import { Controller, Post, Body, HttpStatus, HttpException } from '@nestjs/common';
import { ApiTags, ApiOperation, ApiResponse, ApiBody } from '@nestjs/swagger';
import { BrokenAccessControlService } from './access-control.service';
import { TestResult } from './interface/access-control.interface';
import { RunBrokenAccessControlDto } from './dto/acess-control.dto';



@ApiTags('Broken Access Control Tests')
@Controller('api/security-tests')
export class BrokenAccessControlController {
  constructor(private readonly brokenAccessControlService: BrokenAccessControlService) {}

  @Post('broken-access-control')
  @ApiOperation({ summary: 'Run Broken Access Control Security Tests' })
  @ApiBody({ type: RunBrokenAccessControlDto })
  @ApiResponse({
    status: 201,
    description: 'Returns test results including vulnerabilities and secure endpoints.',
  })
  @ApiResponse({ status: 400, description: 'Invalid or missing URL.' })
  @ApiResponse({
    status: 500,
    description: 'Failed to run broken access control tests.',
  })
  async runBrokenAccessControlTests(@Body() body: RunBrokenAccessControlDto): Promise<{
    url: string;
    summary: {
      totalTests: number;
      vulnerabilitiesFound: number;
      secureEndpoints: number;
      criticalIssues: number;
      highIssues: number;
      mediumIssues: number;
      lowIssues: number;
    };
    vulnerabilities: {
      critical: TestResult[];
      high: TestResult[];
      medium: TestResult[];
      low: TestResult[];
    };
    secure: TestResult[];
  }> {
    try {
      if (!body.url) {
        throw new HttpException('URL is required', HttpStatus.BAD_REQUEST);
      }

      try {
        new URL(body.url);
      } catch {
        throw new HttpException('Invalid URL format', HttpStatus.BAD_REQUEST);
      }

      const results = await this.brokenAccessControlService.runAllTests(body.url);

      // If no links were found to test, respond with empty results
      if (!results || results.length === 0) {
        return {
          url: body.url,
          summary: {
            totalTests: 0,
            vulnerabilitiesFound: 0,
            secureEndpoints: 0,
            criticalIssues: 0,
            highIssues: 0,
            mediumIssues: 0,
            lowIssues: 0,
          },
          vulnerabilities: {
            critical: [],
            high: [],
            medium: [],
            low: [],
          },
          secure: [],
        };
      }

      const vulnerabilities = results.filter(r => r.success);
      const secure = results.filter(r => !r.success);

      const critical = vulnerabilities.filter(v => v.severity === 'critical');
      const high = vulnerabilities.filter(v => v.severity === 'High');
      const medium = vulnerabilities.filter(v => v.severity === 'Medium');
      const low = vulnerabilities.filter(v => v.severity === 'Low');

      return {
        url: body.url,
        summary: {
          totalTests: results.length,
          vulnerabilitiesFound: vulnerabilities.length,
          secureEndpoints: secure.length,
          criticalIssues: critical.length,
          highIssues: high.length,
          mediumIssues: medium.length,
          lowIssues: low.length,
        },
        vulnerabilities: {
          critical,
          high,
          medium,
          low,
        },
        secure,
      };
    } catch (error) {
      if (error instanceof HttpException) {
        throw error;
      }
      throw new HttpException(`Failed to run broken access control tests: ${error.message}`, HttpStatus.INTERNAL_SERVER_ERROR);
    }
  }
}