import { messages } from '../../../core/messages/index.js';
import { createLineLookup, maskGoComments } from '../../../shared/helpers/index.js';
import { criarAnalista, criarOcorrencia } from '../../../types/index.js';
const disableEnv = process.env.TUTANUS_DISABLE_PLUGIN_GO === '1';
function warn(message, relPath, line, nivel) {
    return criarOcorrencia({
        relPath,
        mensagem: message,
        linha: line,
        nivel: nivel ?? messages.SeverityNiveis.warning,
        origem: messages.AnalystOrigens.go,
        tipo: messages.AnalystTipos.go
    });
}
function collectSecurityIssues(src, relPath) {
    const ocorrencias = [];
    const lineOf = createLineLookup(src).lineAt;
    const scan = maskGoComments(src);
    for (const match of scan.matchAll(/^\s*[a-zA-Z_][a-zA-Z0-9_]*\s*:?\s*=\s*(?:os\.|ioutil\.|io\.|net\.|http\.|json\.|xml\.|encoding\/)\w+\.\w+\([^)]*\)\s*$/gm)) {
        if (/err\s*:?=\s*/.test(match[0]) || /if\s+err\s*!=\s*nil/.test(scan.slice(0, match.index)))
            continue;
        const line = lineOf(match.index);
        ocorrencias.push(warn(messages.GoMensagens.uncheckedError, relPath, line, messages.SeverityNiveis.error));
    }
    for (const match of scan.matchAll(/(?:password|secret|api[_-]?key|token|credential)\s*(?::\s*|=\s*["'`])([^"'`\s]{4,})/gi)) {
        const line = lineOf(match.index);
        ocorrencias.push(warn(messages.GoMensagens.hardcodedSecret, relPath, line, messages.SeverityNiveis.error));
    }
    for (const match of scan.matchAll(/\b(fmt\.(?:Print|Sprint|Fprint))\s*\(\s*([^)]+)\)/g)) {
        const args = match[2] ?? '';
        if (/["'`]/.test(args.trim()))
            continue;
        const line = lineOf(match.index);
        ocorrencias.push(warn(messages.GoMensagens.printWithoutFormat, relPath, line));
    }
    return ocorrencias;
}
export const analistaGoSeguranca = criarAnalista({
    nome: 'analista-go-seguranca',
    categoria: 'seguranca',
    descricao: 'Detecta vulnerabilidades de segurança em código Go.',
    global: false,
    test: (relPath) => /\.go$/i.test(relPath),
    aplicar: async (src, relPath) => {
        if (disableEnv)
            return null;
        const msgs = collectSecurityIssues(src, relPath);
        return msgs.length ? msgs : null;
    }
});
//# sourceMappingURL=analyst-security.js.map