"""Keyless native WAF fingerprinting and supplied-source SAST adapters."""
import json
import tempfile
from pathlib import Path

from .module_inputs import ModuleInputs
from .pipeline import execute
from .web_modules import alert, read_report

SAST_RULES = {
    "asfb-js-postmessage-wildcard": "Review wildcard postMessage target origin and message sensitivity.",
    "asfb-python-shell-true": "Review subprocess execution with shell=True.",
    "asfb-python-dynamic-code": "Review dynamically evaluated code and input provenance.",
    "asfb-python-pickle": "Deserialization must only accept trusted input.",
    "asfb-python-unsafe-yaml": "Review use of an unsafe YAML loader.",
    "asfb-python-tls-disabled": "Review disabled certificate verification.",
    "asfb-js-eval": "Review dynamic evaluation and input provenance.",
    "asfb-js-function-constructor": "Review dynamic Function construction.",
    "asfb-js-shell-command": "Review shell command execution and input provenance.",
    "asfb-js-html-assignment": "Review HTML assignments for untrusted content.",
}
LANGUAGES = {"python": ".py", "javascript": ".js", "typescript": ".ts"}


def normalized_sast(report, target):
    findings = []
    seen = set()
    for item in report.get("results", []):
        if not isinstance(item, dict):
            continue
        rule = str(item.get("check_id", "")).rsplit(".", 1)[-1]
        line = (item.get("start") or {}).get("line")
        if rule not in SAST_RULES or type(line) is not int or not 1 <= line <= 200001:
            continue
        if (rule, line) in seen:
            continue
        seen.add((rule, line))
        finding = alert("semgrep", "Semgrep: " + SAST_RULES[rule], target,
                        f"Supplied source, line {line}; rule {rule}. "
                        "Pattern review only; input trust, reachability and exploitability are not proven. "
                        "Source, values and native context are redacted.", "Medium", rule)
        finding["source_line"] = line
        findings.append(finding)
    return findings[:100]


async def run(module, url, host, agent, delay, inputs=None):
    values = inputs if isinstance(inputs, ModuleInputs) else ModuleInputs(**(inputs or {}))
    if module == "semgrep" and (not values.source_text.strip() or values.sast_language not in LANGUAGES):
        reason = "Requires supplied source text and an explicit Python, JavaScript or TypeScript language"
        return {"source": module, "status": "skipped", "alerts": [], "reason": reason, "output": reason}
    with tempfile.TemporaryDirectory(prefix="asfb-" + module + "-") as tmp:
        root = Path(tmp)
        output = root / "report.json"
        if module == "semgrep":
            source = root / ("source" + LANGUAGES[values.sast_language])
            source.write_text(values.source_text, encoding="utf-8")
            source.chmod(0o600)
            args = ["/usr/bin/env", "SEMGREP_SEND_METRICS=off", "SEMGREP_ENABLE_VERSION_CHECK=0",
                    "SEMGREP_APP_TOKEN=", "/opt/semgrep/bin/semgrep", "scan", "--oss-only",
                    "--config", "/app/app/semgrep-rules/review.yaml", "--json", "--output", str(output),
                    "--metrics", "off", "--disable-version-check", "--no-git-ignore",
                    "--jobs", "1", "--timeout", "5", "--max-memory", "512",
                    "--max-target-bytes", "1000000", str(source)]
            deadline = 75
            reason = "Supplied source only; ten bundled pattern-review rules; CE single-file analysis; no code execution, remote registry, uploads or autofix"
        elif module == "wafw00f":
            spec = root / "spec.json"
            spec.write_text(json.dumps({"target": url, "host": host, "agent": agent, "delay": delay}), encoding="utf-8")
            args = ["/opt/wafw00f/bin/python", "/app/app/waf_runner.py", str(spec), str(output)]
            deadline = 45
            reason = "Native WAFW00F vendor signatures; up to eight paced same-origin GET requests; no redirects or generic blocking heuristics"
        else:
            raise ValueError("Unsupported analysis module")
        rows, status = await execute(args, deadline)
        report = read_report(output)
        findings, vendors, requests = [], [], 0
        if module == "semgrep" and isinstance(report, dict) and isinstance(report.get("results"), list):
            findings = normalized_sast(report, url)
            errors = report.get("errors") or []
            scanned = (report.get("paths") or {}).get("scanned") or []
            if errors and status == "completed":
                status = "partial" if findings else "failed"
                reason += "; native analysis errors were reported (details redacted)"
            if not scanned and status == "completed":
                status = "failed"
                reason += "; supplied file was not reported as scanned"
        elif module == "wafw00f" and isinstance(report, dict) and report.get("profile") == "wafw00f-bounded":
            vendors = [name for name in report.get("vendors", []) if isinstance(name, str) and len(name) <= 120][:10]
            requests = report.get("requests", 0)
            requests = requests if type(requests) is int and 0 <= requests <= 8 else 0
            if report.get("status") in ("partial", "failed"):
                status = report["status"] if status == "completed" else status
            for vendor in vendors:
                findings.append(alert(module, "WAF fingerprint: " + vendor, url,
                    "Native vendor-signature observation; this is infrastructure inventory, not a vulnerability. "
                    "Header/body signatures can be spoofed or hidden. Raw responses and probe URLs are omitted."))
            if report.get("stop_reason") in ("request_budget", "response_limit", "rate_limited", "deadline",
                                             "request_failed", "scope_blocked", "probe_blocked"):
                reason += "; " + report["stop_reason"].replace("_", " ")
        else:
            if status == "completed":
                status = "failed"
            reason += "; no valid native report"
        if status == "completed" and findings:
            status = "findings"
        if status in ("timeout", "failed", "unavailable"):
            reason += "; incomplete scan; parsed results retained"
        return {"source": module, "target": url, "status": status, "alerts": findings,
                "waf": {"vendors": vendors, "requests": requests} if module == "wafw00f" else None,
                "requests": requests, "deadline_seconds": deadline, "reason": reason,
                "output": f"{module}: {len(findings)} observations; status: {status}; native output redacted"}