// engine/security-analyzer/criteria-generator.ts — OWASP criteria, auth criteria, STRIDE, compliance
// SPEC-029
import { loadSecurityPatterns } from './config-loader.js';
// === OWASP criteria generation ===
export async function generateOwaspCriteria(profiles) {
    const config = await loadSecurityPatterns();
    const criteria = [];
    const seen = new Set();
    for (const profile of profiles) {
        const profileCriteria = config.owaspCriteriaByProfile[profile] ?? [];
        for (const c of profileCriteria) {
            const key = c.description;
            if (!seen.has(key)) {
                seen.add(key);
                criteria.push({
                    owasp: c.owasp,
                    description: c.description,
                    rationale: c.rationale,
                    verificationStatus: 'missing',
                });
            }
        }
    }
    return criteria;
}
// === Auth-specific criteria ===
export async function getAuthCriteria(mechanism) {
    if (mechanism === 'none') {
        return [];
    }
    const config = await loadSecurityPatterns();
    return config.authMechanismCriteria[mechanism] ?? [];
}
// === STRIDE threat generation ===
export async function generateStridThreats(featureType) {
    const config = await loadSecurityPatterns();
    const threatKey = featureType === 'generic' ? 'auth' : featureType;
    const rawThreats = config.strideThreats[threatKey] ?? [];
    return rawThreats.map((t) => ({
        category: t.category,
        scenario: t.scenario,
        cvssRange: t.cvssRange,
        mitigation: t.mitigation,
    }));
}
// === Compliance detection ===
export function detectComplianceFrameworks(description, projectDescription) {
    const text = `${description} ${projectDescription ?? ''}`.toLowerCase();
    const frameworks = [];
    const hipaaKeywords = ['phi', 'medical', 'health', 'patient', 'hipaa', 'ehr', 'emr', 'clinical'];
    const pciKeywords = [
        'payment',
        'card',
        'pci',
        'cardholder',
        'merchant',
        'stripe',
        'checkout',
        'billing',
    ];
    const fedRampKeywords = ['federal', 'government', 'fedramp', 'fisma', 'gov'];
    const soc2Keywords = ['soc2', 'soc 2', 'trust service', 'compliance', 'audit'];
    if (hipaaKeywords.some((k) => text.includes(k))) {
        frameworks.push('hipaa');
    }
    if (pciKeywords.some((k) => text.includes(k))) {
        frameworks.push('pci-dss');
    }
    if (fedRampKeywords.some((k) => text.includes(k))) {
        frameworks.push('fedramp');
    }
    if (soc2Keywords.some((k) => text.includes(k))) {
        frameworks.push('soc2');
    }
    return frameworks;
}
//# sourceMappingURL=criteria-generator.js.map