import { createFileRoute } from "@tanstack/react-router";
import { LegalPage, LegalSection, MailLink } from "~/components/legal/LegalPage";
import { getLegalInfo } from "~/fns/legal";
import { SOURCE_URL } from "~/lib/marketing/site";
import { ExternalLink } from "~/ui/TextLink";
import { seo } from "~/utils/seo";

export const Route = createFileRoute("/security")({
  loader: () => getLegalInfo(),
  head: ({ match }) => ({
    meta: seo({
      origin: match.context.publicUrl,
      path: "/security",
      title: "Security and vulnerability disclosure · gitfor",
      description: "How to report a security vulnerability in gitfor, and what we promise in return.",
    }),
  }),
  component: SecurityPolicyPage,
});

const IN_SCOPE = [
  "The hosted forge and its API, Git and LFS endpoints.",
  "Isolation between accounts, repositories, CI jobs, editor containers and Sites.",
  "Authentication: sessions, passkeys, two-factor, tokens, OAuth and GitHub sign-in.",
  "The open-source code in the gitfor repository.",
] as const;

const OUT_OF_SCOPE = [
  "Content users host on Sites or in repositories (report that as abuse).",
  "Denial of service, load testing, spam or social engineering of staff or users.",
  "Findings that need a compromised device, or only affect outdated browsers.",
  "Missing best-practice headers or rate limits without a demonstrated impact.",
  "Vulnerabilities in Cloudflare, Stripe or GitHub themselves; report those to the vendor.",
] as const;

const RULES = [
  "Only test against accounts and repositories you own or have explicit permission to use.",
  "Do not access, change or delete other users' data; stop and report as soon as you see any.",
  "Do not run cryptocurrency miners, scanners against third parties or high-volume traffic.",
  "Give us reasonable time to fix the issue before disclosing it publicly; we aim for 90 days or less.",
] as const;

function SecurityPolicyPage() {
  const info = Route.useLoaderData();
  const contact = info.securityEmail ?? info.contactEmail;
  return (
    <LegalPage
      title="Security"
      lede="We welcome reports from security researchers and will work with you to fix issues quickly."
      info={info}
    >
      <LegalSection title="Reporting a vulnerability">
        <p>
          Email <MailLink address={contact} placeholder="SECURITY_CONTACT_EMAIL" /> with a description, steps to
          reproduce and the impact you observed. You can also open a private security advisory on the{" "}
          <ExternalLink href={SOURCE_URL} rel="noreferrer">
            source repository
          </ExternalLink>
          . Please do not file public issues for vulnerabilities. Our{" "}
          <ExternalLink href="/.well-known/security.txt">security.txt</ExternalLink> lists the same contact.
        </p>
      </LegalSection>

      <LegalSection title="What we promise">
        <ul>
          <li>We acknowledge reports within 3 business days and keep you updated until it is resolved.</li>
          <li>We credit you in the fix announcement if you want to be credited.</li>
          <li>
            We will not pursue or support legal action against good-faith research that follows this policy, and we
            consider it authorized under anti-hacking laws and our terms.
          </li>
        </ul>
      </LegalSection>

      <LegalSection title="Rules of engagement">
        <ul>
          {RULES.map((rule) => (
            <li key={rule}>{rule}</li>
          ))}
        </ul>
      </LegalSection>

      <LegalSection title="In scope">
        <ul>
          {IN_SCOPE.map((item) => (
            <li key={item}>{item}</li>
          ))}
        </ul>
      </LegalSection>

      <LegalSection title="Out of scope">
        <ul>
          {OUT_OF_SCOPE.map((item) => (
            <li key={item}>{item}</li>
          ))}
        </ul>
        <p>We do not currently run a paid bug bounty.</p>
      </LegalSection>
    </LegalPage>
  );
}