import type { ToolProfileDefinition } from '../../domain/tool-profile-definition';
import { commonSeverityMappings, commonStatusMappings } from '../common-normalization';

export const defenderForIotDefinition: ToolProfileDefinition = {
  schemaVersion: 1,
  id: 'defender-for-iot-vulnerabilities',
  securityScoring: {
    version: '1.0.0',
    native: { kind: 'unavailable', reason: 'Affected-device counts describe vulnerability reach, not a native security score.' },
    targets: [], resultPopulation: 'findings-only'
  },
  priorityBasis: {
    version: '1.0.0',
    basis: { kind: 'severity', properties: ['vulnerability.severity'] },
    excludedProperties: [
      { property: 'affected-device-count', reason: 'Vulnerability reach is not a criticality.' }
    ]
  },
  timeslotComparison: {
    version: '1.0.0', kind: 'unavailable',
    reason: 'The aggregated CVE export does not establish complete negative evidence for vulnerability remediation.'
  },
  name: 'Microsoft Defender for IoT',
  version: '1.2.0',
  processing: {
    mappingVersion: '1.0.0', normalizationVersion: '1.1.0', presentationVersion: '1.0.0',
    compatibilityKey: 'defender-for-iot-vulnerabilities-v2', changeClass: 'semantic-breaking',
    reimportRequired: true, affectedDimensions: ['recognition', 'extraction', 'finding-identity', 'evidence']
  },
  sourceSignals: [
    { scope: 'header', pattern: /^TotalCVEs$/i, contribution: 0.45, message: 'The asset summary exposes TotalCVEs.' },
    { scope: 'header', pattern: /^CVE$/i, contribution: 0.38, message: 'The detail table exposes CVE identifiers.' },
    { scope: 'header', pattern: /^Sensor$/i, contribution: 0.14, message: 'The source records a reporting sensor.' },
    { scope: 'header', pattern: /^Beschreibung$/i, contribution: 0.18, message: 'The detail table exposes the Defender CVE description field.' },
    { scope: 'header', pattern: /^Critical$/i, contribution: 0.1, message: 'The asset summary exposes Critical counts.' },
    { scope: 'header', pattern: /^Device ID$/i, contribution: 0.24, message: 'The source exposes the Defender device identifier.' },
    { scope: 'header', pattern: /^CVSS Score$/i, contribution: 0.2, message: 'The CVE export exposes a CVSS score.' },
    { scope: 'header', pattern: /^Component$/i, contribution: 0.1, message: 'The CVE export identifies the affected component.' }
  ],
  tableRules: {
    preferredNames: [
      { pattern: /asset|device|summary/i, contribution: 0.45, message: 'Likely asset summary table.' },
      { pattern: /vulnerab|cve|detail/i, contribution: 0.55, message: 'Likely vulnerability detail table.' }
    ],
    discouragedNames: []
  },
  fieldRules: [
    { role: 'rule-id', headers: [{ pattern: /^CVE$/i, contribution: 1, message: 'CVE is the source-native finding identifier.' }] },
    { role: 'description', headers: [{ pattern: /^(?:Beschreibung|Description)$/i, contribution: 1, message: 'The field contains the CVE description.' }] },
    { role: 'severity', headers: [{ pattern: /^Severity$/i, contribution: 1, message: 'The field contains the vulnerability severity.' }] },
    { role: 'asset', headers: [{ pattern: /^Affected Device Count$/i, contribution: 0.92, message: 'The aggregated affected-device count stands in for the affected object of this CVE.' }] },
    { role: 'evidence', headers: [{ pattern: /^Source Observations$/i, contribution: 1, message: 'The field preserves every sensor observation and row locator.' }] }
  ],
  normalization: { severity: commonSeverityMappings, status: commonStatusMappings, missingStatusOutcome: 'warning' },
  presentation: {
    titleHeaders: [/^CVE$/i],
    severityHeaders: [/^Severity$/i],
    sortHeaders: [/^Severity$/i],
    sortDirection: 'desc',
    defaultStatusFilter: 'deviation',
    statusFilters: [
      { value: 'all', label: 'All Vulnerabilities', patterns: [] },
      { value: 'deviation', label: 'Vulnerabilities', patterns: [/^critical$/i, /^high$/i, /^medium$/i, /^low$/i] }
    ],
    resultSectionHeaders: [/^Affected Devices$/i]
  },
  comparisonKeys: [['rule-id']]
};