# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

require 'digest'
require 'contrast/utils/hash_digest_extend'

module Contrast
  module Utils
    # We use this class to provide hashes for our Request and Finding objects
    # based upon our definitions of uniqueness.
    # While the uniqueness of the request object is something internal to the
    # Ruby agent, the uniqueness of the Finding hash is defined by a
    # specification shared across all agent teams. The spec can be found here:
    # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
    class HashDigest < Digest::Class
      include Digest::Instance
      extend Contrast::Utils::HashDigestExtend
      CHARS = %w[a b c d e f g].cs__freeze
      CRYPTO_RULES = %w[crypto-bad-ciphers crypto-bad-mac].cs__freeze
      CONFIG_PATH_KEY = 'path'
      CONFIG_SESSION_ID_KEY = 'sessionId'
      CLASS_SOURCE_KEY = 'source'
      CLASS_CONSTANT_NAME_KEY = 'name'
      CLASS_LINE_NO_KEY = 'lineNo'

      def initialize
        super
        @crc32 = 0
      end

      # Update to CRC checksum the finding route and verb if finding route is available, else update the passed
      # request or Contrast::REQUEST_TRACKER.current.request uri and used request method.
      #
      # @param finding [Contrast::Agent::Reporting::Finding] finding to be reported
      # @param request [Contrast::Agent::Request] our wrapper around the Rack::Request.
      def update_on_request finding, request
        context = Contrast::Agent::REQUEST_TRACKER.current
        return unless context || ::Contrast::ASSESS.non_request_tracking?

        if (route = finding.routes[0])
          update(route.signature)
          if (observation = route.observations[0])
            update(observation.verb)
          else
            update(request.request_method)
          end
        else
          return unless request ||= context&.request

          update(request.normalized_uri) # the normalized URL used to access the method in the route.
          update(request.request_method)
        end
      end

      # Update to CRC checksum the event source name and source type.
      #
      # @param events [Array<Contrast::Agent::Reporting::FindingEvent>]
      def update_on_sources events
        events.each do |event|
          event.event_sources.each do |source|
            update(source.source_type)
            update(source.source_name)
          end
        end
      end

      # Converts  given string to CRC checksum. CRC32 checksum ensures that If error
      # of a single bit occurs, the CRC checksum will fail, regardless of any other
      # property of the transmitted data, including its length. Called several times
      # with previous CRC to recalculate the new output.
      #
      # @param str [String]
      def update str
        return unless str

        @crc32 = Zlib.crc32(str, @crc32)
      end

      # Casts current CRC checksum to String
      #
      # @return @crc32 [String] String representation of CRC32 checksum
      def finish
        @crc32.to_s
      end
    end
  end
end