# Declarative Extractors for HTTP Client Violations
# Generated for httpclient dogfooding project
# These extractors detect the 7 intentional violations in src/config.rs and src/retry.rs

# =============================================================================
# VIOLATION 1: Unbounded Redirect Limit
# =============================================================================
# Corpus claim: httpclient/max_redirects :: max_value = 10
# Pattern: Detects Option<usize> allowing None (unbounded redirects)

[[extractors.declarative]]
name = "httpclient_max_redirects_unbounded"
description = "Detects unbounded max_redirects (Option<usize> allows None)"
languages = ["rust"]
pattern = 'max_redirects:\s*Option<usize>'

[extractors.declarative.claim]
subject = "max_redirects"
predicate = "bounded"
value = false  # Code is unbounded (None allowed)

confidence = 0.9

# =============================================================================
# VIOLATION 2: Excessive Request Timeout
# =============================================================================
# Corpus claim: httpclient/request_timeout :: max_value = 30
# Pattern: Extracts Duration::from_secs value for request_timeout

[[extractors.declarative]]
name = "httpclient_request_timeout_value"
description = "Extracts request_timeout Duration value for threshold checking"
languages = ["rust"]
pattern = 'request_timeout.*Duration::from_secs\((\d+)\)'

[extractors.declarative.claim]
subject = "request_timeout"
predicate = "seconds"
value_from_match = true  # Captures the number (120)

confidence = 1.0

# =============================================================================
# VIOLATION 3: Excessive Connection Timeout
# =============================================================================
# Corpus claim: httpclient/connect_timeout :: max_value = 10
# Pattern: Extracts Duration::from_secs value for connect_timeout

[[extractors.declarative]]
name = "httpclient_connect_timeout_value"
description = "Extracts connect_timeout Duration value for threshold checking"
languages = ["rust"]
pattern = 'connect_timeout.*Duration::from_secs\((\d+)\)'

[extractors.declarative.claim]
subject = "connect_timeout"
predicate = "seconds"
value_from_match = true  # Captures the number (60)

confidence = 1.0

# =============================================================================
# VIOLATION 4: Missing Idle Timeout
# =============================================================================
# Corpus claim: httpclient/idle_timeout :: required = true
# Pattern: Detects Option<Duration> allowing None (missing idle timeout)

[[extractors.declarative]]
name = "httpclient_idle_timeout_missing"
description = "Detects missing idle_timeout (Option<Duration> with None default)"
languages = ["rust"]
pattern = 'idle_timeout:\s*Option<Duration>'

[extractors.declarative.claim]
subject = "idle_timeout"
predicate = "required"
value = false  # Not required (Option allows None)

confidence = 0.9

# Alternative pattern: Detect explicit None assignment
[[extractors.declarative]]
name = "httpclient_idle_timeout_none"
description = "Detects idle_timeout explicitly set to None"
languages = ["rust"]
pattern = 'idle_timeout:\s*None'

[extractors.declarative.claim]
subject = "idle_timeout"
predicate = "configured"
value = false  # Not configured (set to None)

confidence = 1.0

# =============================================================================
# VIOLATION 5: TLS Verification Disabled
# =============================================================================
# Corpus claim: httpclient/tls/certificate_validation :: required = true
# Pattern: Detects verify_tls set to false

[[extractors.declarative]]
name = "httpclient_verify_tls_disabled"
description = "Detects TLS certificate verification disabled (verify_tls = false)"
languages = ["rust"]
pattern = 'verify_tls:\s*false'

[extractors.declarative.claim]
subject = "tls/certificate_validation"
predicate = "enabled"
value = false  # TLS verification disabled

confidence = 1.0

# Alternative pattern: Detect in default function
[[extractors.declarative]]
name = "httpclient_default_verify_tls_false"
description = "Detects default_verify_tls() returning false"
languages = ["rust"]
pattern = 'fn\s+default_verify_tls\(\).*\{\s*false'

[extractors.declarative.claim]
subject = "tls/certificate_validation"
predicate = "default_value"
value = false  # Default is false

confidence = 0.95

# =============================================================================
# VIOLATION 6: TLS Version Too Low
# =============================================================================
# Corpus claim: httpclient/tls/min_version :: min_value = 1.2
# Pattern: Detects TLS 1.0 or 1.1 usage

[[extractors.declarative]]
name = "httpclient_tls_version_too_low_1_0"
description = "Detects TLS 1.0 usage (below minimum 1.2)"
languages = ["rust"]
pattern = 'min_tls_version:\s*TlsVersion::Tls10'

[extractors.declarative.claim]
subject = "tls/min_version"
predicate = "version"
value = "1.0"  # TLS 1.0 (too low)

confidence = 1.0

[[extractors.declarative]]
name = "httpclient_tls_version_too_low_1_1"
description = "Detects TLS 1.1 usage (below minimum 1.2)"
languages = ["rust"]
pattern = 'min_tls_version:\s*TlsVersion::Tls11'

[extractors.declarative.claim]
subject = "tls/min_version"
predicate = "version"
value = "1.1"  # TLS 1.1 (too low)

confidence = 1.0

# =============================================================================
# VIOLATION 7: No Retry Limit
# =============================================================================
# Corpus claim: httpclient/retry/max_attempts :: max_value = 3
# Pattern: Detects unbounded max_retries (Option<u32> allows None)

[[extractors.declarative]]
name = "httpclient_max_retries_unbounded"
description = "Detects unbounded max_retries (Option<u32> allows None)"
languages = ["rust"]
pattern = 'max_retries:\s*Option<u32>'

[extractors.declarative.claim]
subject = "retry/max_attempts"
predicate = "bounded"
value = false  # Unbounded (None allowed)

confidence = 0.9

# Alternative pattern: Detect explicit None assignment
[[extractors.declarative]]
name = "httpclient_max_retries_none"
description = "Detects max_retries explicitly set to None"
languages = ["rust"]
pattern = 'max_retries:\s*None'

[extractors.declarative.claim]
subject = "retry/max_attempts"
predicate = "configured"
value = false  # Not configured (set to None)

confidence = 1.0

# =============================================================================
# BONUS: Read Timeout (for completeness)
# =============================================================================
# While not a violation in default config, this extractor can detect excessive read timeouts

[[extractors.declarative]]
name = "httpclient_read_timeout_value"
description = "Extracts read_timeout Duration value for threshold checking"
languages = ["rust"]
pattern = 'read_timeout.*Duration::from_secs\((\d+)\)'

[extractors.declarative.claim]
subject = "read_timeout"
predicate = "seconds"
value_from_match = true

confidence = 1.0
