common

var (
	// SuperglobalPattern matches PHP superglobal array access
	// e.g., $_GET['key'], $_POST["key"], $_REQUEST[$var]
	SuperglobalPattern = regexp.MustCompile(`\$_(GET|POST|COOKIE|REQUEST|SERVER|FILES|SESSION|ENV)\[['"]?([\w\-]+)['"]?\]`)

	// SuperglobalForeachPattern matches PHP foreach over superglobals
	// e.g., foreach ($_GET as $key => $value)
	SuperglobalForeachPattern = regexp.MustCompile(`foreach\s*\(\s*(\$_\w+)\s+as\s+\$(\w+)\s*=>\s*\$(\w+)\s*\)`)

	// SuperglobalSimplePattern matches just the superglobal name
	// e.g., $_GET, $_POST (without array access)
	SuperglobalSimplePattern = regexp.MustCompile(`\$_(GET|POST|COOKIE|REQUEST|SERVER|FILES|SESSION|ENV)`)
)

var (
	// MethodCallPattern matches object method calls
	// e.g., $obj->method(, $request->input(
	MethodCallPattern = regexp.MustCompile(`\$(\w+)->(\w+)\s*\(`)

	// MethodCallWithArgsPattern matches method calls with string arguments
	// e.g., $var->method('arg'), $var->method("arg")
	MethodCallWithArgsPattern = regexp.MustCompile(`\$(\w+)->(\w+)\s*\(\s*['"]([^'"]*)['"]\s*(?:,\s*[^)]+)?\s*\)`)

	// PropertyArrayPattern matches property with array access
	// e.g., $obj->data['key'], $request->query["param"]
	PropertyArrayPattern = regexp.MustCompile(`\$(\w+)->(\w+)\[['"]?([\w\-]+)['"]?\]`)

	// SimplePropertyPattern matches simple property access (no array, no method call)
	// e.g., $obj->data, $request->body
	SimplePropertyPattern = regexp.MustCompile(`\$(\w+)->(\w+)(?:[^\[\(]|$)`)
)

var (
	// InputMethodPattern matches universal PHP input method patterns
	// e.g., ->get_input(, ->getInput(, ->input(
	InputMethodPattern = regexp.MustCompile(`(?i)->(?:get_?)?(?:input|var|variable|query_?params?|parsed_?body|cookie_?params?|server_?params?|uploaded_?files?|headers?|all|post|cookie|param)s?\s*\(`)

	// InputPropertyPattern matches universal PHP input property patterns
	// e.g., ->input[, ->data[, ->request[
	InputPropertyPattern = regexp.MustCompile(`(?i)->(?:input|request|params?|query|cookies?|headers?|body|data|args?|post|get|files?|server|attributes?|payload)s?\[`)

	// InputObjectPattern matches objects that typically carry user input
	// NOTE: This is GENERIC - framework-specific objects are detected separately
	// e.g., $request, $input, $ctx, $context
	InputObjectPattern = regexp.MustCompile(`(?i)(request|input|req|params?|http|ctx|context|getRequest\(\)|getApplication\(\))`)
)

var (
	// ContextDependentMethodPattern matches methods that may be input getters
	// but need context to determine (e.g., ->get( could be cache get or input get)
	ContextDependentMethodPattern = regexp.MustCompile(`(?i)->(?:get_?)?(?:val|text|int|bool|array|raw_?val|check)\s*\(`)

	// ExcludeMethodPattern matches methods that look like input but aren't
	// e.g., ->getData( is often a generic getter, not input
	ExcludeMethodPattern = regexp.MustCompile(`(?i)->(?:getData|getBody|getContent|fetch|find|load|read)\s*\(`)
)

var (
	// JSRequestPattern matches common JS request object access
	// e.g., req.body, req.query, req.params, request.body
	JSRequestPattern = regexp.MustCompile(`(?:req|request|ctx)\.(?:body|query|params|cookies|headers|files?)`)

	// JSPropertyAccessPattern matches JS property access that may be input
	// e.g., ctx.request.body, event.body
	JSPropertyAccessPattern = regexp.MustCompile(`\b(\w+)\.(\w+)(?:\.(\w+))?`)
)

var (
	// PythonFlaskPattern matches Flask request access
	// e.g., request.form, request.args, request.json
	PythonFlaskPattern = regexp.MustCompile(`request\.(?:form|args|json|data|values|files|cookies|headers)`)

	// PythonDjangoPattern matches Django request access
	// e.g., request.GET, request.POST, request.COOKIES
	PythonDjangoPattern = regexp.MustCompile(`request\.(?:GET|POST|COOKIES|META|FILES|body|data)`)

	// PythonArgparsePattern matches argparse parsed args access
	// e.g., args.username, args.verbose
	PythonArgparsePattern = regexp.MustCompile(`args\.(\w+)`)
)

var (
	// GoRequestPattern matches Go http.Request access
	// e.g., r.URL.Query(), r.FormValue(, r.Header.Get(
	GoRequestPattern = regexp.MustCompile(`(?:r|req|request)\.(?:URL\.Query|FormValue|Header|Cookie|Body|Form|PostForm)`)

	// GoGinPattern matches Gin framework access
	// e.g., c.Query(, c.Param(, c.PostForm(
	GoGinPattern = regexp.MustCompile(`c\.(?:Query|Param|PostForm|GetHeader|Cookie|ShouldBind)`)

	// GoEchoPattern matches Echo framework access
	// e.g., c.QueryParam(, c.Param(, c.FormValue(
	GoEchoPattern = regexp.MustCompile(`c\.(?:QueryParam|Param|FormValue|Request)`)
)

var (
	// JavaServletPattern matches HttpServletRequest access
	// e.g., request.getParameter(, request.getHeader(
	JavaServletPattern = regexp.MustCompile(`(?:request|req|httpRequest)\.get(?:Parameter|Header|Cookie|Attribute|Session)\s*\(`)

	// JavaSpringPattern matches Spring annotation parameters
	// e.g., @RequestParam, @PathVariable, @RequestBody
	JavaSpringAnnotationPattern = regexp.MustCompile(`@(?:RequestParam|PathVariable|RequestBody|RequestHeader|CookieValue|ModelAttribute|RequestPart|MatrixVariable)`)
)

var (
	// CArgvPattern matches C main function argv access
	// e.g., argv[1], argv[i]
	CArgvPattern = regexp.MustCompile(`argv\s*\[\s*(\d+|\w+)\s*\]`)

	// CEnvPattern matches C environment access
	// e.g., getenv("PATH"), envp[0]
	CEnvPattern = regexp.MustCompile(`(?:getenv\s*\(|envp\s*\[|environ\s*\[)`)

	// CStdinPattern matches C stdin reads
	// e.g., scanf(, gets(, fgets(stdin
	CStdinPattern = regexp.MustCompile(`(?:scanf|gets|fgets|getchar|getc|getline)\s*\(`)
)

var AllSourceTypes = core.AllSourceTypes

var LanguageKeywords = map[string][]string{
	"php": {
		"isset", "empty", "unset", "echo", "print",
		"is_null", "is_string", "is_array", "is_int", "is_bool", "is_float",
		"array", "list", "global", "static",
	},
	"python": {
		"None", "True", "False", "and", "or", "not", "is", "in",
		"lambda", "pass", "with", "as", "global", "nonlocal",
		"assert", "raise", "except", "from",
	},
	"javascript": {
		"undefined", "null", "true", "false", "typeof", "instanceof",
		"arguments", "debugger", "delete", "void", "with",
		"NaN", "Infinity",
	},
	"typescript": {
		"undefined", "null", "true", "false", "typeof", "instanceof",
		"arguments", "debugger", "delete", "void", "with",
		"NaN", "Infinity", "keyof", "readonly", "infer", "never",
	},
	"go": {
		"nil", "true", "false", "iota",
		"make", "new", "append", "copy", "delete", "len", "cap",
		"panic", "recover", "defer", "go", "select", "chan",
		"range", "fallthrough", "goto", "map", "struct",
	},
	"java": {
		"null", "true", "false", "instanceof",
		"extends", "implements", "throws", "native", "synchronized",
		"volatile", "transient", "strictfp", "assert",
	},
	"c": {
		"NULL", "sizeof", "typedef", "extern", "register", "volatile",
		"inline", "restrict", "auto", "goto",
	},
	"cpp": {
		"NULL", "nullptr", "sizeof", "typedef", "extern", "register",
		"volatile", "inline", "restrict", "auto", "goto",
		"template", "typename", "virtual", "override", "delete",
		"constexpr", "noexcept", "decltype", "static_cast", "dynamic_cast",
	},
	"c_sharp": {
		"null", "true", "false", "typeof", "sizeof", "nameof",
		"checked", "unchecked", "lock", "fixed", "stackalloc",
		"internal", "sealed", "virtual", "override", "readonly",
		"ref", "out", "in", "params", "where", "default",
	},
	"ruby": {
		"nil", "true", "false", "self", "super",
		"defined?", "begin", "end", "rescue", "ensure", "raise",
		"alias", "undef", "redo", "retry", "yield",
	},
	"rust": {
		"true", "false", "self", "Self", "super", "crate",
		"move", "ref", "box", "dyn", "where", "unsafe",
		"extern", "mod", "pub", "priv", "loop", "match",
	},
}

var PHPInputPatterns = []InputPattern{

	{Regex: regexp.MustCompile(`\$_GET\[`), Name: "$_GET"},
	{Regex: regexp.MustCompile(`\$_POST\[`), Name: "$_POST"},
	{Regex: regexp.MustCompile(`\$_REQUEST\[`), Name: "$_REQUEST"},
	{Regex: regexp.MustCompile(`\$_COOKIE\[`), Name: "$_COOKIE"},
	{Regex: regexp.MustCompile(`\$_FILES\[`), Name: "$_FILES"},
	{Regex: regexp.MustCompile(`\$_SERVER\[`), Name: "$_SERVER"},

	{Regex: regexp.MustCompile(`\$request->input\(`), Name: "$request->input()"},
	{Regex: regexp.MustCompile(`\$request->get\(`), Name: "$request->get()"},
	{Regex: regexp.MustCompile(`\$request->post\(`), Name: "$request->post()"},
	{Regex: regexp.MustCompile(`\$request->query\[`), Name: "$request->query"},
	{Regex: regexp.MustCompile(`\$request->all\(`), Name: "$request->all()"},

	{Regex: regexp.MustCompile(`->getQueryParams\(`), Name: "->getQueryParams()"},
	{Regex: regexp.MustCompile(`->getParsedBody\(`), Name: "->getParsedBody()"},
	{Regex: regexp.MustCompile(`->getCookieParams\(`), Name: "->getCookieParams()"},
}

var UniversalKeywords = map[string]bool{

	"if": true, "else": true, "elseif": true, "elif": true,
	"switch": true, "case": true, "default": true,
	"for": true, "while": true, "do": true, "foreach": true,
	"break": true, "continue": true, "return": true,
	"try": true, "catch": true, "finally": true, "throw": true,

	"true": true, "false": true, "null": true, "nil": true, "undefined": true,
	"True": true, "False": true, "None": true,

	"and": true, "or": true, "not": true, "is": true, "in": true,

	"function": true, "func": true, "def": true, "fn": true,
	"var": true, "let": true, "const": true, "mut": true,
	"class": true, "interface": true, "struct": true, "enum": true,
	"type": true, "impl": true, "trait": true,

	"public": true, "private": true, "protected": true,
	"static": true, "final": true, "abstract": true,
	"async": true, "await": true, "yield": true,

	"new": true, "this": true, "self": true, "super": true,
	"instanceof": true, "typeof": true,

	"isset": true, "empty": true, "unset": true,
	"echo": true, "print": true,

	"import": true, "export": true, "require": true, "include": true,
	"use": true, "namespace": true, "package": true, "module": true,
}