfidence = Math.min(1.0, primaryConfidence + amplifyingConfidence * 0.3);

    if (overallConfidence < this.engineOptions.minConfidence) {
      return null;
    }

    const score = this.calculateMalwareScore(rule, allMatches, originalCode, context.language);

    const firstMatch = primaryMatches[0];
    const codeSnippet = extractSnippet(
      originalCode,
      firstMatch.location,
      LIMITS.MAX_SNIPPET_LENGTH
    );

    const finding: MalwareFinding = {
      id: `${rule.id}-${Date.now()}`,
      ruleId: rule.id,
      ruleName: rule.name,
      location: firstMatch.location,
      codeSnippet,
      threatType: rule.threatType,
      category: rule.category,
      severity: rule.severity,
      confidence: this.mapConfidenceToLevel(overallConfidence),
      malwareScore: score,
      patternMatches: allMatches.slice(0, LIMITS.MAX_PATTERN_MATCHES_PER_FINDING),
      message: rule.description,
      analysis: this.generateAnalysis(rule, allMatches, score),
      remediation: rule.remediation,
      mitreAttack: rule.mitreAttack,
      cves: rule.cves,
      detectedAt: new Date().toISOString(),
      language: context.language
    };

    return finding;
  }

  /**
   * Calculate malware score for a finding
   */
  private calculateMalwareScore(
    rule: MalwareRule,
    matches: PatternMatch[],
    code: string,
    language: SupportedLanguage
  ): MalwareScore {
    const baseScore = rule.baseScore ?? 50;
    const patternScore = Math.min(20, matches.length * 5);
    const obfuscationScore = detectObfuscationLevel(code, language) * 15;
    const entropyBonus = Math.max(0, Math.min(10, (calculateEntropy(code) - 4.5) * 5));

    const totalScore = Math.min(100, Math.max(0, 
      baseScore + patternScore + obfuscationScore + entropyBonus
    ));

    const breakdown: MalwareScoreBreakdown = {
      baseScore,
      patternScore,
      obfuscationScore,
      networkScore: 0,
      executionScore: 0,
      persistenceScore: 0,
      correlationScore: 0,
      falsePositivePenalty: 0,
      totalScore
    };

    return {
      score: totalScore,
      breakdown,
      calculatedSeverity: this.scoreToSeverity(totalScore),
      riskLevel: this.scoreToRiskLevel(totalScore),
      explanation: this.generateScoreExplanation(breakdown)
    };
  }

  /**
   * Get character index from source location
   */
  private getIndexFromLocation(code: string, location: SourceLocation): number {
    const lines = code.split('\n');
    let index = 0;
    for (let i = 0; i < location.startLine - 1 && i < lines.length; i++) {
      index += lines[i].length + 1;
    }
    return index + (location.startColumn ?? 0);
  }

  /**
   * Calculate overall confidence from pattern matches
   */
  private calculateConfidence(matches: PatternMatch[]): number {
    if (matches.length === 0) return 0;

    const avgWeight = matches.reduce((sum, m) => {
      const weight = m.pattern.weight ?? 1.0;
      return sum + weight;
    }, 0) / matches.length;

    const countBonus = Math.min(0.2, matches.length * 0.05);

    return Math.min(1.0, avgWeight + countBonus);
  }

  /**
   * Map numeric confidence to ConfidenceLevel
   */
  private mapConfidenceToLevel(confidence: number): ConfidenceLevel {
    if (confidence >= 0.95) return ConfidenceLevel.CONFIRMED;
    if (confidence >= 0.80) return ConfidenceLevel.HIGH;
    if (confidence >= 0.60) return ConfidenceLevel.MEDIUM;
    if (confidence >= 0.40) return ConfidenceLevel.LOW;
    return ConfidenceLevel.TENTATIVE;
  }

  /**
   * Convert score to severity level
   */
  private scoreToSeverity(score: number): MalwareSeverity {
    if (score >= 85) return MalwareSeverity.CRITICAL;
    if (score >= 65) return MalwareSeverity.HIGH;
    if (score >= 40) return MalwareSeverity.MEDIUM;
    if (score >= 20) return MalwareSeverity.LOW;
    return MalwareSeverity.INFO;
  }

  /**
   * Convert score to risk level
   */
  private scoreToRiskLevel(score: number): 'critical' | 'high' | 'medium' | 'low' | 'minimal' {
    if (score >= 85) return 'critical';
    if (score >= 65) return 'high';
    if (score >= 40) return 'medium';
    if (score >= 20) return 'low';
    return 'minimal';
  }

  /**
   * Generate score explanation
   */
  private generateScoreExplanation(breakdown: MalwareScoreBreakdown): string {
    const parts: string[] = [];
    parts.push(`Base score: ${breakdown.baseScore}`);
    if (breakdown.patternScore > 0) parts.push(`Pattern matches: +${breakdown.patternScore}`);
    if (breakdown.obfuscationScore > 0) parts.push(`Obfuscation: +${breakdown.obfuscationScore.toFixed(1)}`);
    parts.push(`Total: ${breakdown.totalScore}`);
    return parts.join(', ');
  }

  /**
   * Generate analysis explanation for a finding
   */
  private generateAnalysis(
    rule: MalwareRule,
    matches: PatternMatch[],
    score: MalwareScore
  ): string {
    const parts: string[] = [
      `Rule "${rule.name}" triggered with ${matches.length} pattern match(es).`,
      `Malware score: ${score.score}/100 (${score.riskLevel} risk).`,
      `Threat type: ${rule.threatType}.`,
      `Category: ${rule.category}.`
    ];

    if (rule.mitreAttack && rule.mitreAttack.length > 0) {
      const techniques = rule.mitreAttack.map(m => m.techniqueName).join(', ');
      parts.push(`MITRE ATT&CK: ${techniques}.`);
    }

    return parts.join(' ');
  }

  /**
   * Get all rules
   */
  getAllRules(): MalwareRule[] {
    return Array.from(this.rules.values());
  }

  /**
   * Get enabled rule count
   */
  getEnabledRuleCount(): number {
    return this.getAllRules().filter(r => r.enabled).length;
  }

  /**
   * Analyze multiple files concurrently
   */
  async analyzeFiles(
    files: Array<{ path: string; code: string; language?: string }>
  ): Promise<Map<string, MalwareFinding[]>> {
    const results = new Map<string, MalwareFinding[]>();

    const concurrencyLimit = 5;
    for (let i = 0; i < files.length; i += concurrencyLimit) {
      const batch = files.slice(i, i + concurrencyLimit);
      const batchResults = await Promise.all(
        batch.map(async file => {
          const findings = await this.analyzeCode(file.code, {
            filePath: file.path,
            language: file.language
          });
          return { path: file.path, findings };
        })
      );

      for (const { path, findings } of batchResults) {
        results.set(path, findings);
      }
    }

    return results;
  }

  /**
   * Generate analysis summary
   */
  generateSummary(findings: MalwareFinding[]): {
    totalFindings: number;
    bySeverity: Record<MalwareSeverity, number>;
    byThreatType: Record<string, number>;
    highestScore: number;
    criticalCount: number;
  } {
    const summary = {
      totalFindings: findings.length,
      bySeverity: {
        [MalwareSeverity.CRITICAL]: 0,
        [MalwareSeverity.HIGH]: 0,
        [MalwareSeverity.MEDIUM]: 0,
        [MalwareSeverity.LOW]: 0,
        [MalwareSeverity.INFO]: 0
      },
      byThreatType: {} as Record<string, number>,
      highestScore: 0,
      criticalCount: 0
    };

    for (const finding of findings) {
      summary.bySeverity[finding.severity]++;
      summary.byThreatType[finding.threatType] = 
        (summary.byThreatType[finding.threatType] || 0) + 1;
      
      if (finding.malwareScore.score > summary.highestScore) {
        summary.highestScore = finding.malwareScore.score;
      }

      if (finding.severity === MalwareSeverity.CRITICAL) {
        summary.criticalCount++;
      }
    }

    return summary;
  }
}

// ============================================================================
// HELPER FUNCTIONS
// ============================================================================

/**
 * Create a rule engine with all default rules
 */
export function createDefaultEngine(options?: Partial<EngineOptions>): MalwareRuleEngine {
  return new MalwareRuleEngine([], options);
}

/**
 * Quick scan function for simple use cases
 */
export async function quickScan(
  code: string,
  language?: string
): Promise<{
  isMalicious: boolean;
  score: number;
  findings: MalwareFinding[];
}> {
  const engine = createDefaultEngine();
  const context: AnalysisContext = {
    filePath: 'scan',
    content: code,
    language: (language as SupportedLanguage) ?? SupportedLanguage.JAVASCRIPT
  };
  
  const findings = await engine.analyze(context);
  
  const maxScore = findings.length > 0 
    ? Math.max(...findings.map(f => f.malwareScore.score))
    : 0;

  return {
    isMalicious: maxScore >= 65,
    score: maxScore,
    findings
  };
}