// Parameter Analysis Detector - Analyzes URL query parameters for suspicious patterns

import { BaseDetector } from '../base-detector.js';

export class ParameterAnalysisDetector extends BaseDetector {
  constructor(config = {}) {
    super({
      name: 'parameter-analysis',
      category: 'url',
      version: '1.0.0',
      description: 'Detects suspicious query parameters in URLs',
      weight: 1,
      severity: 'medium',
      ...config
    });
  }

  async detect(target, ruleRegistry) {
    if (!target.url) {
      return this.createResult(false, [], 0);
    }

    const findings = [];
    const params = this.extractQueryParams(target.url);

    if (Object.keys(params).length === 0) {
      return this.createResult(false, [], 0);
    }

    const rules = ruleRegistry.getRules('url', 'parameter-patterns');

    if (!rules || !rules.suspiciousParams) {
      return this.createResult(false, [], 0);
    }

    // Check for suspicious parameter names
    for (const paramName of Object.keys(params)) {
      if (rules.suspiciousParams.includes(paramName.toLowerCase())) {
        findings.push(this.createFinding({
          pattern: `param:${paramName}`,
          matched: `${paramName}=${params[paramName]}`,
          description: `Suspicious query parameter: ${paramName}`,
          severity: 'medium',
          weight: 1,
          metadata: {
            parameterName: paramName,
            parameterValue: params[paramName]
          }
        }));
      }
    }

    const matched = findings.length > 0;
    const riskScore = findings.reduce((sum, f) => sum + (f.weight || 1), 0);

    return this.createResult(matched, findings, riskScore);
  }
}
