import { FileScanner } from 'pompelmi';
import { execSync } from 'child_process';
import path from 'path';

class DependencyScanner {
  constructor() {
    this.scanner = new FileScanner({
      // Specialized rules for package scanning
      enableSupplyChainDetection: true,
      packageAnalysis: {
        scanInstallScripts: true,
        checkCodeSigning: true,
        validatePublishers: true,
        detectSuspiciousPatterns: true
      }
    });

    this.trustedPublishers = new Set([
      'npm-official',
      'verified-org',
      // Add your trusted publishers
    ]);
  }

  async auditPackages() {
    console.log('🔍 Scanning dependencies for security threats...');

    // Get package list
    const packages = this.getInstalledPackages();
    const threats = [];

    for (const pkg of packages) {
      try {
        const result = await this.scanPackage(pkg);
        if (result.threats.length > 0) {
          threats.push(...result.threats);
        }
      } catch (error) {
        console.error(`Failed to scan package ${pkg.name}:`, error.message);
      }
    }

    if (threats.length > 0) {
      this.reportThreats(threats);
      process.exit(1); // Fail the build
    }

    console.log('✅ All dependencies passed security scan');
  }

  async scanPackage(pkg) {
    const packagePath = path.join('node_modules', pkg.name);
    const threats = [];

    // Scan package files
    const scanResult = await this.scanner.scanDirectory(packagePath);

    if (scanResult.verdict !== 'clean') {
      threats.push({
        package: pkg.name,
        version: pkg.version,
        threats: scanResult.findings,
        severity: 'high'
      });
    }

    // Check install scripts
    const installScriptThreats = await this.scanInstallScripts(pkg);
    threats.push(...installScriptThreats);

    // Verify publisher
    const publisherThreat = await this.verifyPublisher(pkg);
    if (publisherThreat) threats.push(publisherThreat);

    return { threats };
  }

  async scanInstallScripts(pkg) {
    const packageJson = require(`node_modules/${pkg.name}/package.json`);
    const threats = [];

    const dangerousScripts = ['preinstall', 'install', 'postinstall'];

    for (const scriptType of dangerousScripts) {
      if (packageJson.scripts?.[scriptType]) {
        const script = packageJson.scripts[scriptType];

        // Scan for suspicious patterns
        const suspiciousPatterns = [
          /curl\s+.*\|\s*(bash|sh)/i,     // Download and execute
          /wget\s+.*\|\s*(bash|sh)/i,     // Download and execute
          /rm\s+-rf\s+\//i,               // Dangerous file operations
          /chmod\s+\+x/i,                 // Making files executable
          /eval\s*\(/i,                   // Dynamic code execution
          /process\.env\[['"][A-Z_]+['"]\]/i, // Environment access
        ];

        for (const pattern of suspiciousPatterns) {
          if (pattern.test(script)) {
            threats.push({
              package: pkg.name,
              type: 'suspicious_install_script',
              script: scriptType,
              content: script,
              severity: 'medium'
            });
          }
        }
      }
    }

    return threats;
  }

  async verifyPublisher(pkg) {
    try {
      // Check package registry info
      const registryInfo = await this.getRegistryInfo(pkg.name);

      // Verify publisher is trusted
      if (!this.trustedPublishers.has(registryInfo.publisher)) {
        // Check if it's a new/suspicious publisher
        if (registryInfo.publisherAge < 30) { // Less than 30 days
          return {
            package: pkg.name,
            type: 'untrusted_publisher',
            publisher: registryInfo.publisher,
            publisherAge: registryInfo.publisherAge,
            severity: 'medium'
          };
        }
      }

      // Check for typosquatting
      const legitimatePackages = ['react', 'express', 'lodash', 'axios'];
      for (const legitimate of legitimatePackages) {
        if (this.isTyposquat(pkg.name, legitimate)) {
          return {
            package: pkg.name,
            type: 'potential_typosquat',
            targetPackage: legitimate,
            severity: 'high'
          };
        }
      }

    } catch (error) {
      console.warn(`Could not verify publisher for ${pkg.name}:`, error.message);
    }

    return null;
  }

  isTyposquat(packageName, targetName) {
    // Simple Levenshtein distance check
    if (packageName === targetName) return false;

    const distance = this.levenshteinDistance(packageName, targetName);
    const similarity = 1 - (distance / Math.max(packageName.length, targetName.length));

    // If packages are very similar but not identical, flag as potential typosquat
    return similarity > 0.8 && similarity < 1.0;
  }

  levenshteinDistance(str1, str2) {
    const matrix = Array(str2.length + 1).fill().map(() => Array(str1.length + 1).fill(0));

    for (let i = 0; i <= str1.length; i++) matrix[0][i] = i;
    for (let j = 0; j <= str2.length; j++) matrix[j][0] = j;

    for (let j = 1; j <= str2.length; j++) {
      for (let i = 1; i <= str1.length; i++) {
        const cost = str1[i - 1] === str2[j - 1] ? 0 : 1;
        matrix[j][i] = Math.min(
          matrix[j][i - 1] + 1,     // deletion
          matrix[j - 1][i] + 1,     // insertion
          matrix[j - 1][i - 1] + cost // substitution
        );
      }
    }

    return matrix[str2.length][str1.length];
  }
}

// Run the audit
const scanner = new DependencyScanner();
scanner.auditPackages().catch(console.error);

# Pinned versions with integrity checks
requests==2.28.2 --hash=sha256:64299f4909223da747622c030b781c0d7811e359c37124b4bd368fb8c6518baa
flask==2.2.3 --hash=sha256:7eb373984bf1c770023716b98c4b2a9b5b1b5d6b1c4e3d1e4b5a1a2b3c4d5e6f

# Security scanning integration
pommelmi-python>=1.0.0

def audit_python_packages():
    """Audit Python packages for security threats"""
    import subprocess
    import json
    from pompelmi import PythonPackageScanner

    # Get installed packages
    result = subprocess.run([
        'pip', 'list', '--format=json'
    ], capture_output=True, text=True)

    packages = json.loads(result.stdout)
    scanner = PythonPackageScanner()

    for package in packages:
        # Scan package for threats
        scan_result = scanner.scan_package(
            package['name'],
            package['version']
        )

        if scan_result.verdict != 'clean':
            print(f"⚠️  Threat detected in {package['name']}:")
            for finding in scan_result.findings:
                print(f"   - {finding.description}")

            # Quarantine malicious packages
            if scan_result.verdict == 'malicious':
                subprocess.run(['pip', 'uninstall', '-y', package['name']])
                print(f"🚨 Removed malicious package: {package['name']}")

if __name__ == '__main__':
    audit_python_packages()

name: Supply Chain Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Daily security audit
    - cron: '0 2 * * *'

jobs:
  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Install Pompelmi CLI
        run: npm install -g @pompelmi/cli

      - name: Audit Dependencies
        run: |
          # Scan package.json for suspicious dependencies
          pompelmi scan-deps --strict --report=sarif

          # Scan installed packages
          npm audit --audit-level=moderate

          # Custom security checks
          node scripts/supply-chain-audit.js

      - name: Upload Security Report
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: security-report.sarif

  container-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker Image
        run: docker build -t app:test .

      - name: Scan Container for Malicious Files
        run: |
          # Extract container filesystem
          docker create --name temp app:test
          docker export temp | tar -x -C /tmp/container

          # Scan extracted files
          pompelmi scan-directory /tmp/container \
            --exclude=/tmp/container/proc \
            --exclude=/tmp/container/sys \
            --report=json > container-scan.json

          # Check for threats
          if jq -e '.threats[] | select(.severity == "high")' container-scan.json; then
            echo "High severity threats found in container"
            exit 1
          fi

  supply-chain-monitor:
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    steps:
      - name: Monitor Supply Chain Changes
        run: |
          # Check for new dependencies
          git diff HEAD~1 HEAD package.json | grep '^+' | grep -E '(dependencies|devDependencies)'

          # Alert on suspicious changes
          node scripts/monitor-changes.js

const PompelmiWebpackPlugin = require('@pompelmi/webpack-plugin');

module.exports = {
  // ... other config

  plugins: [
    new PompelmiWebpackPlugin({
      // Scan all imported modules
      scanImports: true,

      // Scan dynamically loaded code
      scanDynamicImports: true,

      // Fail build on threats
      failOnThreats: true,

      // Custom rules for build-time scanning
      rules: [
        'build-time-threats.yar',
        'suspicious-imports.yar'
      ],

      // Report generation
      reports: {
        console: true,
        json: './build-security-report.json',
        sarif: './build-security.sarif'
      }
    })
  ]
};

// Custom build security plugin
class BuildSecurityPlugin {
  apply(compiler) {
    compiler.hooks.compilation.tap('BuildSecurityPlugin', (compilation) => {
      compilation.hooks.seal.tapAsync('BuildSecurityPlugin', async (callback) => {
        // Scan all modules in the compilation
        for (const module of compilation.modules) {
          if (module.resource) {
            await this.scanModule(module);
          }
        }
        callback();
      });
    });
  }

  async scanModule(module) {
    const scanner = new FileScanner({
      enableSupplyChainDetection: true,
      buildTimeAnalysis: true
    });

    try {
      const result = await scanner.scanFile(module.resource);

      if (result.verdict === 'malicious') {
        throw new Error(
          `Malicious code detected in module: ${module.resource}\n` +
          `Threats: ${result.findings.map(f => f.title).join(', ')}`
        );
      }

      if (result.verdict === 'suspicious') {
        console.warn(
          `⚠️  Suspicious code in module: ${module.resource}\n` +
          `Warnings: ${result.findings.map(f => f.title).join(', ')}`
        );
      }

    } catch (error) {
      console.error(`Security scan failed for ${module.resource}:`, error);
      throw error;
    }
  }
}

#!/bin/sh
# Scan staged files before commit

echo "🔍 Running pre-commit security scan..."

# Get staged files
STAGED_FILES=$(git diff --cached --name-only)

# Scan staged files for threats
for file in $STAGED_FILES; do
  if [[ -f "$file" ]]; then
    # Scan file with Pompelmi
    if ! pompelmi scan "$file" --quiet; then
      echo "🚨 Security threat detected in: $file"
      echo "Commit blocked for security reasons"
      exit 1
    fi
  fi
done

# Additional checks for package files
if [[ " $STAGED_FILES " =~ " package.json " ]] || [[ " $STAGED_FILES " =~ " package-lock.json " ]]; then
  echo "📦 Package files modified, running dependency audit..."

  if ! node scripts/audit-new-dependencies.js; then
    echo "🚨 Dependency audit failed"
    exit 1
  fi
fi

# Check for secrets in code
if command -v truffleHog > /dev/null; then
  echo "🔐 Scanning for secrets..."
  truffleHog git file://. --since_commit HEAD~1 --only-verified
fi

echo "✅ Pre-commit security checks passed"

resource "aws_lambda_function" "supply_chain_scanner" {
  filename         = "supply-chain-scanner.zip"
  function_name    = "supply-chain-security"
  role            = aws_iam_role.scanner_role.arn
  handler         = "index.handler"
  runtime         = "nodejs18.x"

  environment {
    variables = {
      POMPELMI_API_KEY = var.pompelmi_api_key
      THREAT_WEBHOOK   = var.security_webhook_url
    }
  }
}

# Scan all uploaded artifacts
resource "aws_s3_bucket_notification" "artifact_scan" {
  bucket = aws_s3_bucket.artifacts.id

  lambda_function {
    lambda_function_arn = aws_lambda_function.supply_chain_scanner.arn
    events             = ["s3:ObjectCreated:*"]
    filter_prefix      = "artifacts/"
  }
}

# CloudWatch monitoring
resource "aws_cloudwatch_metric_alarm" "high_threat_rate" {
  alarm_name          = "supply-chain-high-threat-rate"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name        = "ThreatDetections"
  namespace          = "SupplyChain/Security"
  period             = "300"
  statistic          = "Sum"
  threshold          = "5"

  alarm_actions = [aws_sns_topic.security_alerts.arn]
}