// Copyright (c) 2026 defconxt. All rights reserved.
// Licensed under AGPL-3.0 — see LICENSE file for details.
// NERF is a trademark of defconxt.

/**
 * Evaluation rubric definitions per finding type.
 *
 * Each rubric specifies the criteria an evaluator checks and the
 * fields that must be populated for a finding to be considered complete.
 */

export const RUBRICS = {
  /**
   * Static code review findings (ReviewFinding).
   * Checks severity vs CWE mapping, proof includes code snippet,
   * remediation is actionable.
   */
  static: {
    type: 'static',
    criteria: [
      'Severity matches CWE risk profile (e.g., CWE-89 SQLi should not be rated info)',
      'Proof includes a concrete code snippet with file and line reference',
      'Remediation is specific and actionable, not generic advice',
      'CWE IDs are accurate for the vulnerability class described',
      'Finding is not in dead code, test code, or commented-out code',
      'Description explains the attack vector, not just the code pattern',
    ],
    requiredFields: ['title', 'severity', 'location', 'proof', 'remediation', 'cweIds'],
  },

  /**
   * Dynamic scan findings (Finding from Nuclei/scanner pipeline).
   * Checks severity vs CVE/CWE, host/matchedAt populated, template accuracy.
   */
  dynamic: {
    type: 'dynamic',
    criteria: [
      'Severity matches the CVE/CWE risk profile for the identified vulnerability',
      'Host and matchedAt fields are populated with valid targets',
      'Template ID corresponds to a real, current vulnerability check',
      'Finding is not a false positive from an overly broad matcher',
      'Description accurately describes the vulnerability, not just the template name',
      'References include relevant CVE/advisory links when applicable',
    ],
    requiredFields: ['title', 'severity', 'location', 'description'],
  },

  /**
   * Correlated findings (CorrelatedFinding: static + dynamic evidence).
   * Checks correlation confidence, both evidence types present,
   * severity escalation justified.
   */
  correlated: {
    type: 'correlated',
    criteria: [
      'Both static and dynamic evidence are present and reference the same vulnerability',
      'Correlation confidence score is justified by the evidence overlap',
      'Severity escalation (if any) is justified by combined evidence',
      'CWE IDs are consistent between static and dynamic sources',
      'Proof combines code-level and runtime evidence coherently',
      'Remediation addresses both the code flaw and the runtime exposure',
    ],
    requiredFields: ['title', 'severity', 'proof', 'cweIds'],
  },

  /**
   * Compliance/regulatory findings.
   * Checks regulatory reference accuracy, control mapping.
   */
  compliance: {
    type: 'compliance',
    criteria: [
      'Regulatory reference cites specific article/section (e.g., GDPR Art. 32, not just "GDPR")',
      'Control mapping is accurate (CIS, NIST 800-53, ISO 27001 control IDs)',
      'Finding distinguishes between technical non-compliance and documentation gaps',
      'Remediation includes both technical fix and compliance documentation steps',
      'Severity reflects actual regulatory risk, not just technical severity',
      'Evidence supports the non-compliance claim with observable artifacts',
    ],
    requiredFields: ['title', 'severity', 'description', 'remediation'],
  },
};

/**
 * Get all rubric types.
 * @returns {string[]}
 */
export function getRubricTypes() {
  return Object.keys(RUBRICS);
}
