/// Malware and security threat patterns for binary data scanning
/// 
/// This module contains pattern definitions for detecting malicious content
/// in model files, including:
/// - Executable file headers (PE, ELF, Mach-O)
/// - Script patterns (shebangs, imports, eval/exec)
/// - System commands and shell invocations
/// 
/// These patterns are shared across multiple validators (SafeTensors, Pickle, GGUF, etc.)

use crate::pattern_matching::Pattern;

/// Executable file headers (Windows PE, ELF, Mach-O, etc.)
/// 
/// These patterns detect if a file contains executable code, which should
/// NEVER appear in pure data formats like SafeTensors or NumPy arrays.
/// 
/// Detection indicates:
/// - Mislabeled files (e.g., .exe renamed to .safetensors)
/// - Supply chain attacks (executable injected into model file)
/// - Format exploits (crafted files exploiting parser bugs)
pub fn executable_header_patterns() -> Vec<Pattern> {
    vec![
        Pattern {
            bytes: b"MZ\x90\x00",
            description: "PE executable header (Windows .exe)",
            score: 3,
            
        },
        Pattern {
            bytes: b"\x7fELF\x01",
            description: "ELF executable header (Linux/Unix 32-bit)",
            score: 3,
            
        },
        Pattern {
            bytes: b"\x7fELF\x02",
            description: "ELF executable header (Linux/Unix 64-bit)",
            score: 3,
            
        },
        Pattern {
            bytes: b"\xfe\xed\xfa\xce",
            description: "Mach-O executable (macOS 32-bit)",
            score: 3,
            
        },
        Pattern {
            bytes: b"\xfe\xed\xfa\xcf",
            description: "Mach-O executable (macOS 64-bit)",
            score: 3,
            
        },
        Pattern {
            bytes: b"\xca\xfe\xba\xbe",
            description: "Mach-O universal binary (macOS)",
            score: 3,
            
        },
    ]
}

/// Script patterns (shebangs only - code execution patterns moved to SupplyChain)
/// 
/// These patterns detect embedded executable scripts in binary model files.
/// NOTE: eval/exec/system patterns are handled by SupplyChainValidator to avoid duplication.
pub fn script_patterns() -> Vec<Pattern> {
    vec![
        Pattern {
            bytes: b"#!/bin/sh",
            description: "Shell script shebang",
            score: 2,
            
        },
        Pattern {
            bytes: b"#!/bin/bash",
            description: "Bash script shebang",
            score: 2,
            
        },
        Pattern {
            bytes: b"#!/usr/bin/python",
            description: "Python script shebang",
            score: 2,
            
        },
        Pattern {
            bytes: b"#!/usr/bin/env",
            description: "Generic script shebang",
            score: 2,
            
        },
        // Removed eval/exec/__import__ patterns - these are now exclusively in SupplyChainValidator
        // to avoid redundant detection. SupplyChain is the authoritative source for code execution threats.
    ]
}

/// System command patterns (DEPRECATED - moved to SupplyChainValidator)
/// 
/// These patterns have been moved to SupplyChainValidator to eliminate redundancy.
/// ModelIntegrity should focus on format/structure, not code execution detection.
/// SupplyChain is the authoritative validator for malicious functions and system commands.
pub fn system_command_patterns() -> Vec<Pattern> {
    vec![
        // All patterns removed - now handled exclusively by SupplyChainValidator
        // to avoid redundant detection across multiple validators.
    ]
}

/// Get all malware/security patterns combined
/// 
/// This is the standard set used by most validators.
/// Individual validators can extend this with format-specific patterns.
pub fn all_malware_patterns() -> Vec<Pattern> {
    let mut patterns = Vec::new();
    patterns.extend(executable_header_patterns());
    patterns.extend(script_patterns());
    patterns.extend(system_command_patterns());
    patterns
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_pattern_counts() {
        let exec_patterns = executable_header_patterns();
        let script_patterns = script_patterns();
        let system_patterns = system_command_patterns();
        let all_patterns = all_malware_patterns();

        // Updated counts to match actual patterns (after refactoring to move patterns to SupplyChainValidator)
        assert_eq!(exec_patterns.len(), 6);
        assert_eq!(script_patterns.len(), 4); // Only shebangs remain
        assert_eq!(system_patterns.len(), 0); // Moved to SupplyChainValidator
        assert_eq!(all_patterns.len(), 10); // 6 + 4 + 0
    }

    #[test]
    fn test_pattern_scores() {
        let exec_patterns = executable_header_patterns();
        let script_patterns = script_patterns();

        // Executable headers should have highest score
        assert!(exec_patterns.iter().all(|p| p.score == 3));
        
        // Script patterns should have medium score
        assert!(script_patterns.iter().all(|p| p.score == 2));
        
        // System command patterns removed - now handled by SupplyChainValidator
    }

}

