//! Extractor-related configuration types.

use std::path::PathBuf;

use serde::Deserialize;

use crate::extractors::DeclarativeExtractorDef;

/// Extractor configuration.
#[derive(Debug, Clone, Deserialize)]
#[serde(default)]
pub struct ExtractorConfig {
    /// Enabled extractors.
    pub enabled: Vec<String>,

    /// Disabled extractors (alternative to enabled list).
    pub disabled: Vec<String>,

    /// Timeout extractor settings.
    pub timeout_config: TimeoutExtractorConfig,

    /// Dependency version extractor settings.
    pub dep_versions: DepVersionConfig,

    /// High-entropy secrets extractor settings.
    pub entropy: EntropyConfig,

    /// Declarative extractors defined in config.
    ///
    /// These are custom pattern-based extractors that users define via TOML
    /// without writing Rust code. Each declarative extractor specifies a
    /// regex pattern and claim configuration.
    ///
    /// # Example
    ///
    /// ```toml
    /// [[extractors.declarative]]
    /// name = "deprecated_api_v1"
    /// description = "Detects usage of deprecated v1 API endpoints"
    /// languages = ["go", "rust", "python"]
    /// pattern = '/api/v1/\w+'
    /// claim.subject = "api/deprecated_endpoint"
    /// claim.predicate = "version"
    /// claim.value = "v1"
    /// confidence = 1.0
    /// ```
    #[serde(default)]
    pub declarative: Vec<DeclarativeExtractorDef>,
}

/// Timeout extractor configuration.
#[derive(Debug, Clone, Deserialize)]
#[serde(default)]
pub struct TimeoutExtractorConfig {
    /// Minimum reasonable timeout in milliseconds.
    pub min_reasonable_ms: u64,

    /// Maximum reasonable timeout in milliseconds.
    pub max_reasonable_ms: u64,
}

/// Dependency version extractor configuration.
#[derive(Debug, Clone, Deserialize)]
#[serde(default)]
pub struct DepVersionConfig {
    /// Enable dependency version extraction (opt-in).
    ///
    /// Default: false to reduce noise in output.
    /// Enable this if you want dependency inventory for advisory lookup.
    pub enabled: bool,

    /// Path to advisory database.
    pub advisory_db: PathBuf,
}

/// High-entropy secrets extractor configuration.
///
/// Controls the entropy thresholds used to detect potential secrets.
/// Higher thresholds reduce false positives but may miss some secrets.
///
/// # Example
///
/// ```toml
/// [extractors.entropy]
/// min_entropy = 4.5
/// min_charset_variety = 0.4
/// min_length = 20
/// max_length = 200
/// ```
#[derive(Debug, Clone, Deserialize)]
#[serde(default)]
pub struct EntropyConfig {
    /// Minimum Shannon entropy to consider a string as a potential secret.
    ///
    /// - AWS keys: ~5.0 bits
    /// - UUIDs: ~3.8 bits
    /// - Random base64: ~5.5 bits
    ///
    /// Default: 4.5 (catches most secrets while excluding UUIDs)
    pub min_entropy: f32,

    /// Minimum charset variety (unique chars / total chars).
    ///
    /// Secrets typically have high variety (0.4+), while UUIDs are lower (~0.25).
    /// Default: 0.4
    pub min_charset_variety: f32,

    /// Minimum string length to analyze.
    ///
    /// Short strings are likely config values, not secrets.
    /// Default: 20
    pub min_length: usize,

    /// Maximum string length to analyze.
    ///
    /// Very long strings are likely data blobs, not secrets.
    /// Default: 200
    pub max_length: usize,
}
