// src/core/security/defaults.ts

import type { ISupervisorSecurityPolicy } from './ISupervisorSecurityPolicy';

/**
 * Development security policy - PERMISSIVE, for development/testing ONLY.
 *
 * WARNING: This policy does NOT require capability tokens.
 * DO NOT use in production - use DEFAULT_SECURITY_POLICY instead.
 *
 * @deprecated Use DEFAULT_SECURITY_POLICY for production.
 */
export const DEVELOPMENT_SECURITY_POLICY: ISupervisorSecurityPolicy = {
  // Identity
  realm: 'development',

  // Allow new Function() for dynamic components (dev only)
  allowDynamicCompilation: true,

  // Child-to-parent (events bubbling up)
  childToParent: {
    requireCapability: false,
    verificationDepth: 'presence',
    auditLevel: 'none',
  },

  // Parent-to-child (context flowing down)
  parentToChild: {
    requireCapability: false,
    capabilityPolicy: 'inherit',
  },

  // Sibling communication
  siblingToSibling: {
    allowed: true,
    requireCapability: false,
    verificationDepth: 'presence',
    routeThrough: 'direct',
  },

  // External communication
  external: {
    requireCapability: false,
    verificationDepth: 'presence',
    auditLevel: 'summary',
  },

  // Delegation
  delegation: {
    maxChainLength: 10,
    allowCrossRealm: true,
    requireAttenuation: false,
  },

  // Revocation
  revocation: {
    checkFrequency: 'cached',
    cacheMaxAge: 60000, // 1 minute
    propagateToChildren: true,
  },
};

/**
 * Default security policy - SECURE, for production use.
 *
 * Vision 27 Section 6.1: "Every message MUST carry a capability token"
 * This policy enforces that requirement.
 *
 * PHASE 1 (Current): Requires capabilities with presence verification.
 * PHASE 2 (Future):  Add cryptographic signature verification.
 * PHASE 3 (Future):  Add full delegation chain verification.
 *
 * "Presence" verification still provides:
 * - Capability token must be present
 * - Token must not be expired
 * - Token must not be revoked
 * - Delegation chain checked for revocation (Mark Miller)
 */
export const DEFAULT_SECURITY_POLICY: ISupervisorSecurityPolicy = {
  // Identity
  realm: 'default',

  // SECURITY: Disable new Function() in production
  // Mark Miller: "new Function() bypasses all LISP security controls"
  allowDynamicCompilation: false,

  // Child-to-parent (events bubbling up)
  childToParent: {
    requireCapability: true,
    verificationDepth: 'presence', // Phase 2: upgrade to 'signature'
    auditLevel: 'summary',
  },

  // Parent-to-child (context flowing down)
  parentToChild: {
    requireCapability: true,
    capabilityPolicy: 'attenuate',
  },

  // Sibling communication
  siblingToSibling: {
    allowed: false, // Must go through parent
    requireCapability: true,
    verificationDepth: 'presence', // Phase 2: upgrade to 'signature'
    routeThrough: 'parent',
  },

  // External communication
  external: {
    requireCapability: true,
    verificationDepth: 'presence', // Phase 3: upgrade to 'full-chain'
    auditLevel: 'full',
    blockedSources: [], // Configure per deployment
  },

  // Delegation
  delegation: {
    maxChainLength: 3,
    allowCrossRealm: false,
    requireAttenuation: true,
  },

  // Revocation
  revocation: {
    checkFrequency: 'realtime',
    cacheMaxAge: 0,
    propagateToChildren: true,
  },
};

/**
 * Strict security policy - alias for DEFAULT_SECURITY_POLICY.
 *
 * @deprecated Use DEFAULT_SECURITY_POLICY directly (it is now secure by default).
 */
export const STRICT_SECURITY_POLICY: ISupervisorSecurityPolicy = DEFAULT_SECURITY_POLICY;

/**
 * Create a custom security policy by merging with secure defaults.
 *
 * Vision 27 Section 6.1: "Every message MUST carry a capability token"
 * The base policy is DEFAULT_SECURITY_POLICY which enforces this.
 */
export function createSecurityPolicy(
  overrides: Partial<ISupervisorSecurityPolicy>
): ISupervisorSecurityPolicy {
  return {
    ...DEFAULT_SECURITY_POLICY,
    ...overrides,
    childToParent: {
      ...DEFAULT_SECURITY_POLICY.childToParent,
      ...overrides.childToParent,
    },
    parentToChild: {
      ...DEFAULT_SECURITY_POLICY.parentToChild,
      ...overrides.parentToChild,
    },
    siblingToSibling: {
      ...DEFAULT_SECURITY_POLICY.siblingToSibling,
      ...overrides.siblingToSibling,
    },
    external: {
      ...DEFAULT_SECURITY_POLICY.external,
      ...overrides.external,
    },
    delegation: {
      ...DEFAULT_SECURITY_POLICY.delegation,
      ...overrides.delegation,
    },
    revocation: {
      ...DEFAULT_SECURITY_POLICY.revocation,
      ...overrides.revocation,
    },
  };
}

/**
 * Create a development security policy with optional overrides.
 *
 * WARNING: This creates a PERMISSIVE policy. Use only for development/testing.
 */
export function createDevelopmentPolicy(
  overrides: Partial<ISupervisorSecurityPolicy> = {}
): ISupervisorSecurityPolicy {
  return {
    ...DEVELOPMENT_SECURITY_POLICY,
    ...overrides,
    childToParent: {
      ...DEVELOPMENT_SECURITY_POLICY.childToParent,
      ...overrides.childToParent,
    },
    parentToChild: {
      ...DEVELOPMENT_SECURITY_POLICY.parentToChild,
      ...overrides.parentToChild,
    },
    siblingToSibling: {
      ...DEVELOPMENT_SECURITY_POLICY.siblingToSibling,
      ...overrides.siblingToSibling,
    },
    external: {
      ...DEVELOPMENT_SECURITY_POLICY.external,
      ...overrides.external,
    },
    delegation: {
      ...DEVELOPMENT_SECURITY_POLICY.delegation,
      ...overrides.delegation,
    },
    revocation: {
      ...DEVELOPMENT_SECURITY_POLICY.revocation,
      ...overrides.revocation,
    },
  };
}
