import { INFORMATION_APPLICATION_ICON, INFORMATION_PROTECTION_ICON } from "#configuration/icons/information.icons";
import { INFORMATION_APPLICATION_SECTION_ID, INFORMATION_PROTECTION_SECTION_ID } from "#core/ids/information.ids";
import type { Section } from "#types/document.types";

export const PROTECTION_SECTION: Section = {
    icon: INFORMATION_PROTECTION_ICON,
    id: INFORMATION_PROTECTION_SECTION_ID,
    intro: "The site does not maintain accounts, login, or persistent user data storage. Your visit involves only the transport of public page content from our server to your browser, protected end-to-end by TLS.",
    subsections: [
        {
            blocks: [
                {
                    entries: [
                        { description: "No registration, login, or user accounts of any kind", term: "Accounts" },
                        { description: "No passwords, sessions, or credential storage", term: "Authentication" },
                        {
                            description: "No names, emails, payment info, or profile data stored server-side",
                            term: "Personal Data",
                        },
                        { description: "No analytics scripts, ad networks, or third-party trackers", term: "Tracking" },
                        { description: "No application cookies are set during normal browsing", term: "Cookies" },
                    ],
                    kind: "glossary",
                },
                {
                    kind: "text",
                    note: true,
                    text: "Without a user data store there is no database for an attacker to compromise. The threat model is intentionally minimal.",
                },
            ],
            title: "What We Do Not Collect",
        },
        {
            blocks: [
                {
                    entries: [
                        {
                            description: "TLS 1.2 and TLS 1.3 only (older, vulnerable protocols disabled)",
                            term: "TLS Versions",
                        },
                        {
                            description:
                                "Enabled to ensure session keys cannot be compromised even if long-term keys are exposed",
                            term: "Perfect Forward Secrecy",
                        },
                        { description: "Enabled for improved performance and security", term: "HTTP/2" },
                        { description: "Let's Encrypt with automatic renewal", term: "Certificate Authority" },
                        { description: "Enabled for certificate validation", term: "OCSP Stapling" },
                        {
                            description:
                                "HTTP Strict Transport Security with 1-year duration, includeSubDomains, and preload directives",
                            term: "HSTS",
                        },
                    ],
                    kind: "glossary",
                },
                {
                    items: [
                        "ECDHE-ECDSA-AES128-GCM-SHA256",
                        "ECDHE-RSA-AES128-GCM-SHA256",
                        "ECDHE-ECDSA-AES256-GCM-SHA384",
                        "ECDHE-RSA-AES256-GCM-SHA384",
                        "ECDHE-ECDSA-CHACHA20-POLY1305",
                        "ECDHE-RSA-CHACHA20-POLY1305",
                    ],
                    kind: "list",
                    label: "Cipher Suites",
                },
                {
                    kind: "text",
                    note: true,
                    text: "All HTTP traffic is automatically redirected to HTTPS. There is no way to access the platform over unencrypted connections.",
                },
            ],
            content: "All content is delivered over HTTPS with strong transport security:",
            title: "Encryption in Transit",
        },
    ],
    title: "Data Protection Overview",
};

export const APPLICATION_SECTION: Section = {
    icon: INFORMATION_APPLICATION_ICON,
    id: INFORMATION_APPLICATION_SECTION_ID,
    subsections: [
        {
            blocks: [
                {
                    headers: ["Header", "Value", "Purpose"],
                    kind: "table",
                    rows: [
                        [
                            "<code>Content-Security-Policy</code>",
                            "default-src 'none'",
                            "nothing loads unless a directive allows it; scripts run only with the nonce issued for that response and 'strict-dynamic' trusts what they load; styles and fonts only from this origin; no framing, no plugins",
                        ],
                        ["<code>X-Content-Type-Options</code>", "nosniff", "prevents MIME type sniffing"],
                        ["<code>X-Frame-Options</code>", "SAMEORIGIN", "allows framing only from same origin"],
                        ["<code>X-XSS-Protection</code>", "0", "disabled in favor of CSP"],
                        [
                            "<code>Referrer-Policy</code>",
                            "strict-origin-when-cross-origin",
                            "limits referrer information",
                        ],
                        [
                            "<code>Permissions-Policy</code>",
                            "all denied",
                            "accelerometer, camera, geolocation, gyroscope, magnetometer, microphone, payment, USB and interest cohorts disabled",
                        ],
                        ["<code>Strict-Transport-Security</code>", "max-age=31536000", "includeSubDomains; preload"],
                        [
                            "<code>Cross-Origin-Opener-Policy</code>",
                            "same-origin",
                            "isolates the browsing context from cross-origin windows",
                        ],
                        [
                            "<code>Cross-Origin-Embedder-Policy</code>",
                            "credentialless",
                            "cross-origin resources load without credentials",
                        ],
                        [
                            "<code>Cross-Origin-Resource-Policy</code>",
                            "same-origin",
                            "pages and assets are not embeddable elsewhere; the JSON payloads and Markdown twins are the cross-origin surfaces",
                        ],
                        [
                            "<code>tdm-reservation</code>",
                            "0",
                            "text-and-data-mining rights are not reserved; crawling, indexing and AI training are consented to",
                        ],
                    ],
                },
            ],
            content: "All responses include strict security headers:",
            title: "Security Headers",
        },
    ],
    title: "Application Security",
};