package cli

import (
	"fmt"
	"text/tabwriter"

	"github.com/spf13/cobra"
)

// labCmd groups commands for the bundled, legal-to-attack practice targets.
var labCmd = &cobra.Command{
	Use:   "lab",
	Short: "Bundled practice targets you can attack with one command",
	Long: "Pentest Swarm AI ships intentionally-vulnerable targets you can spin up on\n" +
		"localhost and attack legally. `lab list` shows them; `scan --lab --lab-target\n" +
		"<name>` runs one end to end (up → scan → teardown).",
}

var labListCmd = &cobra.Command{
	Use:   "list",
	Short: "List the bundled --lab targets",
	RunE: func(cmd *cobra.Command, args []string) error {
		targets := LabTargets()
		out := cmd.OutOrStdout()
		fmt.Fprintf(out, "Bundled practice targets (%d). Run one with:\n", len(targets))
		fmt.Fprintln(out, "  pentestswarm scan --lab --lab-target <name> --verify --follow")
		fmt.Fprintln(out)
		w := tabwriter.NewWriter(out, 0, 2, 2, ' ', 0)
		fmt.Fprintln(w, "NAME\tTARGET\tNOTES")
		for _, t := range targets {
			p := labProfiles[t.Name]
			note := t.Note
			if note == "" {
				note = "—"
			}
			fmt.Fprintf(w, "%s\t%s\t%s\n", t.Name, p.target, note)
		}
		_ = w.Flush()
		fmt.Fprintln(out)
		fmt.Fprintln(out, "More targets (run from upstream, then scan — see deploy/lab/<name>/):")
		fmt.Fprintln(out, "  vapi, hackazon  (recon auto-fingerprints their API surface)")
		fmt.Fprintln(out, "  dvws, brokencrystals  (OpenAPI auto-discovery + crawl)")
		fmt.Fprintln(out, "  pixi  (experimental — the prebuilt image's global CSRF blocks API exploitation)")
		return nil
	},
}

func init() {
	labCmd.AddCommand(labListCmd)
	rootCmd.AddCommand(labCmd)
}