// Security audit and vulnerability analyzer for TLS configurations

///|
pub struct SecurityFinding {
  severity : String // "info", "warning", "critical"
  category : String
  finding : String
  suggestion : String
} derive(Debug, Eq)

///|
pub fn audit_client_hello_security(
  hello : ClientHello,
) -> Array[SecurityFinding] {
  let findings = []

  // 1. Version Audit
  let ver = hello.legacy_version.to_int()
  if ver < 0x0303 {
    findings.push({
      severity: "critical",
      category: "Protocol Version",
      finding: "Legacy TLS version offered: 0x" + ver.to_string(radix=16),
      suggestion: "Disable TLS 1.0 (0x0301) and TLS 1.1 (0x0302). Force TLS 1.2 minimum version.",
    })
  }

  // 2. Cipher Suite Audit
  let mut has_null = false
  let mut has_rc4 = false
  let mut has_3des = false
  let mut has_weak_export = false

  for cipher in hello.cipher_suites {
    let c_val = cipher.to_int()
    // Null Ciphers: 0x0001 (NULL_MD5), 0x0002 (NULL_SHA), 0x002c (NULL_SHA256)
    if c_val == 0x0001 || c_val == 0x0002 || c_val == 0x002c {
      has_null = true
    }
    // RC4 Ciphers: e.g. 0x0004, 0x0005
    if c_val == 0x0004 || c_val == 0x0005 {
      has_rc4 = true
    }
    // 3DES Ciphers: e.g. 0x000a
    if c_val == 0x000a {
      has_3des = true
    }
    // Weak Export Ciphers: e.g. 0x0003, 0x0006, 0x0008, 0x0011, 0x0014
    if c_val == 0x0003 ||
      c_val == 0x0006 ||
      c_val == 0x0008 ||
      c_val == 0x0011 ||
      c_val == 0x0014 {
      has_weak_export = true
    }
  }

  if has_null {
    findings.push({
      severity: "critical",
      category: "Cryptography",
      finding: "Client offers NULL encryption cipher suites (no confidentiality)",
      suggestion: "Immediately remove NULL cipher suites from active configurations.",
    })
  }
  if has_rc4 {
    findings.push({
      severity: "critical",
      category: "Cryptography",
      finding: "Client offers RC4 cipher suites (known cryptographic weaknesses)",
      suggestion: "Disable RC4 cipher suites. Replace with AES-GCM or ChaCha20-Poly1305.",
    })
  }
  if has_3des {
    findings.push({
      severity: "warning",
      category: "Cryptography",
      finding: "Client offers 3DES/DES cipher suites (SWEET32 vulnerability hazard)",
      suggestion: "Disable Triple-DES (3DES) suites. Enforce AES-GCM block ciphers.",
    })
  }
  if has_weak_export {
    findings.push({
      severity: "critical",
      category: "Cryptography",
      finding: "Client offers legacy export-grade cipher suites (susceptible to FREAK/Logjam)",
      suggestion: "Disable all export-grade ciphers (usually marked EXPORT).",
    })
  }

  // 3. SNI Audit
  if hello.server_name is None {
    findings.push({
      severity: "info",
      category: "Privacy",
      finding: "ClientHello lacks Server Name Indication (SNI) extension",
      suggestion: "Enable SNI to allow proper routing on multi-tenant virtual hosting servers.",
    })
  }

  // 4. ALPN Audit
  if hello.alpn_protocols.length() == 0 {
    findings.push({
      severity: "info",
      category: "Performance",
      finding: "No Application-Layer Protocol Negotiation (ALPN) extensions present",
      suggestion: "Enable ALPN to negotiate HTTP/2 or HTTP/3 without extra roundtrips.",
    })
  }

  findings
}

///|
pub fn audit_server_hello_security(
  hello : ServerHello,
) -> Array[SecurityFinding] {
  let findings = []

  // 1. Version Audit
  let ver = hello.version.to_int()
  if ver < 0x0303 {
    findings.push({
      severity: "critical",
      category: "Protocol Version",
      finding: "Server negotiated deprecated legacy version: 0x" +
      ver.to_string(radix=16),
      suggestion: "Upgrade server configuration to negotiate TLS 1.2 or TLS 1.3 only.",
    })
  }

  // 2. Cipher Suite Audit
  let cipher = hello.cipher_suite.to_int()
  // Check for weak ciphers
  if cipher == 0x000a {
    findings.push({
      severity: "critical",
      category: "Cryptography",
      finding: "Server selected weak 3DES cipher suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA",
      suggestion: "Remove 3DES/DES cipher suites from server settings.",
    })
  } else if cipher == 0x0001 || cipher == 0x0002 || cipher == 0x002c {
    findings.push({
      severity: "critical",
      category: "Cryptography",
      finding: "Server selected NULL encryption cipher suite (plaintext traffic!)",
      suggestion: "Disable NULL cipher suites. Plaintext traffic leaks all credentials.",
    })
  }

  findings
}

///|
pub fn print_security_audit_report(findings : Array[SecurityFinding]) -> Unit {
  if findings.length() == 0 {
    println("[+] TLS Security Audit: Clean. No issues found.")
    return
  }
  println("=================================================================")
  println("                 TLS CONFIGURATION SECURITY AUDIT REPORT")
  println("=================================================================")
  for f in findings {
    let sev = f.severity.to_upper()
    println("[\{sev}] Category: \{f.category}")
    println("  └─ Issue: \{f.finding}")
    println("  └─ Suggestion: \{f.suggestion}\n")
  }
  println("=================================================================")
}