use super::Rule;

/// Dependency-specific vulnerability patterns
pub fn get_dependency_rules() -> Vec<Rule> {
    // These rules detect vulnerable patterns in common dependency files
    // Package managers and their lock files
    vec![]
}

/// Trait for dependency analysis
pub trait DependencyRule {
    fn analyze_package_json(&self, content: &str) -> Vec<DependencyVulnerability>;
    fn analyze_requirements_txt(&self, content: &str) -> Vec<DependencyVulnerability>;
    fn analyze_go_mod(&self, content: &str) -> Vec<DependencyVulnerability>;
    fn analyze_cargo_toml(&self, content: &str) -> Vec<DependencyVulnerability>;
    fn analyze_pom_xml(&self, content: &str) -> Vec<DependencyVulnerability>;
}

/// A vulnerability found in a dependency
#[derive(Debug, Clone)]
pub struct DependencyVulnerability {
    pub package_name: String,
    pub version: String,
    pub vulnerability_type: String,
    pub description: String,
    pub recommendation: String,
}

/// Known packages with cryptographic vulnerabilities
pub struct KnownVulnerablePackages;

impl KnownVulnerablePackages {
    /// JavaScript/Node.js packages with known crypto issues
    pub fn javascript() -> Vec<(&'static str, &'static str, &'static str)> {
        vec![
            // (package_name, vulnerable_versions_pattern, issue)
            ("node-forge", "<1.0.0", "Uses vulnerable RSA implementation"),
            ("crypto-js", "*", "Uses RSA/ECDSA for encryption"),
            ("jsrsasign", "*", "RSA/ECDSA cryptography library"),
            ("node-rsa", "*", "RSA cryptography library"),
            ("elliptic", "*", "Elliptic curve cryptography library"),
            ("secp256k1", "*", "Specific EC curve implementation"),
        ]
    }

    /// Python packages with known crypto issues
    pub fn python() -> Vec<(&'static str, &'static str, &'static str)> {
        vec![
            ("pycryptodome", "*", "Contains RSA/ECDSA implementations"),
            ("pycrypto", "*", "Deprecated, contains vulnerable crypto"),
            ("cryptography", "*", "Contains RSA/ECDSA implementations"),
            ("ecdsa", "*", "ECDSA cryptography library"),
            ("rsa", "*", "RSA cryptography library"),
            ("paramiko", "*", "SSH library using RSA/ECDSA"),
        ]
    }

    /// Go packages with known crypto issues
    pub fn go() -> Vec<(&'static str, &'static str, &'static str)> {
        vec![
            ("crypto/rsa", "*", "Standard library RSA"),
            ("crypto/ecdsa", "*", "Standard library ECDSA"),
            ("crypto/dsa", "*", "Standard library DSA"),
            ("crypto/elliptic", "*", "Standard library EC"),
        ]
    }

    /// Java packages with known crypto issues
    pub fn java() -> Vec<(&'static str, &'static str, &'static str)> {
        vec![
            ("org.bouncycastle", "*", "Contains RSA/ECDSA implementations"),
            ("javax.crypto", "*", "Standard library crypto"),
        ]
    }
}
