"""Bugcrowd report builder — auto-draft submissions from findings.

Generates structured reports in Bugcrowd format with evidence links,
severity justification, and remediation suggestions.
"""

from datetime import datetime
from typing import Any, Dict, List

from infj_bot.core.plugins.findings_db import Finding


SEVERITY_MAP = {
    "P1": "critical",
    "P2": "high",
    "P3": "medium",
    "P4": "low",
    "P5": "informational",
}


class ReportBuilder:
    """Build Bugcrowd-ready reports from findings."""

    def build(self, finding: Finding, evidence_list: List[Dict[str, Any]]) -> str:
        """Return a full Bugcrowd markdown report."""
        lines = [
            f"# {finding.title}",
            "",
            f"**Severity:** {finding.severity} ({SEVERITY_MAP.get(finding.severity, 'unknown')})",
            f"**Asset:** {finding.asset or 'N/A'}",
            f"**Confidence:** {finding.confidence}",
            f"**Vulnerability Type:** {finding.vuln_type or 'TBD'}",
            "",
            "## Summary",
            finding.description or "_No description provided._",
            "",
            "## Impact",
            finding.impact or "_Impact not yet assessed._",
            "",
            "## Steps to Reproduce",
            finding.reproduction or "1. _(reproduction steps not yet documented)_",
            "",
            "## Evidence",
        ]
        if evidence_list:
            for ev in evidence_list:
                lines.append(
                    f"- **{ev.get('type', 'file')}**: `{ev.get('path', 'N/A')}` — {ev.get('description', '')}"
                )
        else:
            lines.append("_No evidence attached yet._")

        lines.extend(
            [
                "",
                "## Suggested Fix",
                finding.fix or "_No fix suggested yet._",
                "",
                "## Notes",
                finding.notes or "_None._",
                "",
                f"---\n*Report generated by DRIFT Bug Bot at {datetime.now().isoformat(timespec='seconds')}*",
            ]
        )
        return "\n".join(lines)

    def build_summary(self, findings: List[Finding]) -> str:
        """Build a summary table of multiple findings."""
        if not findings:
            return "No findings to summarize."
        lines = [
            "# Bug Hunt Summary",
            "",
            "| ID | Title | Severity | Status | Asset |",
            "|----|-------|----------|--------|-------|",
        ]
        for f in findings:
            title = (f.title[:40] + "...") if len(f.title) > 40 else f.title
            asset = (
                (f.asset[:30] + "...")
                if f.asset and len(f.asset) > 30
                else (f.asset or "N/A")
            )
            lines.append(f"| {f.id} | {title} | {f.severity} | {f.status} | {asset} |")
        return "\n".join(lines)

    def severity_justification(self, severity: str, impact: str) -> str:
        """Return a pre-written severity justification block."""
        justifications = {
            "P1": (
                "**P1 — Critical**\n"
                "- Direct compromise of confidentiality, integrity, or availability.\n"
                "- No user interaction required or trivial to trigger.\n"
                "- Affects production data or core infrastructure."
            ),
            "P2": (
                "**P2 — High**\n"
                "- Significant security impact with limited prerequisites.\n"
                "- May require authenticated access or specific conditions.\n"
                "- Could lead to data exposure or unauthorized actions."
            ),
            "P3": (
                "**P3 — Medium**\n"
                "- Noticeable security weakness with moderate exploit complexity.\n"
                "- Requires multiple steps or specific context to abuse.\n"
                "- Impact is contained or requires chaining with other issues."
            ),
            "P4": (
                "**P4 — Low**\n"
                "- Minor security concern or best-practice deviation.\n"
                "- Exploitation is difficult or impact is negligible.\n"
                "- Defense-in-depth issue rather than direct vulnerability."
            ),
            "P5": (
                "**P5 — Informational**\n"
                "- No direct security impact.\n"
                "- Useful for hardening or awareness.\n"
                "- Sandbox-only or documentation-level finding."
            ),
        }
        return justifications.get(severity, "Severity not classified.")