"""Hardcoded rule ID → SOC2/ISO27001 control mappings and remediation guidance."""

from dataclasses import dataclass


@dataclass
class ControlMapping:
    """Framework control mapping for a rule."""

    rule_id: str
    soc2_control: str
    iso27001_control: str
    remediation: str

    def framework_controls(self, framework: str) -> list[str]:
        """Return list of applicable framework controls."""
        controls = []
        if framework in ("soc2", "all"):
            controls.append(f"SOC2 {self.soc2_control}")
        if framework in ("iso27001", "all"):
            controls.append(f"ISO {self.iso27001_control}")
        return controls


REMEDIATION_MAP: dict[str, ControlMapping] = {
    "AP001": ControlMapping(
        rule_id="AP001",
        soc2_control="CC6.1",
        iso27001_control="A.14.1.2",
        remediation=(
            "Ensure all endpoints require authentication. "
            "Add `[Authorize]` / `@PreAuthorize` / middleware guard."
        ),
    ),
    "AP002": ControlMapping(
        rule_id="AP002",
        soc2_control="CC6.3",
        iso27001_control="A.14.1.2",
        remediation=(
            "Apply role-based access control. "
            "Restrict endpoint to minimum required role."
        ),
    ),
    "AP003": ControlMapping(
        rule_id="AP003",
        soc2_control="CC6.6",
        iso27001_control="A.14.2.5",
        remediation=(
            "Enforce consistent auth scheme. "
            "Remove mixed authenticated/public patterns on same resource."
        ),
    ),
    "AP004": ControlMapping(
        rule_id="AP004",
        soc2_control="CC6.1",
        iso27001_control="A.14.1.2",
        remediation=(
            "Auth entry points must be explicitly marked public. "
            "Add `[AllowAnonymous]` or equivalent."
        ),
    ),
    "AP005": ControlMapping(
        rule_id="AP005",
        soc2_control="CC6.3",
        iso27001_control="A.14.1.2",
        remediation=(
            "Privilege escalation risk. "
            "Validate caller role before granting elevated access."
        ),
    ),
    "AP006": ControlMapping(
        rule_id="AP006",
        soc2_control="CC6.3",
        iso27001_control="A.14.1.2",
        remediation=(
            "Restrict admin endpoints. "
            "Add explicit admin-role guard."
        ),
    ),
    "AP007": ControlMapping(
        rule_id="AP007",
        soc2_control="CC6.1",
        iso27001_control="A.14.2.1",
        remediation=(
            "Sensitive route exposed without protection. "
            "Add auth middleware."
        ),
    ),
    "AP008": ControlMapping(
        rule_id="AP008",
        soc2_control="CC6.6",
        iso27001_control="A.14.1.2",
        remediation=(
            "Public endpoint with sensitive operation. "
            "Require authentication."
        ),
    ),
    "AP101": ControlMapping(
        rule_id="AP101",
        soc2_control="CC6.1",
        iso27001_control="A.14.1.2",
        remediation=(
            "Broken access control. "
            "Enforce authorization on every handler."
        ),
    ),
    "AP102": ControlMapping(
        rule_id="AP102",
        soc2_control="CC6.7",
        iso27001_control="A.14.1.3",
        remediation=(
            "Weak/missing encryption. "
            "Use TLS 1.2+, strong cipher suites."
        ),
    ),
    "AP103": ControlMapping(
        rule_id="AP103",
        soc2_control="CC6.8",
        iso27001_control="A.14.2.5",
        remediation=(
            "Injection risk. "
            "Validate and sanitize all inputs. Use parameterized queries."
        ),
    ),
    "AP104": ControlMapping(
        rule_id="AP104",
        soc2_control="CC7.1",
        iso27001_control="A.14.2.1",
        remediation=(
            "Insecure design. "
            "Review threat model for this endpoint."
        ),
    ),
    "AP105": ControlMapping(
        rule_id="AP105",
        soc2_control="CC7.2",
        iso27001_control="A.14.2.2",
        remediation=(
            "Security misconfiguration. "
            "Harden defaults, remove debug endpoints."
        ),
    ),
    "AP106": ControlMapping(
        rule_id="AP106",
        soc2_control="CC6.8",
        iso27001_control="A.14.2.3",
        remediation=(
            "Vulnerable component. "
            "Update dependency to patched version."
        ),
    ),
    "AP107": ControlMapping(
        rule_id="AP107",
        soc2_control="CC6.1",
        iso27001_control="A.14.1.2",
        remediation=(
            "Authentication failure risk. "
            "Implement brute-force protection and MFA."
        ),
    ),
    "AP108": ControlMapping(
        rule_id="AP108",
        soc2_control="CC6.8",
        iso27001_control="A.14.2.5",
        remediation=(
            "SSRF risk. "
            "Validate and allowlist outbound URLs."
        ),
    ),
    "AP201": ControlMapping(
        rule_id="AP201",
        soc2_control="CC6.7",
        iso27001_control="A.14.1.3",
        remediation=(
            "Hardcoded secret detected. "
            "Remove from source, rotate credential, use secrets manager."
        ),
    ),
}


def get_mapping(rule_id: str) -> ControlMapping | None:
    """Return the control mapping for a rule ID, or None if not found."""
    return REMEDIATION_MAP.get(rule_id)
