/**
 * @fileoverview Sanitization patterns - Whitelists, Blacklists, Secret patterns
 * @module morph-spec/sanitizer/patterns
 */

/**
 * Whitelist: Files explicitly allowed to be read and sent to LLM
 */
export const WHITELIST_FILES = [
  'package.json',
  'package-lock.json',
  'yarn.lock',
  'pnpm-lock.yaml',
  '*.csproj',
  '*.sln',
  'README.md',
  'CLAUDE.md',
  'Dockerfile',
  'docker-compose.yml',
  'docker-compose.*.yml',
  '*.bicep',
  'azure-pipelines.yml',
  '.github/workflows/*.yml',
  '.gitlab-ci.yml',
  'tsconfig.json',
  'jsconfig.json',
  '.eslintrc*',
  '.prettierrc*',
  'vite.config.*',
  'next.config.*',
  'nuxt.config.*'
];

/**
 * Blacklist: Directories to NEVER scan or read
 */
export const BLACKLIST_DIRECTORIES = [
  'node_modules',
  '.git',
  '.svn',
  '.hg',
  'bin',
  'obj',
  'dist',
  'build',
  'out',
  '.next',
  '.nuxt',
  'coverage',
  '__pycache__',
  '.pytest_cache',
  'venv',
  'env',
  '.venv',
  '.env.*',
  'temp',
  'tmp',
  '.cache'
];

/**
 * Blacklist: File patterns to NEVER read (even if matched by whitelist)
 */
export const BLACKLIST_FILES = [
  '.env',
  '.env.local',
  '.env.*.local',
  '.env.production',
  '*.key',
  '*.pem',
  '*.pfx',
  '*.p12',
  '*.cert',
  '*.crt',
  '*secret*',
  '*password*',
  '*credentials*',
  '*token*',
  'secrets.json',
  'appsettings.Production.json',
  'appsettings.Staging.json',
  '*.log',
  '*.sqlite',
  '*.db'
];

/**
 * Secret patterns to redact from file contents
 * Each pattern has: regex, replacement text, description
 */
export const SECRET_PATTERNS = [
  {
    name: 'api-key',
    regex: /(?:api[_-]?key|apikey|api[_-]?secret)[\s:=]+["']?([a-zA-Z0-9_\-]{20,})["']?/gi,
    replacement: 'API_KEY=***REDACTED***',
    description: 'API keys'
  },
  {
    name: 'bearer-token',
    regex: /(?:bearer|authorization)[\s:=]+["']?([a-zA-Z0-9_\-\.]{20,})["']?/gi,
    replacement: 'Bearer ***REDACTED***',
    description: 'Bearer tokens'
  },
  {
    name: 'connection-string',
    regex: /(?:connection[_-]?string|connectionstring)[\s:=]+["']?([^"'\n]{30,})["']?/gi,
    replacement: 'ConnectionString=***REDACTED***',
    description: 'Connection strings'
  },
  {
    name: 'sql-password',
    regex: /(?:password|pwd)=([^;"\s]{6,})/gi,
    replacement: 'Password=***REDACTED***',
    description: 'SQL passwords in connection strings'
  },
  {
    name: 'azure-key',
    regex: /(?:account[_-]?key|accountkey)[\s:=]+["']?([a-zA-Z0-9+/=]{40,})["']?/gi,
    replacement: 'AccountKey=***REDACTED***',
    description: 'Azure Storage Account Keys'
  },
  {
    name: 'jwt-secret',
    regex: /(?:jwt[_-]?secret|jwtsecret)[\s:=]+["']?([a-zA-Z0-9_\-]{16,})["']?/gi,
    replacement: 'JwtSecret=***REDACTED***',
    description: 'JWT secrets'
  },
  {
    name: 'private-key',
    regex: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----[\s\S]+?-----END (?:RSA |EC )?PRIVATE KEY-----/gi,
    replacement: '-----BEGIN PRIVATE KEY-----\n***REDACTED***\n-----END PRIVATE KEY-----',
    description: 'Private keys (PEM format)'
  },
  {
    name: 'github-token',
    regex: /gh[pousr]_[a-zA-Z0-9]{36,}/gi,
    replacement: 'ghp_***REDACTED***',
    description: 'GitHub personal access tokens'
  },
  {
    name: 'npm-token',
    regex: /npm_[a-zA-Z0-9]{36,}/gi,
    replacement: 'npm_***REDACTED***',
    description: 'NPM tokens'
  },
  {
    name: 'generic-secret',
    regex: /(?:secret|password|pwd|pass|token)[\s:=]+["']([^"'\n]{8,})["']/gi,
    replacement: 'secret=***REDACTED***',
    description: 'Generic secrets'
  }
];

/**
 * Maximum file size to include (50KB)
 * Files larger than this are truncated with a summary
 */
export const MAX_FILE_SIZE = 50 * 1024; // 50KB

/**
 * Maximum content length for README/CLAUDE.md summaries
 */
export const MAX_SUMMARY_LENGTH = 500; // 500 chars
