"""
All AI prompts for the CLI agent — kept in one place so they're easy to tune.
"""


def triage_prompt(file_list: str, max_files: int) -> str:
    return (
        "You are a Senior Application Security Engineer. "
        "I have a local codebase with the following files:\n"
        f"{file_list}\n\n"
        f"Select the {max_files} most critical files to review for security vulnerabilities. "
        "Focus on: authentication logic, database access, API routes, config files, "
        "secret/credential handling, input validation, and file upload handlers.\n"
        "Also prioritise any file that contains the words: secret, password, token, key, "
        "auth, login, admin, cred, jwt, session, crypto, hash.\n"
        "Return a JSON object with a single key 'critical_files' containing the list of "
        "exact file paths. Do not select more than "
        f"{max_files} files."
    )


def analysis_prompt(file_path: str, content: str) -> str:
    return (
        f"Review the following code from '{file_path}' for security vulnerabilities.\n"
        "Focus on OWASP Top 10:\n"
        "  A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection,\n"
        "  A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components,\n"
        "  A07 Auth Failures, A08 Integrity Failures, A09 Logging Failures, A10 SSRF.\n"
        "Also check for: hardcoded secrets/API keys, debug flags left on, insecure defaults.\n\n"
        f"CODE:\n{content}\n\n"
        "Return a JSON object with key 'vulnerabilities' — a list of objects, each with:\n"
        "  'severity'      : Critical | High | Medium | Low\n"
        "  'issue'         : Short title of the vulnerability\n"
        "  'explanation'   : 1-2 sentences explaining the risk\n"
        "  'suggested_fix' : Concrete code snippet or clear instruction to fix it\n"
        "  'line_number'   : Integer line number, or null if not applicable\n"
        "If no vulnerabilities are found, return {\"vulnerabilities\": []}."
    )


def summary_prompt(target: str, issues_json: str) -> str:
    return (
        "You are a Senior AppSec Manager writing an executive security report.\n"
        f"Target: {target}\n\n"
        "Here are all vulnerabilities found in the automated scan:\n"
        f"{issues_json}\n\n"
        "Write a 2-3 paragraph executive summary of the overall security posture. "
        "Highlight the most critical risks, explain what an attacker could do with them, "
        "and recommend the top 3 immediate priorities. "
        "Keep it professional, direct, and actionable — avoid generic fluff."
    )


def chat_prompt(target: str, scan_context: str, user_question: str) -> str:
    return (
        "You are SecureLens AI, an expert cybersecurity assistant embedded in a CLI tool.\n"
        f"The developer just scanned: {target}\n\n"
        "Here are the full scan results:\n"
        f"{scan_context}\n\n"
        f"Developer's question: {user_question}\n\n"
        "Answer clearly and practically. Reference specific findings from the scan when relevant. "
        "If asked about a fix, show concrete code where possible."
    )


def web_summary_prompt(url: str, issues_json: str, score: int, grade: str) -> str:
    return (
        "You are SecureLens AI, a web security expert.\n"
        f"I just ran a security scan on: {url}\n"
        f"Overall score: {score}/100  Grade: {grade}\n\n"
        "Issues found:\n"
        f"{issues_json}\n\n"
        "Write a concise 2-paragraph summary: first explain what the key risks are and how "
        "an attacker could exploit them; second, give the top 3 most impactful fixes. "
        "Be direct — the reader is a developer, not a manager."
    )