import { APPLICATION_SECTION, PROTECTION_SECTION } from "#configuration/strings/information.fragment.strings";
import type { DocumentMeta, Section } from "#types/document.types";
import {
    INFORMATION_CONTACT_ICON,
    INFORMATION_INFRASTRUCTURE_ICON,
    INFORMATION_PARTIES_ICON,
    INFORMATION_TECHNICAL_ICON,
} from "#configuration/icons/information.icons";
import {
    INFORMATION_CONTACT_SECTION_ID,
    INFORMATION_INFRASTRUCTURE_SECTION_ID,
    INFORMATION_PARTIES_SECTION_ID,
    INFORMATION_TECHNICAL_SECTION_ID,
} from "#core/ids/information.ids";
import { SOURCE_ROOT, WALK_ROOT } from "#assets/walk.assets";
import { CONTACT_MAIL } from "#assets/link.assets";

export const INFORMATION_META: DocumentMeta = {
    closing: "Last Technical Review: September 22, 2026",
    effectiveDate: "September 22, 2026",
    intro: "Bane's Lab is a static informational site. We do not collect, store, or process personal user data. This document explains the security measures that protect content delivery and your visit.",
    lastUpdated: "September 22, 2026",
    title: "Security Information",
    version: "2.2.0",
};

const INFRASTRUCTURE_SECTION: Section = {
    icon: INFORMATION_INFRASTRUCTURE_ICON,
    id: INFORMATION_INFRASTRUCTURE_SECTION_ID,
    subsections: [
        {
            blocks: [
                {
                    entries: [
                        { description: "NGINX terminates TLS and serves files straight from disk", term: "Edge" },
                        {
                            description:
                                "There is no application server, database, or runtime process behind the edge; every page is pre-rendered at build time",
                            term: "No Backend",
                        },
                        {
                            description: "The Server header and every version identifier are removed from responses",
                            term: "Header Stripping",
                        },
                        {
                            description:
                                "Pre-rendered HTML pages plus content-hashed CSS/JS served with long-term caching",
                            term: "Static Delivery",
                        },
                        {
                            description:
                                "Each page and tab is also published as a JSON payload under /json/ and as a Markdown twin at its own path with a .md suffix (or by requesting the page with an Accept header of text/markdown), readable from any origin; both carry only the same public content as the page",
                            term: "Machine-Readable Content",
                        },
                        {
                            description: `The Anatomy page publishes the site's own client source: each file's text is served as a static file under ${SOURCE_ROOT} and its syntax walk under ${WALK_ROOT}, derived from the same build that produced the page`,
                            term: "Published Source",
                        },
                    ],
                    kind: "glossary",
                },
            ],
            title: "Architecture",
        },
        {
            blocks: [
                {
                    entries: [
                        { description: "Host-based firewall restricts access to essential ports", term: "Firewall" },
                        { description: "Only HTTPS (443) and HTTP (80, redirect only) exposed", term: "Port Exposure" },
                        {
                            description:
                                "Plain HTTP and the www subdomain permanently redirect to https://banes-lab.com",
                            term: "Canonical Host",
                        },
                        {
                            description:
                                "Mail for this domain is handled by its registrar's forwarding servers; a published MTA-STS policy in enforce mode requires sending servers to deliver over TLS with a matching certificate, and a TLS reporting record asks them to report any failure to do so",
                            term: "Mail Transport",
                        },
                    ],
                    kind: "glossary",
                },
            ],
            title: "Network",
        },
    ],
    title: "Infrastructure",
};

const PARTIES_SECTION: Section = {
    icon: INFORMATION_PARTIES_ICON,
    id: INFORMATION_PARTIES_SECTION_ID,
    subsections: [
        {
            blocks: [
                {
                    entries: [{ description: "Let's Encrypt for TLS certificates", term: "Certificate Authority" }],
                    kind: "glossary",
                },
                {
                    kind: "text",
                    note: true,
                    text: "Every script, stylesheet, font and image is served from this origin. No content delivery network, analytics, advertising, or user-tracking third parties are loaded.",
                },
            ],
            title: "What Loads From Outside Our Servers",
        },
    ],
    title: "Third-Party Services",
};

const CONTACT_SECTION: Section = {
    icon: INFORMATION_CONTACT_ICON,
    id: INFORMATION_CONTACT_SECTION_ID,
    subsections: [
        {
            blocks: [
                {
                    entries: [
                        { description: CONTACT_MAIL, term: "Email" },
                        { description: "Security reports acknowledged within 48 hours", term: "Response Time" },
                        { description: "security reports prioritized", term: "Note" },
                    ],
                    kind: "glossary",
                },
                { kind: "text", note: true, text: "Responsible disclosure is appreciated." },
            ],
            content: "If you discover a security vulnerability or have security concerns:",
            title: "Security Reports",
        },
        {
            content: "This document is updated when our security practices change. Last updated September 22, 2026.",
            title: "Document Updates",
        },
    ],
    title: "Contact",
};

const TECHNICAL_SECTION: Section = {
    icon: INFORMATION_TECHNICAL_ICON,
    id: INFORMATION_TECHNICAL_SECTION_ID,
    subsections: [
        {
            blocks: [
                {
                    entries: [
                        { description: "Shared, ten megabytes", term: "SSL Session Cache" },
                        { description: "10 minutes", term: "SSL Session Timeout" },
                        {
                            description: "Disabled (prevents tracking, ensures forward secrecy)",
                            term: "SSL Session Tickets",
                        },
                        { description: "Full chain with intermediate certificates", term: "Certificate Chain" },
                        { description: "Cloudflare DNS (1.1.1.1, 1.0.0.1)", term: "OCSP Resolver" },
                    ],
                    kind: "glossary",
                },
            ],
            title: "TLS Configuration",
        },
    ],
    title: "Technical Details",
};

export const INFORMATION_SECTIONS: readonly Section[] = [
    PROTECTION_SECTION,
    APPLICATION_SECTION,
    INFRASTRUCTURE_SECTION,
    PARTIES_SECTION,
    CONTACT_SECTION,
    TECHNICAL_SECTION,
];