<?php

declare(strict_types=1);

namespace App\Framework\Waf\Rules;

/**
 * Types of WAF security rules
 */
enum RuleType: string
{
    case PATTERN_MATCH = 'pattern_match';
    case REGEX_MATCH = 'regex_match';
    case HEADER_CHECK = 'header_check';
    case PARAMETER_CHECK = 'parameter_check';
    case BODY_CHECK = 'body_check';
    case SIZE_LIMIT = 'size_limit';
    case RATE_LIMIT = 'rate_limit';
    case IP_WHITELIST = 'ip_whitelist';
    case IP_BLACKLIST = 'ip_blacklist';
    case GEOGRAPHIC_FILTER = 'geographic_filter';
    case USER_AGENT_CHECK = 'user_agent_check';
    case CONTENT_TYPE_CHECK = 'content_type_check';
    case METHOD_CHECK = 'method_check';
    case PATH_CHECK = 'path_check';
    case COOKIE_CHECK = 'cookie_check';

    /**
     * Get rule type description
     */
    public function getDescription(): string
    {
        return match ($this) {
            self::PATTERN_MATCH => 'Pattern-based string matching',
            self::REGEX_MATCH => 'Regular expression matching',
            self::HEADER_CHECK => 'HTTP header validation',
            self::PARAMETER_CHECK => 'Query/form parameter validation',
            self::BODY_CHECK => 'Request body content validation',
            self::SIZE_LIMIT => 'Content size limitations',
            self::RATE_LIMIT => 'Request rate limiting',
            self::IP_WHITELIST => 'IP address whitelist check',
            self::IP_BLACKLIST => 'IP address blacklist check',
            self::GEOGRAPHIC_FILTER => 'Geographic location filtering',
            self::USER_AGENT_CHECK => 'User agent validation',
            self::CONTENT_TYPE_CHECK => 'Content-Type header validation',
            self::METHOD_CHECK => 'HTTP method validation',
            self::PATH_CHECK => 'URL path validation',
            self::COOKIE_CHECK => 'Cookie validation'
        };
    }

    /**
     * Get default processing priority
     */
    public function getDefaultPriority(): int
    {
        return match ($this) {
            self::IP_WHITELIST => 100,          // Process first - bypass other rules
            self::IP_BLACKLIST => 95,           // Block malicious IPs early
            self::RATE_LIMIT => 90,             // Rate limiting before content analysis
            self::METHOD_CHECK => 85,           // HTTP method validation
            self::SIZE_LIMIT => 80,             // Size checks before content parsing
            self::CONTENT_TYPE_CHECK => 75,     // Content type validation
            self::HEADER_CHECK => 70,           // Header validation
            self::PATH_CHECK => 65,             // Path validation
            self::GEOGRAPHIC_FILTER => 60,      // Geographic filtering
            self::USER_AGENT_CHECK => 55,       // User agent checks
            self::COOKIE_CHECK => 50,           // Cookie validation
            self::PARAMETER_CHECK => 45,        // Parameter validation
            self::BODY_CHECK => 40,             // Body content analysis
            self::PATTERN_MATCH => 35,          // Pattern matching
            self::REGEX_MATCH => 30             // Complex regex last (most expensive)
        };
    }

    /**
     * Check if rule type requires request body
     */
    public function requiresBody(): bool
    {
        return match ($this) {
            self::BODY_CHECK, self::PARAMETER_CHECK => true,
            default => false
        };
    }

    /**
     * Check if rule type is computationally expensive
     */
    public function isExpensive(): bool
    {
        return match ($this) {
            self::REGEX_MATCH, self::BODY_CHECK, self::PATTERN_MATCH => true,
            default => false
        };
    }

    /**
     * Check if rule type can cause false positives
     */
    public function canCauseFalsePositives(): bool
    {
        return match ($this) {
            self::PATTERN_MATCH, self::REGEX_MATCH, self::BODY_CHECK,
            self::PARAMETER_CHECK, self::USER_AGENT_CHECK => true,
            default => false
        };
    }

    /**
     * Get expected processing time category
     */
    public function getProcessingTimeCategory(): string
    {
        return match ($this) {
            self::IP_WHITELIST, self::IP_BLACKLIST, self::METHOD_CHECK => 'fast',
            self::HEADER_CHECK, self::PATH_CHECK, self::SIZE_LIMIT => 'medium',
            self::REGEX_MATCH, self::BODY_CHECK, self::PATTERN_MATCH => 'slow',
            default => 'medium'
        };
    }

    /**
     * Check if rule type supports caching
     */
    public function supportsCaching(): bool
    {
        return match ($this) {
            self::IP_WHITELIST, self::IP_BLACKLIST, self::GEOGRAPHIC_FILTER => true,
            default => false
        };
    }
}
