import type { InspectionResult } from "./types";

export const demoInspection: InspectionResult = {
  host: "portfolio-demo.invalid",
  inspectedAt: "2026-09-09T16:00:00.000Z",
  addresses: ["203.0.113.42"],
  completeness: {
    status: "complete",
    complete: 3,
    total: 3,
    collectors: { dns: "ok", tls: "ok", http: "ok" },
    issues: [],
  },
  dns: {
    addresses: ["203.0.113.42"],
    families: {
      ipv4: { addresses: ["203.0.113.42"], status: "ok", error: null },
      ipv6: { addresses: [], status: "absent", error: null },
    },
    a: ["203.0.113.42"],
    aaaa: [],
    mx: [{ exchange: "mail.portfolio-demo.invalid", priority: 10 }],
    ns: ["ns1.example.net", "ns2.example.net"],
    txt: ["v=spf1 include:_spf.example.net -all"],
    spf: ["v=spf1 include:_spf.example.net -all"],
    dmarc: ["v=DMARC1; p=none; rua=mailto:dmarc@example.net"],
    spfPosture: { status: "present", reason: "One SPF record was observed." },
    dmarcPosture: { status: "monitor", policy: "none", pct: 100, record: "v=DMARC1; p=none; rua=mailto:dmarc@example.net", reason: "p=none monitors failures without enforcement." },
    _meta: { status: "ok", partial: false, errors: [] },
  },
  tls: {
    address: "203.0.113.42",
    protocol: "TLSv1.3",
    authorized: true,
    authorizationError: null,
    hostnameValid: true,
    hostnameError: null,
    subject: { CN: "portfolio-demo.invalid" },
    issuer: { O: "Example Trust Services", CN: "Example RSA CA" },
    subjectaltname: "DNS:portfolio-demo.invalid",
    validFrom: "Sep 01 00:00:00 2026 GMT",
    validTo: "Dec 01 23:59:59 2026 GMT",
    daysRemaining: 83,
    fingerprint256: "2A:8D:DE:MO:FI:XT:UR:E0",
    _meta: { status: "ok", errors: [] },
  },
  http: {
    http: { url: "http://portfolio-demo.invalid/", address: "203.0.113.42", addresses: ["203.0.113.42"], status: 301, location: "https://portfolio-demo.invalid/" },
    httpRedirectsToHttps: true,
    httpRedirectTarget: { url: "https://portfolio-demo.invalid/", addresses: ["203.0.113.42"], validated: true, resolution: { status: "ok", partial: false, errors: [] } },
    httpsChain: [{
      url: "https://portfolio-demo.invalid/",
      address: "203.0.113.42",
      addresses: ["203.0.113.42"],
      status: 200,
      location: null,
      headers: {
        "strict-transport-security": "max-age=31536000; includeSubDomains",
        "content-security-policy": null,
        "x-content-type-options": "nosniff",
        "referrer-policy": "strict-origin-when-cross-origin",
        "x-frame-options": "DENY",
        server: "nginx",
        "x-powered-by": null,
      },
    }],
    finalUrl: "https://portfolio-demo.invalid/",
    _meta: { status: "ok", errors: [] },
  },
  findings: [
    {
      id: "http.csp_missing",
      category: "http",
      severity: "warning",
      title: "Content-Security-Policy is missing",
      summary: "No CSP header was observed on the final HTTPS response.",
      evidence: ["http.httpsChain[].headers.content-security-policy"],
      remediation: "Deploy a tested CSP appropriate for the application.",
      scoreImpact: -6,
    },
    {
      id: "dns.dmarc_monitor",
      category: "dns",
      severity: "info",
      title: "DMARC is not fully enforcing",
      summary: "DMARC uses p=none, so failing mail is monitored rather than rejected or quarantined.",
      evidence: ["dns.dmarc"],
      remediation: "Move to quarantine or reject after validating legitimate mail sources.",
      scoreImpact: 0,
    },
  ],
  score: { overall: 98, deductions: 2, categories: { dns: 100, tls: 100, http: 94 } },
};