package client

// KEVEntry describes a CISA-known-exploited style vulnerability for read-only exposure checks.
// Heuristics indicate likely exposure on the host — not a penetration test.
type KEVEntry struct {
	ID          string
	Name        string
	Product     string
	Severity    string // critical, high, medium
	CISAKEV     bool
	Description string
}

// KEVCatalog is aligned with CISA AA22-117A / AA22-279A top exploited CVE families.
var KEVCatalog = []KEVEntry{
	{ID: "CVE-2021-44228", Name: "Log4Shell", Product: "Apache Log4j", Severity: "critical", CISAKEV: true,
		Description: "JNDI RCE in Log4j 2.x before 2.17.0"},
	{ID: "CVE-2021-26855", Name: "ProxyLogon", Product: "Microsoft Exchange", Severity: "critical", CISAKEV: true,
		Description: "Exchange Server pre-auth SSRF chain (Mar 2021)"},
	{ID: "CVE-2020-1472", Name: "Zerologon", Product: "Microsoft Netlogon", Severity: "critical", CISAKEV: true,
		Description: "Domain controller Netlogon privilege escalation"},
	{ID: "CVE-2019-19781", Name: "Citrix ADC", Product: "Citrix ADC/Gateway", Severity: "critical", CISAKEV: true,
		Description: "Path traversal on Citrix Application Delivery Controller"},
	{ID: "CVE-2019-11510", Name: "Pulse Secure", Product: "Ivanti Pulse Connect Secure", Severity: "critical", CISAKEV: true,
		Description: "Arbitrary file read on Pulse VPN appliances"},
	{ID: "CVE-2020-5902", Name: "F5 BIG-IP", Product: "F5 BIG-IP", Severity: "critical", CISAKEV: true,
		Description: "Remote code execution in TMUI (CVE-2020-5902)"},
	{ID: "CVE-2022-1388", Name: "F5 iControl", Product: "F5 BIG-IP", Severity: "critical", CISAKEV: true,
		Description: "iControl REST auth bypass (May 2022)"},
	{ID: "CVE-2021-26084", Name: "Confluence OGNL", Product: "Atlassian Confluence", Severity: "critical", CISAKEV: true,
		Description: "Confluence Server/Data Center RCE"},
	{ID: "CVE-2022-26134", Name: "Confluence RCE", Product: "Atlassian Confluence", Severity: "critical", CISAKEV: true,
		Description: "Confluence unauthenticated RCE (2022)"},
	{ID: "CVE-2021-40539", Name: "ManageEngine", Product: "Zoho ManageEngine ADSelfService Plus", Severity: "critical", CISAKEV: true,
		Description: "Unauthenticated RCE in ADSelfService Plus"},
	{ID: "CVE-2018-13379", Name: "FortiOS path traversal", Product: "Fortinet FortiGate/FortiOS", Severity: "critical", CISAKEV: true,
		Description: "SSL-VPN path traversal (FortiOS)"},
	{ID: "CVE-2021-34527", Name: "PrintNightmare", Product: "Windows Print Spooler", Severity: "high", CISAKEV: true,
		Description: "Spooler remote code execution (Jul 2021)"},
	{ID: "CVE-2020-0688", Name: "Exchange RCE", Product: "Microsoft Exchange", Severity: "high", CISAKEV: true,
		Description: "Exchange control panel deserialization RCE"},
	{ID: "CVE-2021-21972", Name: "vCenter RCE", Product: "VMware vCenter", Severity: "critical", CISAKEV: true,
		Description: "vSphere Client RCE in vCenter Server"},
}

// KEVFinding is one catalog entry with a probe result for this host.
type KEVFinding struct {
	CVE         string `json:"cve"`
	Name        string `json:"name"`
	Product     string `json:"product"`
	Severity    string `json:"severity"`
	CISAKEV     bool   `json:"cisa_kev"`
	Status      string `json:"status"` // exposed, likely, clear, n/a
	Detail      string `json:"detail,omitempty"`
}

// KEVScanReport aggregates exposure heuristics for the dashboard.
type KEVScanReport struct {
	ScannedAt       string       `json:"scanned_at"`
	ExposedCount    int          `json:"exposed_count"`
	LikelyCount     int          `json:"likely_count"`
	CriticalCount   int          `json:"critical_count"`
	RiskScore       int          `json:"risk_score"` // 0-100 higher = worse
	Findings        []KEVFinding `json:"findings"`
	Summary         string       `json:"summary,omitempty"`
}