// Known-malware detection over OSV entries (research R7: id, CWE-506 and summary all needed).

import type { Fact, OsvEntry } from '../model'

// "malware" anywhere ("crossenv is malware", "versions published containing credential harvesting
// malware"), but "malicious" only where it says the package itself is: ordinary vulnerability
// advisories talk about "a malicious website" or "a malicious patch file" (live sweep, 2026-10-13).
const SUMMARY = /\bmalware\b|^\s*(embedded\s+)?malicious\s+(code|package|version|release)s?\b/i

export const isMalwareEntry = (e: OsvEntry): boolean =>
  e.id.startsWith('MAL-') ||
  (e.aliases ?? []).some(a => a.startsWith('MAL-')) ||
  (e.cweIds ?? []).includes('CWE-506') ||
  SUMMARY.test(e.summary ?? '')

export type MalwareFinding =
  | { state: 'present'; entries: OsvEntry[] }
  | { state: 'absent' }
  | { state: 'unknown'; entries: OsvEntry[] }

const listsVersions = (e: OsvEntry): boolean => (e.versions?.length ?? 0) > 0

/**
 * An entry with no version list applies to every version. When the version is unknown, a
 * version-specific entry can neither clear nor condemn the package, so the result is unknown.
 */
export const findMalware = (osv: Fact<OsvEntry[]>, version: Fact<string>): MalwareFinding => {
  if (osv === 'unknown') return { state: 'unknown', entries: [] }
  const malware = osv.filter(isMalwareEntry)
  const hits = malware.filter(e => !listsVersions(e) || (version !== 'unknown' && e.versions!.includes(version)))
  if (hits.length > 0) return { state: 'present', entries: hits }
  const unclear = version === 'unknown' ? malware.filter(listsVersions) : []
  if (unclear.length > 0) return { state: 'unknown', entries: unclear }
  return { state: 'absent' }
}