using System.Text.Json.Serialization;

namespace StellaOps.Policy.Scoring;

/// <summary>
/// CVSS v4.0 Base metric group - Exploitability and impact metrics.
/// Per FIRST CVSS v4.0 Specification Document.
/// </summary>
public sealed record CvssBaseMetrics
{
    /// <summary>Attack Vector (AV) - Mandatory.</summary>
    [JsonPropertyName("av")]
    public required AttackVector AttackVector { get; init; }

    /// <summary>Attack Complexity (AC) - Mandatory.</summary>
    [JsonPropertyName("ac")]
    public required AttackComplexity AttackComplexity { get; init; }

    /// <summary>Attack Requirements (AT) - Mandatory.</summary>
    [JsonPropertyName("at")]
    public required AttackRequirements AttackRequirements { get; init; }

    /// <summary>Privileges Required (PR) - Mandatory.</summary>
    [JsonPropertyName("pr")]
    public required PrivilegesRequired PrivilegesRequired { get; init; }

    /// <summary>User Interaction (UI) - Mandatory.</summary>
    [JsonPropertyName("ui")]
    public required UserInteraction UserInteraction { get; init; }

    /// <summary>Vulnerable System Confidentiality (VC) - Mandatory.</summary>
    [JsonPropertyName("vc")]
    public required ImpactMetricValue VulnerableSystemConfidentiality { get; init; }

    /// <summary>Vulnerable System Integrity (VI) - Mandatory.</summary>
    [JsonPropertyName("vi")]
    public required ImpactMetricValue VulnerableSystemIntegrity { get; init; }

    /// <summary>Vulnerable System Availability (VA) - Mandatory.</summary>
    [JsonPropertyName("va")]
    public required ImpactMetricValue VulnerableSystemAvailability { get; init; }

    /// <summary>Subsequent System Confidentiality (SC) - Mandatory.</summary>
    [JsonPropertyName("sc")]
    public required ImpactMetricValue SubsequentSystemConfidentiality { get; init; }

    /// <summary>Subsequent System Integrity (SI) - Mandatory.</summary>
    [JsonPropertyName("si")]
    public required ImpactMetricValue SubsequentSystemIntegrity { get; init; }

    /// <summary>Subsequent System Availability (SA) - Mandatory.</summary>
    [JsonPropertyName("sa")]
    public required ImpactMetricValue SubsequentSystemAvailability { get; init; }
}

/// <summary>
/// CVSS v4.0 Threat metric group.
/// </summary>
public sealed record CvssThreatMetrics
{
    /// <summary>Exploit Maturity (E) - Optional, defaults to Not Defined.</summary>
    [JsonPropertyName("e")]
    public ExploitMaturity ExploitMaturity { get; init; } = ExploitMaturity.NotDefined;

    /// <summary>When the threat signal was last observed (UTC).</summary>
    [JsonPropertyName("observedAt")]
    public DateTimeOffset? ObservedAt { get; init; }

    /// <summary>When this threat signal should expire.</summary>
    [JsonPropertyName("expiresAt")]
    public DateTimeOffset? ExpiresAt { get; init; }

    /// <summary>Source of threat intelligence (kev, epss, internal).</summary>
    [JsonPropertyName("source")]
    public string? Source { get; init; }
}

/// <summary>
/// CVSS v4.0 Environmental metric group - Modified base metrics for specific environments.
/// </summary>
public sealed record CvssEnvironmentalMetrics
{
    /// <summary>Modified Attack Vector (MAV).</summary>
    [JsonPropertyName("mav")]
    public ModifiedAttackVector? ModifiedAttackVector { get; init; }

    /// <summary>Modified Attack Complexity (MAC).</summary>
    [JsonPropertyName("mac")]
    public ModifiedAttackComplexity? ModifiedAttackComplexity { get; init; }

    /// <summary>Modified Attack Requirements (MAT).</summary>
    [JsonPropertyName("mat")]
    public ModifiedAttackRequirements? ModifiedAttackRequirements { get; init; }

    /// <summary>Modified Privileges Required (MPR).</summary>
    [JsonPropertyName("mpr")]
    public ModifiedPrivilegesRequired? ModifiedPrivilegesRequired { get; init; }

    /// <summary>Modified User Interaction (MUI).</summary>
    [JsonPropertyName("mui")]
    public ModifiedUserInteraction? ModifiedUserInteraction { get; init; }

    /// <summary>Modified Vulnerable System Confidentiality (MVC).</summary>
    [JsonPropertyName("mvc")]
    public ModifiedImpactMetricValue? ModifiedVulnerableSystemConfidentiality { get; init; }

    /// <summary>Modified Vulnerable System Integrity (MVI).</summary>
    [JsonPropertyName("mvi")]
    public ModifiedImpactMetricValue? ModifiedVulnerableSystemIntegrity { get; init; }

    /// <summary>Modified Vulnerable System Availability (MVA).</summary>
    [JsonPropertyName("mva")]
    public ModifiedImpactMetricValue? ModifiedVulnerableSystemAvailability { get; init; }

    /// <summary>Modified Subsequent System Confidentiality (MSC).</summary>
    [JsonPropertyName("msc")]
    public ModifiedImpactMetricValue? ModifiedSubsequentSystemConfidentiality { get; init; }

    /// <summary>Modified Subsequent System Integrity (MSI).</summary>
    [JsonPropertyName("msi")]
    public ModifiedSubsequentImpact? ModifiedSubsequentSystemIntegrity { get; init; }

    /// <summary>Modified Subsequent System Availability (MSA).</summary>
    [JsonPropertyName("msa")]
    public ModifiedSubsequentImpact? ModifiedSubsequentSystemAvailability { get; init; }

    /// <summary>Confidentiality Requirement (CR).</summary>
    [JsonPropertyName("cr")]
    public SecurityRequirement? ConfidentialityRequirement { get; init; }

    /// <summary>Integrity Requirement (IR).</summary>
    [JsonPropertyName("ir")]
    public SecurityRequirement? IntegrityRequirement { get; init; }

    /// <summary>Availability Requirement (AR).</summary>
    [JsonPropertyName("ar")]
    public SecurityRequirement? AvailabilityRequirement { get; init; }
}

/// <summary>
/// CVSS v4.0 Supplemental metric group - Additional context metrics that do not affect scoring.
/// </summary>
public sealed record CvssSupplementalMetrics
{
    /// <summary>Safety (S) - Does the vulnerability affect human safety?</summary>
    [JsonPropertyName("s")]
    public Safety? Safety { get; init; }

    /// <summary>Automatable (AU) - Can the vulnerability be exploited automatically?</summary>
    [JsonPropertyName("au")]
    public Automatable? Automatable { get; init; }

    /// <summary>Recovery (R) - What is the recovery capability?</summary>
    [JsonPropertyName("r")]
    public Recovery? Recovery { get; init; }

    /// <summary>Value Density (V) - Resource density of the vulnerable system.</summary>
    [JsonPropertyName("v")]
    public ValueDensity? ValueDensity { get; init; }

    /// <summary>Vulnerability Response Effort (RE) - Effort required to respond.</summary>
    [JsonPropertyName("re")]
    public ResponseEffort? VulnerabilityResponseEffort { get; init; }

    /// <summary>Provider Urgency (U) - Urgency as assessed by the provider.</summary>
    [JsonPropertyName("u")]
    public ProviderUrgency? ProviderUrgency { get; init; }
}

#region Base Metric Enums

/// <summary>Attack Vector values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum AttackVector
{
    /// <summary>Network (N) - Remotely exploitable.</summary>
    Network,
    /// <summary>Adjacent (A) - Same network segment.</summary>
    Adjacent,
    /// <summary>Local (L) - Local access required.</summary>
    Local,
    /// <summary>Physical (P) - Physical access required.</summary>
    Physical
}

/// <summary>Attack Complexity values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum AttackComplexity
{
    /// <summary>Low (L) - No specialized conditions.</summary>
    Low,
    /// <summary>High (H) - Specialized conditions required.</summary>
    High
}

/// <summary>Attack Requirements values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum AttackRequirements
{
    /// <summary>None (N) - No preconditions required.</summary>
    None,
    /// <summary>Present (P) - Preconditions must exist.</summary>
    Present
}

/// <summary>Privileges Required values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum PrivilegesRequired
{
    /// <summary>None (N) - No privileges needed.</summary>
    None,
    /// <summary>Low (L) - Basic user privileges needed.</summary>
    Low,
    /// <summary>High (H) - Admin/elevated privileges needed.</summary>
    High
}

/// <summary>User Interaction values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum UserInteraction
{
    /// <summary>None (N) - No user interaction required.</summary>
    None,
    /// <summary>Passive (P) - Involuntary user action.</summary>
    Passive,
    /// <summary>Active (A) - Conscious user action required.</summary>
    Active
}

/// <summary>Impact metric values (None/Low/High) per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ImpactMetricValue
{
    /// <summary>None (N) - No impact.</summary>
    None,
    /// <summary>Low (L) - Limited impact.</summary>
    Low,
    /// <summary>High (H) - Serious impact.</summary>
    High
}

#endregion

#region Threat Metric Enums

/// <summary>Exploit Maturity values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ExploitMaturity
{
    /// <summary>Not Defined (X) - Not assessed.</summary>
    NotDefined,
    /// <summary>Attacked (A) - Active exploitation observed.</summary>
    Attacked,
    /// <summary>Proof of Concept (P) - PoC code exists.</summary>
    ProofOfConcept,
    /// <summary>Unreported (U) - No public exploit code.</summary>
    Unreported
}

#endregion

#region Environmental Metric Enums (Modified versions)

/// <summary>Modified Attack Vector values.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ModifiedAttackVector
{
    NotDefined, Network, Adjacent, Local, Physical
}

/// <summary>Modified Attack Complexity values.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ModifiedAttackComplexity
{
    NotDefined, Low, High
}

/// <summary>Modified Attack Requirements values.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ModifiedAttackRequirements
{
    NotDefined, None, Present
}

/// <summary>Modified Privileges Required values.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ModifiedPrivilegesRequired
{
    NotDefined, None, Low, High
}

/// <summary>Modified User Interaction values.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ModifiedUserInteraction
{
    NotDefined, None, Passive, Active
}

/// <summary>Modified Impact metric values.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ModifiedImpactMetricValue
{
    NotDefined, None, Low, High
}

/// <summary>Modified Subsequent System Impact values (includes Safety dimension).</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ModifiedSubsequentImpact
{
    NotDefined, Negligible, Low, High, Safety
}

/// <summary>Security Requirement values.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum SecurityRequirement
{
    NotDefined, Low, Medium, High
}

#endregion

#region Supplemental Metric Enums

/// <summary>Safety values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum Safety
{
    NotDefined, Negligible, Present
}

/// <summary>Automatable values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum Automatable
{
    NotDefined, No, Yes
}

/// <summary>Recovery values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum Recovery
{
    NotDefined, Automatic, User, Irrecoverable
}

/// <summary>Value Density values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ValueDensity
{
    NotDefined, Diffuse, Concentrated
}

/// <summary>Response Effort values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ResponseEffort
{
    NotDefined, Low, Moderate, High
}

/// <summary>Provider Urgency values per CVSS v4.0.</summary>
[JsonConverter(typeof(JsonStringEnumConverter))]
public enum ProviderUrgency
{
    NotDefined, Clear, Green, Amber, Red
}

#endregion