module

var (
	ErrPlanNotFound               = fmt.Errorf("%w: plan not found", shared.ErrNotFound)
	ErrPlanSlugExists             = fmt.Errorf("%w: plan slug already exists", shared.ErrConflict)
	ErrModuleNotFound             = fmt.Errorf("%w: module not found", shared.ErrNotFound)
	ErrEventTypeNotFound          = fmt.Errorf("%w: event type not found", shared.ErrNotFound)
	ErrSubscriptionNotFound       = fmt.Errorf("%w: subscription not found", shared.ErrNotFound)
	ErrInvalidPlanID              = fmt.Errorf("%w: invalid plan ID format", shared.ErrValidation)
	ErrInvalidModuleID            = fmt.Errorf("%w: invalid module ID format", shared.ErrValidation)
	ErrInvalidSubModuleID         = fmt.Errorf("%w: invalid sub-module ID format", shared.ErrValidation)
	ErrCoreModuleCannotBeDisabled = fmt.Errorf("%w: core module cannot be disabled", shared.ErrValidation)
	ErrModuleNotAvailable         = fmt.Errorf("%w: module is not available", shared.ErrValidation)
)

var CategoryDisplayNames = map[string]string{
	EventCategorySystem:      "System",
	EventCategoryAsset:       "Assets",
	EventCategoryScan:        "Scans",
	EventCategoryFinding:     "Findings",
	EventCategoryExposure:    "Exposures",
	EventCategoryCredential:  "Credentials",
	EventCategoryPentest:     "Penetration Testing",
	EventCategoryRemediation: "Remediation",
	EventCategoryComponent:   "Components",
	EventCategoryThreatIntel: "Threat Intelligence",
}

var CoreModuleIDs = map[string]bool{
	ModuleDashboard: true,
	ModuleAssets:    true,
	ModuleFindings:  true,
	ModuleScans:     true,
	ModuleTeam:      true,
	ModuleRoles:     true,
	ModuleAudit:     true,
	ModuleSettings:  true,
}

var MandatoryModuleIDs = map[string]bool{
	"agents":                     true,
	"notification_settings":      true,
	"integrations":               true,
	"integrations.notifications": true,
	"groups":                     true,
	"api_keys":                   true,
}

var ModuleDependencies = map[string][]Dependency{

	"attack_surface": {
		{ModuleID: "assets", Type: DependencyHard, Reason: "attack surface is computed from assets"},
	},
	"scope_config": {
		{ModuleID: "assets", Type: DependencyHard, Reason: "scope rules select assets"},
	},
	"business_services": {
		{ModuleID: "assets", Type: DependencyHard, Reason: "services map to underlying assets"},
	},
	"ctem_cycles": {
		{ModuleID: "scope_config", Type: DependencyHard, Reason: "cycles operate on a defined scope"},
		{ModuleID: "findings", Type: DependencySoft, Reason: "cycle phases reference findings progress"},
	},
	"relationships": {
		{ModuleID: "assets", Type: DependencyHard, Reason: "relationships are between assets"},
	},

	"credentials": {
		{ModuleID: "assets", Type: DependencyHard, Reason: "leaked credentials are scoped to assets"},
	},
	"components": {
		{ModuleID: "assets", Type: DependencyHard, Reason: "components belong to assets (repos, images, runtimes)"},
	},
	"branches": {
		{ModuleID: "assets", Type: DependencyHard, Reason: "branches belong to repository assets"},
		{ModuleID: "components", Type: DependencySoft, Reason: "branch views surface component inventories per branch"},
	},
	"vulnerabilities": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "vulnerability views list findings of type=vulnerability"},
	},

	"threat_intel": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "threat intel enriches findings"},
	},
	"exposures": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "an exposure is a finding in a specific lifecycle state"},
	},
	"ai_triage": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "triage operates on findings"},
		{ModuleID: "threat_intel", Type: DependencySoft, Reason: "triage uses KEV/EPSS context when scoring"},
	},
	"priority_rules": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "rules classify findings"},
		{ModuleID: "threat_intel", Type: DependencySoft, Reason: "rule conditions often reference KEV/EPSS"},
	},
	"risk_analysis": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "risk scoring reads finding severity + exposure"},
		{ModuleID: "assets", Type: DependencyHard, Reason: "per-asset risk requires the asset inventory"},
	},
	"business_impact": {
		{ModuleID: "business_services", Type: DependencyHard, Reason: "impact scoring is weighted by business-service mapping"},
		{ModuleID: "findings", Type: DependencyHard, Reason: "impact is computed from finding severity × service weight"},
	},
	"risk_scoring": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "risk scoring operates on findings"},
	},

	"pentest": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "pentest campaigns produce findings"},
	},
	"attack_simulation": {
		{ModuleID: "attacker_profiles", Type: DependencyHard, Reason: "simulation requires an attacker profile to emulate"},
		{ModuleID: "assets", Type: DependencyHard, Reason: "simulation needs target assets"},
	},
	"control_testing": {
		{ModuleID: "compensating_controls", Type: DependencyHard, Reason: "control testing validates compensating controls"},
	},
	"compensating_controls": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "compensating controls reduce severity of findings"},
	},

	"remediation": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "remediation closes findings"},
	},
	"remediation_tasks": {
		{ModuleID: "remediation", Type: DependencyHard, Reason: "tasks are the operator-facing queue of the remediation engine"},
	},
	"workflows": {

		{ModuleID: "findings", Type: DependencySoft, Reason: "finding-lifecycle triggers are a subset of workflow triggers"},
		{ModuleID: "integrations", Type: DependencySoft, Reason: "most workflow actions route through integrations (Jira, Slack)"},
	},
	"suppressions": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "suppressions suppress findings"},
	},
	"sla": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "SLA tracks time-to-remediate per finding"},
	},
	"policies": {
		{ModuleID: "findings", Type: DependencySoft, Reason: "most policy checks classify findings"},
	},
	"compliance": {
		{ModuleID: "findings", Type: DependencySoft, Reason: "compliance reports aggregate findings against frameworks"},
	},
	"iocs": {
		{ModuleID: "threat_intel", Type: DependencySoft, Reason: "IOC enrichment pulls from threat intel feeds"},
	},
	"scan_profiles": {
		{ModuleID: "scans", Type: DependencyHard, Reason: "profiles are parameterised scan configurations"},
	},

	"reports": {
		{ModuleID: "findings", Type: DependencySoft, Reason: "most report types render finding data"},
	},
	"executive_summary": {
		{ModuleID: "findings", Type: DependencyHard, Reason: "exec summary rolls up finding metrics"},
		{ModuleID: "scans", Type: DependencySoft, Reason: "scan coverage metrics appear on the summary"},
	},
	"ctem_maturity": {
		{ModuleID: "ctem_cycles", Type: DependencyHard, Reason: "maturity is computed across CTEM cycles"},
		{ModuleID: "findings", Type: DependencySoft, Reason: "F3/B4 invariants rely on finding SLA data"},
	},
	"mitre_coverage": {
		{ModuleID: "threat_intel", Type: DependencyHard, Reason: "coverage maps detections to MITRE techniques"},
		{ModuleID: "compensating_controls", Type: DependencySoft, Reason: "control coverage appears on the heatmap"},
	},
	"sbom_export": {
		{ModuleID: "components", Type: DependencyHard, Reason: "SBOM is generated from the component inventory"},
	},

	"scanner_templates": {
		{ModuleID: "scans", Type: DependencyHard, Reason: "templates are consumed by scans"},
	},
	"template_sources": {
		{ModuleID: "scanner_templates", Type: DependencyHard, Reason: "sources feed the template catalogue"},
	},
	"scan_pipelines": {
		{ModuleID: "scans", Type: DependencyHard, Reason: "pipelines orchestrate scan runs"},
		{ModuleID: "scanner_templates", Type: DependencySoft, Reason: "pipelines typically invoke templates"},
	},
}

var ModulePermissionMapping = map[string]string{

	ModuleDashboard: "dashboard:read",
	ModuleAssets:    "assets:read",
	ModuleFindings:  "findings:read",
	ModuleScans:     "scans:read",

	ModuleCredentials:     "findings:credentials:read",
	ModuleComponents:      "assets:components:read",
	ModuleBranches:        "assets:read",
	ModuleVulnerabilities: "findings:vulnerabilities:read",

	ModuleThreatIntel: "threat_intel:read",
	ModuleExposures:   "findings:exposures:read",
	ModuleAITriage:    "ai_triage:read",
	ModuleSLA:         "settings:sla:read",

	ModulePentest: "pentest:campaigns:read",

	ModuleCompliance: "compliance:frameworks:read",

	ModuleRemediation:  "findings:remediation:read",
	ModuleSuppressions: "findings:suppressions:read",
	ModulePolicies:     "findings:policies:read",

	ModuleReports: "reports:read",
	ModuleAudit:   "audit:read",

	ModuleIntegrations:         "integrations:read",
	ModuleAgents:               "agents:read",
	ModuleTeam:                 "team:read",
	ModuleGroups:               "team:groups:read",
	ModuleRoles:                "team:roles:read",
	ModuleSettings:             "settings:read",
	ModuleAPIKeys:              "integrations:api_keys:read",
	ModuleWebhooks:             "integrations:webhooks:read",
	ModuleNotificationSettings: "integrations:notifications:read",

	ModuleSources: "scans:sources:read",
	ModuleSecrets: "scans:secret_store:read",
	ModuleScope:   "attack_surface:scope:read",

	ModulePipelines:    "integrations:pipelines:read",
	ModuleTools:        "scans:tools:read",
	ModuleScanProfiles: "scans:profiles:read",
	ModuleIOCs:         "threat_intel:read",

	ModuleAttackSurface:    "attack_surface:read",
	ModuleScopeConfig:      "attack_surface:scope:read",
	ModuleBusinessServices: "attack_surface:business_services:read",
	ModuleCTEMCycles:       "attack_surface:cycles:read",
	ModuleAttackerProfiles: "threat_intel:read",
	ModuleRelationships:    "assets:read",

	ModulePriorityRules:  "findings:read",
	ModuleRiskAnalysis:   "findings:read",
	ModuleBusinessImpact: "attack_surface:business_services:read",
	ModuleRiskScoring:    "settings:read",

	ModuleCompensatingControls: "findings:compensating_controls:read",

	ModuleWorkflows:        "findings:workflows:read",
	ModuleRemediationTasks: "findings:remediation:read",

	ModuleCTEMMaturity:     "dashboard:read",
	ModuleExecutiveSummary: "reports:read",
	ModuleMITRECoverage:    "threat_intel:read",
	ModuleSBOMExport:       "assets:components:read",

	ModuleScannerTemplates: "scans:templates:read",
	ModuleTemplateSources:  "scans:templates:read",
	ModuleScanPipelines:    "scans:pipelines:read",
}

var ModulePresets = []ModulePreset{
	presetMinimal,
	presetAssetInventory,
	presetVMEssentials,
	presetASM,
	presetOffensive,
	presetSBOM,
	presetCSPM,
	presetCompliance,
	presetCTEMFull,
}

var UserFacingModuleIDs = map[string]bool{

	ModuleDashboard: true,
	ModuleAssets:    true,
	ModuleFindings:  true,
	ModuleScans:     true,
	ModuleTeam:      true,
	ModuleRoles:     true,
	ModuleAudit:     true,
	ModuleSettings:  true,

	ModuleCredentials:      true,
	ModuleComponents:       true,
	ModuleExposures:        true,
	ModuleThreatIntel:      true,
	ModulePentest:          true,
	ModuleAttackSimulation: true,
	ModuleControlTesting:   true,
	ModuleCompliance:       true,
	ModuleRemediation:      true,
	ModuleReports:          true,
	ModuleIntegrations:     true,

	ModuleAttackSurface:    true,
	ModuleScopeConfig:      true,
	ModuleBusinessServices: true,
	ModuleCTEMCycles:       true,
	ModuleAttackerProfiles: true,
	ModuleRelationships:    true,

	ModulePriorityRules:  true,
	ModuleRiskAnalysis:   true,
	ModuleBusinessImpact: true,
	ModuleRiskScoring:    true,

	ModuleCompensatingControls: true,

	ModuleWorkflows:        true,
	ModuleRemediationTasks: true,

	ModuleCTEMMaturity:     true,
	ModuleExecutiveSummary: true,
	ModuleMITRECoverage:    true,
	ModuleSBOMExport:       true,

	ModuleScannerTemplates: true,
	ModuleTemplateSources:  true,
	ModuleScanPipelines:    true,
}