use anyhow::Result;
use std::path::Path;
use tree_sitter::Node;

use crate::analyzers::ast_analyzer::AstAnalyzer;
use crate::types::{Severity, Vulnerability, VulnerabilityType};

use super::LanguageAnalyzer;

pub struct ShellAnalyzer;

impl ShellAnalyzer {
    pub fn new() -> Self {
        Self
    }
}

impl LanguageAnalyzer for ShellAnalyzer {
    fn check_node(
        &self,
        node: &Node,
        source: &str,
        file_path: &Path,
        analyzer: &AstAnalyzer,
    ) -> Option<Vulnerability> {
        let node_type = node.kind();
        let node_text = match node.utf8_text(source.as_bytes()) {
            Ok(text) => text,
            Err(_) => return None,
        };

        match node_type {
            "command" => {
                let lower = node_text.to_lowercase();

                // OpenSSL commands
                if lower.contains("openssl") {
                    if lower.contains("rsa") || lower.contains("ec") || lower.contains("dsa") || lower.contains("dh") {
                        return Some(analyzer.create_vulnerability(
                            node,
                            file_path,
                            VulnerabilityType::Rsa2048,
                            Severity::Critical,
                            "Shell OpenSSL RSA/EC/DSA/DH command detected",
                            "Migrate to post-quantum cryptography tools (e.g., OQS-OpenSSL)",
                            source,
                        ));
                    }
                    if lower.contains("md5") {
                        return Some(analyzer.create_vulnerability(
                            node,
                            file_path,
                            VulnerabilityType::Md5,
                            Severity::High,
                            "Shell OpenSSL MD5 command detected",
                            "Replace with SHA-256 or SHA-3",
                            source,
                        ));
                    }
                    if lower.contains("sha1") {
                        return Some(analyzer.create_vulnerability(
                            node,
                            file_path,
                            VulnerabilityType::Sha1,
                            Severity::High,
                            "Shell OpenSSL SHA1 command detected",
                            "Replace with SHA-256 or SHA-3",
                            source,
                        ));
                    }
                }

                // Other crypto commands
                if lower.contains("gpg") || lower.contains("ssh-keygen") {
                    if lower.contains("rsa") || lower.contains("dsa") || lower.contains("ecdsa") {
                        return Some(analyzer.create_vulnerability(
                            node,
                            file_path,
                            VulnerabilityType::Rsa2048,
                            Severity::Medium,
                            "Shell GPG/SSH-keygen RSA/DSA/ECDSA command detected",
                            "Ensure key generation uses quantum-safe algorithms (e.g., ED25519, or PQC)",
                            source,
                        ));
                    }
                }

                None
            }
            "string_literal" => {
                analyzer.check_string_literal(node_text, node, file_path, source, node)
            }
            _ => None,
        }
    }
}
