import { joinAnd } from '@socketsecurity/lib-stable/arrays/join'

import { SOCKET_WEBSITE_URL } from '../../constants/socket.mts'

import type { GhsaDetails } from '../../util/git/github.mts'

const GITHUB_ADVISORIES_URL = 'https://github.com/advisories'

// GHSA ID pattern: GHSA-xxxx-xxxx-xxxx (4 alphanumeric segments).

const GHSA_ID_PATTERN = /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/i

export function getSocketFixBranchName(ghsaId: string): string {

return `socket/fix/${ghsaId}`

}

export function getSocketFixBranchPattern(ghsaId?: string | undefined): RegExp {

// Escape special regex characters to prevent ReDoS attacks.

const pattern = ghsaId

? GHSA_ID_PATTERN.test(ghsaId)

? ghsaId

: ghsaId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')

: '.+'

return new RegExp(`^socket/fix/(${pattern})$`)

}

export function getSocketFixCommitMessage(

ghsaId: string,

details?: GhsaDetails | undefined,

): string {

const summary = details?.summary

return `fix: ${ghsaId}${summary ? ` - ${summary}` : ''}`

}

export function getSocketFixPullRequestBody(

ghsaIds: string[],

ghsaDetails?: Map<string, GhsaDetails> | undefined,

): string {

const vulnCount = ghsaIds.length

const firstGhsa = ghsaIds[0]

if (vulnCount === 1 && firstGhsa) {

const ghsaId = firstGhsa

const details = ghsaDetails?.get(ghsaId)

const body = `[Socket](${SOCKET_WEBSITE_URL}) fix for [${ghsaId}](${GITHUB_ADVISORIES_URL}/${ghsaId}).`

if (!details) {

return body

}

const packages = getUniquePackages(details)

return [

body,

'',

'',

`**Vulnerability Summary:** ${details.summary}`,

'',

`**Severity:** ${details.severity}`,

'',

`**Affected Packages:** ${joinAnd(packages)}`,

].join('\n')

}

return [

`[Socket](${SOCKET_WEBSITE_URL}) fixes for ${vulnCount} GHSAs.`,

'',

'**Fixed Vulnerabilities:**',

...ghsaIds.map(id => {

const details = ghsaDetails?.get(id)

const item = `- [${id}](${GITHUB_ADVISORIES_URL}/${id})`

if (details) {

const packages = getUniquePackages(details)

return `${item} - ${details.summary} (${joinAnd(packages)})`

}

return item

}),

].join('\n')

}

export function getSocketFixPullRequestTitle(ghsaIds: string[]): string {

const vulnCount = ghsaIds.length

const firstGhsa = ghsaIds[0]

return vulnCount === 1 && firstGhsa

? `Fix for ${firstGhsa}`

: `Fixes for ${vulnCount} GHSAs`

}

/**

* Extract unique package names with ecosystems from vulnerability details.

*/

export function getUniquePackages(details: GhsaDetails): string[] {

return [

...new Set(

details.vulnerabilities.nodes.map(

v => `${v.package.name} (${v.package.ecosystem})`,

),

),

]

}