// Path Analysis Detector - Analyzes URL paths for suspicious patterns
// Detects login/auth paths, verification flows, and suspicious endpoints

import { BaseDetector } from '../base-detector.js';

export class PathAnalysisDetector extends BaseDetector {
  constructor(config = {}) {
    super({
      name: 'path-analysis',
      category: 'url',
      version: '1.0.0',
      description: 'Detects suspicious URL path patterns commonly used in phishing',
      weight: 1,
      severity: 'medium',
      ...config
    });
  }

  async detect(target, ruleRegistry) {
    if (!target.url) {
      return this.createResult(false, [], 0);
    }

    const findings = [];
    const path = this.extractPath(target.url);

    if (!path || path === '/') {
      return this.createResult(false, [], 0);
    }

    const rules = ruleRegistry.getRules('url', 'path-patterns');

    if (!rules || !rules.patterns) {
      return this.createResult(false, [], 0);
    }

    // Check path patterns
    for (const rule of rules.patterns) {
      if (rule.regex && this.testPattern(rule.regex, path)) {
        findings.push(this.createFinding({
          pattern: rule.pattern,
          matched: path,
          description: rule.description,
          severity: rule.severity || 'medium',
          weight: rule.weight || 1,
          metadata: {
            ruleId: rule.id,
            path
          }
        }));
      }
    }

    const matched = findings.length > 0;
    const riskScore = findings.reduce((sum, f) => sum + (f.weight || 1), 0);

    return this.createResult(matched, findings, riskScore);
  }
}
