# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

require 'contrast/agent/reporting/input_analysis/input_type'
require 'contrast/agent/reporting/input_analysis/score_level'

module Contrast
  module Agent
    module Protect
      module Rule
        module InputClassification
          # Module holding the overwritable methods for input classification. This is used by the
          # Protect rules to define their own input classification logic. To be Used input_types,
          # score_level, AgentLib, and InputAnalysisResult must be required.
          module Extendable
            THRESHOLD = 90.cs__freeze
            WORTHWATCHING_THRESHOLD = 10.cs__freeze
            include Contrast::Agent::Reporting::InputType
            include Contrast::Agent::Reporting::ScoreLevel

            ################################################################
            # Methods to be overwritten for each individual Protect rule. #
            ##############################################################

            # Creates new instance of AgentLib evaluation result with direct call to AgentLib.
            #
            # @param rule_id [String] The name of the Protect Rule.
            # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
            # @param value [String] the value of the input.
            # @return [Contrast::AgentLib::EvalResult, nil] the result of the input evaluation.
            def build_input_eval rule_id, input_type, value
              Contrast::AGENT_LIB.eval_input(value,
                                             Contrast::Agent::Protect::Rule::InputClassification::Base.
                                                convert_input_type(input_type),
                                             Contrast::AGENT_LIB.rule_set[rule_id],
                                             Contrast::AGENT_LIB.eval_option[:PREFER_WORTH_WATCHING])
            end

            # Creates specific result from the AgentLib evaluation.
            #
            # @param rule_id [String] The name of the Protect Rule.
            # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
            # @param value [String the value of the input.
            # @param request [Contrast::Agent::Request] the current request context.
            # @param input_eval [Contrast::AgentLib::EvalResult] the result of the input evaluation.
            # @return [Contrast::Agent::Reporting::InputAnalysisResult, nil] the result of the input analysis.
            def build_ia_result rule_id, input_type, value, request, input_eval
              ia_result = new_ia_result(rule_id, input_type, request.path, value)
              score = input_eval&.score || 0
              if score >= WORTHWATCHING_THRESHOLD
                ia_result.score_level = WORTHWATCHING
                ia_result.ids << self::WORTHWATCHING_MATCH
              else
                ia_result.score_level = IGNORE
              end
              ia_result
            end

            # Creates new isntance of InputAnalysisResult with basic info.
            #
            # @param rule_id [String] The name of the Protect Rule.
            # @param input_type [Contrast::Agent::Reporting::InputType] The type of the user input.
            # @param value [String, Array<String>] the value of the input.
            # @param path [String] the path of the current request context.
            #
            # @return res [Contrast::Agent::Reporting::InputAnalysisResult]
            def new_ia_result rule_id, input_type, path, value = nil
              res = Contrast::Agent::Reporting::InputAnalysisResult.new
              res.rule_id = rule_id
              res.input_type = input_type
              res.path = path
              res.value = value
              res
            end
          end
        end
      end
    end
  end
end