package scanner

import "github.com/adaptive-scale/blacklight/internal/model"

var Regex = []model.Configuration{
	{Name: "AWS Access Key", Regex: `AKIA[0-9A-Z]{16}`, Severity: 3, Type: "cloud"},
	{Name: "AWS Secret Key", Regex: `(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]`, Severity: 3, Type: "cloud"},
	{Name: "Google API Key", Regex: `AIza[0-9A-Za-z\\-_]{35}`, Severity: 3, Type: "cloud"},
	{Name: "Slack Token", Regex: `xox[baprs]-[0-9a-zA-Z]{10,48}`, Severity: 3, Type: "api"},
	{Name: "Stripe API Key", Regex: `sk_live_[0-9a-zA-Z]{24}`, Severity: 3, Type: "payment"},
	{Name: "GitHub Token", Regex: `gh[pousr]_[0-9a-zA-Z]{36,}`, Severity: 3, Type: "vcs"},
	{Name: "Heroku API Key", Regex: `[hH]eroku(.{0,20})?['"][0-9a-fA-F]{32}['"]`, Severity: 3, Type: "cloud"},
	{Name: "Generic API Key", Regex: `(?i)api[_-]?key(.{0,20})?['"][0-9a-zA-Z]{32,45}['"]`, Severity: 2, Type: "api"},
	{Name: "Generic Secret", Regex: `(?i)secret(.{0,20})?['"][0-9a-zA-Z/+]{32,45}['"]`, Severity: 2, Type: "secret"},
	{Name: "Private RSA Key", Regex: `-----BEGIN RSA PRIVATE KEY-----`, Severity: 3, Type: "key"},
	{Name: "Private DSA Key", Regex: `-----BEGIN DSA PRIVATE KEY-----`, Severity: 3, Type: "key"},
	{Name: "Private EC Key", Regex: `-----BEGIN EC PRIVATE KEY-----`, Severity: 3, Type: "key"},
	{Name: "PGP Private Key Block", Regex: `-----BEGIN PGP PRIVATE KEY BLOCK-----`, Severity: 3, Type: "key"},
	{Name: "OpenSSH Private Key", Regex: `-----BEGIN OPENSSH PRIVATE KEY-----`, Severity: 3, Type: "key"},
	{Name: "JWT", Regex: `eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+`, Severity: 2, Type: "auth"},
	{Name: "Facebook Access Token", Regex: `EAACEdEose0cBA[0-9A-Za-z]+`, Severity: 3, Type: "social"},
	{Name: "Basic Auth in URL", Regex: `https?:\/\/[^:\/\s]+:[^@\/\s]+@`, Severity: 2, Type: "auth"},
	{Name: "Google OAuth Token", Regex: `ya29\.[0-9A-Za-z\-_]+`, Severity: 3, Type: "auth"},
	{Name: "Password in Variable", Regex: `(?i)password\s*=\s*['"][^'"]+['"]`, Severity: 2, Type: "auth"},
	{Name: "Password in URL", Regex: `(?i)://[^:]+:[^@]+@`, Severity: 2, Type: "auth"},
	{Name: "RSA Public Key", Regex: `-----BEGIN PUBLIC KEY-----`, Severity: 1, Type: "key"},
	{Name: "Azure Storage Key", Regex: `(?i)azure(.{0,20})?['"][0-9a-zA-Z/+]{88}['"]`, Severity: 3, Type: "cloud"},
	{Name: "Twilio API Key", Regex: `SK[0-9a-fA-F]{32}`, Severity: 3, Type: "api"},
	{Name: "SendGrid API Key", Regex: `SG\.[A-Za-z0-9\-_]{22}\.[A-Za-z0-9\-_]{43}`, Severity: 3, Type: "api"},
	{Name: "Mailchimp API Key", Regex: `[0-9a-f]{32}-us[0-9]{1,2}`, Severity: 3, Type: "api"},
	{Name: "Square Access Token", Regex: `sq0atp-[0-9A-Za-z\-_]{22}`, Severity: 3, Type: "payment"},
	{Name: "Square OAuth Secret", Regex: `sq0csp-[0-9A-Za-z\-_]{43}`, Severity: 3, Type: "payment"},
	{Name: "PayPal Braintree Token", Regex: `access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}`, Severity: 3, Type: "payment"},
	{Name: "LDAP Password", Regex: `(?i)ldap(.{0,20})?['"][^'"]{8,}['"]`, Severity: 2, Type: "auth"},
	{Name: "MongoDB URI with credentials", Regex: `mongodb(\+srv)?:\/\/[^:]+:[^@]+@`, Severity: 2, Type: "database"},
	{Name: "MySQL URI with credentials", Regex: `mysql:\/\/[^:]+:[^@]+@`, Severity: 2, Type: "database"},
	{Name: "PostgreSQL URI with credentials", Regex: `postgresql:\/\/[^:]+:[^@]+@`, Severity: 2, Type: "database"},
	{Name: "Docker Hub Token", Regex: `(?i)docker(.{0,20})?['"][A-Za-z0-9_\-]{20,}['"]`, Severity: 2, Type: "container"},
	{Name: "Stripe Test Key", Regex: `sk_test_[0-9a-zA-Z]{24}`, Severity: 1, Type: "payment"},
	{Name: "Square Sandbox Token", Regex: `sq0atb-[0-9A-Za-z\-_]{22}`, Severity: 1, Type: "payment"},
	{Name: "Generic Bearer Token", Regex: `(?i)Bearer\s+[A-Za-z0-9\-._~+/]+=*`, Severity: 2, Type: "auth"},
	{Name: "JSON Web Token Header", Regex: `"alg"\s*:\s*"HS256"`, Severity: 1, Type: "auth"},
	{Name: "Firebase API Key", Regex: `AIza[0-9A-Za-z\\-_]{35}`, Severity: 3, Type: "cloud"},
	{Name: "Algolia API Key", Regex: `(?i)algolia(.{0,20})?['"][a-z0-9]{32}['"]`, Severity: 2, Type: "api"},
	{Name: "Twitch API Key", Regex: `twitch[_-]?api[_-]?key['"]?\s*[:=]\s*['"][a-z0-9]{30,}['"]`, Severity: 3, Type: "api"},
	{Name: "Discord Token", Regex: `mfa\.[0-9a-z\-_]{84}`, Severity: 3, Type: "social"},
	{Name: "Firebase Auth Domain", Regex: `.*\.firebaseapp\.com`, Severity: 1, Type: "cloud"},
	{Name: "Basic Auth Header", Regex: `Authorization:\s*Basic\s+[A-Za-z0-9+/=]+`, Severity: 2, Type: "auth"},
	{Name: "Authorization Bearer", Regex: `Authorization:\s*Bearer\s+[A-Za-z0-9\-._~+/]+=*`, Severity: 2, Type: "auth"},
	{Name: "Generic Token", Regex: `(?i)token\s*=\s*['"][a-zA-Z0-9_\-]{20,}['"]`, Severity: 2, Type: "auth"},
	{Name: "Generic Username/Password Pair", Regex: `"username"\s*:\s*".+?",\s*"password"\s*:\s*".+?"`, Severity: 2, Type: "auth"},
	{Name: "Secret in ENV", Regex: `(?i)(SECRET|TOKEN|KEY|PWD|PASS)[A-Z0-9_]*=.+`, Severity: 2, Type: "secret"},
	{Name: "Private Key JSON", Regex: `"private_key"\s*:\s*"-----BEGIN PRIVATE KEY-----`, Severity: 3, Type: "key"},
	{Name: "OAuth Client Secret", Regex: `"client_secret"\s*:\s*"[^"]+"`, Severity: 3, Type: "auth"},
	{Name: "OAuth Client ID", Regex: `"client_id"\s*:\s*"[^"]+"`, Severity: 2, Type: "auth"},
	{Name: "Shopify Access Token", Regex: `shpat_[a-fA-F0-9]{32}`, Severity: 3, Type: "ecommerce"},
	{Name: "Shopify Shared Secret", Regex: `shpss_[a-fA-F0-9]{32}`, Severity: 3, Type: "ecommerce"},
	{Name: "Shopify Custom App Token", Regex: `shpca_[a-fA-F0-9]{32}`, Severity: 3, Type: "ecommerce"},
	{Name: "Telegram Bot Token", Regex: `[0-9]+:AA[0-9A-Za-z\-_]{33}`, Severity: 3, Type: "social"},
	{Name: "Bitbucket OAuth Token", Regex: `(?i)bitbucket(.{0,20})?['"][a-z0-9]{32,40}['"]`, Severity: 2, Type: "vcs"},
	{Name: "Dropbox API Key", Regex: `sl\.[A-Za-z0-9-_]{15,}`, Severity: 3, Type: "cloud"},
	{Name: "NPM Token", Regex: `(?i)_authToken\s*=\s*['"]?[a-z0-9\-]{36}['"]?`, Severity: 3, Type: "package"},
	{Name: "Yandex API Key", Regex: `AQVN[A-Za-z0-9\-_]{35,}`, Severity: 2, Type: "api"},
	{Name: "GitLab Personal Token", Regex: `glpat-[0-9a-zA-Z\-_]{20,}`, Severity: 3, Type: "vcs"},
	{Name: "Confluent Cloud API Key", Regex: `(?i)confluent(.{0,20})?['"][a-zA-Z0-9]{16,}['"]`, Severity: 2, Type: "cloud"},
	{Name: "Rollbar Token", Regex: `(?i)rollbar(.{0,20})?['"][a-f0-9]{32}['"]`, Severity: 2, Type: "monitoring"},
	{Name: "Honeycomb API Key", Regex: `(?i)honeycomb(.{0,20})?['"][a-z0-9]{32}['"]`, Severity: 2, Type: "monitoring"},
	{Name: "Cloudinary API Key", Regex: `(?i)cloudinary(.{0,20})?['"][0-9]{15}['"]`, Severity: 2, Type: "cloud"},
	{Name: "NewRelic License Key", Regex: `NRAK-[A-Za-z0-9]{27}`, Severity: 3, Type: "monitoring"},
	{Name: "Postman API Key", Regex: `PMAK-[a-f0-9]{24,32}-[a-f0-9]{24,32}`, Severity: 3, Type: "api"},
	{Name: "Asana Personal Access Token", Regex: `(?i)asana(.{0,20})?['"][0-9a-z]{32}['"]`, Severity: 2, Type: "api"},
	{Name: "Google Cloud Service Account", Regex: `"type": "service_account",\s*"project_id"`, Severity: 2, Type: "cloud"},
	{Name: "Zendesk Token", Regex: `(?i)zendesk(.{0,20})?['"][a-z0-9]{32,45}['"]`, Severity: 2, Type: "api"},
	{Name: "CircleCI Token", Regex: `circleci_token['"]?\s*[:=]\s*['"][0-9a-f]{40}['"]`, Severity: 2, Type: "ci"},
	{Name: "Netlify Token", Regex: `(?i)netlify(.{0,20})?['"][a-z0-9]{40}['"]`, Severity: 2, Type: "cloud"},
	{Name: "GitHub App Private Key", Regex: `-----BEGIN RSA PRIVATE KEY-----[\s\S]+?-----END RSA PRIVATE KEY-----`, Severity: 3, Type: "vcs"},
	{Name: "Azure Client Secret", Regex: `"clientSecret"\s*:\s*"[^"]+"`, Severity: 3, Type: "cloud"},
	{Name: "Azure Client ID", Regex: `"clientId"\s*:\s*"[^"]+"`, Severity: 2, Type: "cloud"},
	{Name: "Azure Tenant ID", Regex: `"tenantId"\s*:\s*"[^"]+"`, Severity: 2, Type: "cloud"},
	{Name: "Fastly API Token", Regex: `(?i)fastly(.{0,20})?['"][A-Za-z0-9\-_=]{32,}['"]`, Severity: 3, Type: "cdn"},
	{Name: "Bitly Generic Access Token", Regex: `(?i)bitly(.{0,20})?['"][a-z0-9]{32,}['"]`, Severity: 2, Type: "api"},
	{Name: "OpenAI API Key", Regex: `sk-[A-Za-z0-9]{32,}`, Severity: 3, Type: "ai"},
	{Name: "Firebase Web API Key", Regex: `AIza[0-9A-Za-z\-_]{35}`, Severity: 2, Type: "cloud"},
	{Name: "ReCaptcha Site Key", Regex: `6L[0-9A-Za-z_-]{38}`, Severity: 1, Type: "security"},
	{Name: "ReCaptcha Secret Key", Regex: `6L[0-9A-Za-z_-]{38}`, Severity: 3, Type: "security"},
	{Name: "OAuth Redirect URI", Regex: `https?:\/\/[^\s]+\/oauth\/callback`, Severity: 1, Type: "auth"},
	{Name: "Generic OAuth Token", Regex: `(?i)oauth(_token)?['"]?\s*[:=]\s*['"][a-z0-9\-_]{20,}['"]`, Severity: 2, Type: "auth"},
	{Name: "Kafka Connection String", Regex: `(?i)kafka(.{0,20})?(\/\/)?[^:]+:[^@]+@`, Severity: 2, Type: "messaging"},
	{Name: "RabbitMQ URI with Credentials", Regex: `amqp:\/\/[^:]+:[^@]+@`, Severity: 2, Type: "messaging"},
	{Name: "Basic Auth Credentials", Regex: `(?i)(user(name)?|login)[=: ]['"][^'"]+['"]\s*(password|pass)[=: ]['"][^'"]+['"]`, Severity: 2, Type: "auth"},
	{Name: "DigitalOcean Token", Regex: `dop_v1_[a-f0-9]{64}`, Severity: 3, Type: "cloud"},
	{Name: "Clojars API Token", Regex: `(?i)clojars(.{0,20})?['"][a-z0-9]{40}['"]`, Severity: 2, Type: "package"},
	{Name: "Artifactory Token", Regex: `(?i)artifactory(.{0,20})?['"][a-z0-9-_]{32,}['"]`, Severity: 2, Type: "package"},
	{Name: "Ansible Vault Encrypted Block", Regex: `\$ANSIBLE_VAULT;.*\n[0-9a-f\n]+`, Severity: 3, Type: "config"},
	{Name: "Generic Client Secret", Regex: `client_secret\s*=\s*['"][^'"]+['"]`, Severity: 3, Type: "auth"},
	{Name: "Generic Access Token", Regex: `access_token\s*=\s*['"][^'"]+['"]`, Severity: 3, Type: "auth"},
	{Name: "Generic Refresh Token", Regex: `refresh_token\s*=\s*['"][^'"]+['"]`, Severity: 2, Type: "auth"},
	{Name: "Email + Password in Log", Regex: `[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,4}:.+`, Severity: 2, Type: "auth"},
	{Name: "Firebase Admin SDK", Regex: `"project_id": ".+?",\s*"private_key_id": ".+?"`, Severity: 3, Type: "cloud"},
	{Name: "Pusher Secret Key", Regex: `(?i)pusher(.{0,20})?['"][a-z0-9]{32}['"]`, Severity: 2, Type: "messaging"},
	{Name: "RDS Endpoint", Regex: `[a-zA-Z0-9\-]+\.rds\.amazonaws\.com`, Severity: 1, Type: "database"},
	{Name: "Snowflake Credential", Regex: `snowflake:\/\/[^:]+:[^@]+@`, Severity: 2, Type: "database"},
	{Name: "Cloudflare API Token", Regex: `(?i)cloudflare(.{0,20})?['"][a-z0-9_\-]{40,}['"]`, Severity: 3, Type: "cdn"},
	{Name: "Environment Variable Export", Regex: `(?i)export\s+(SECRET|TOKEN|KEY|PWD|PASS)[A-Z0-9_]*=.+`, Severity: 2, Type: "secret"},
	{Name: "PEM Encoded Private Key", Regex: `-----BEGIN PRIVATE KEY-----[\s\S]+?-----END PRIVATE KEY-----`, Severity: 3, Type: "key"},
	{Name: "Basic Shell Credential", Regex: `(?i)(token|secret|password|pwd|key)=['"]?[A-Za-z0-9+/=]{8,}['"]?`, Severity: 2, Type: "secret"},
	{Name: "Terraform Variable with Secret", Regex: `variable\s+".*(_secret|_key|_token)"`, Severity: 2, Type: "iac"},
	{Name: "Kubernetes Secret YAML", Regex: `apiVersion: v1\s+kind: Secret`, Severity: 2, Type: "container"},
	{Name: "Credit Card Number (Generic)", Regex: `\b(?:\d[ -]*?){13,16}\b`, Severity: 3, Type: "pci"},
	{Name: "Visa Card", Regex: `\b4[0-9]{12}(?:[0-9]{3})?\b`, Severity: 3, Type: "pci"},
	{Name: "MasterCard", Regex: `\b5[1-5][0-9]{14}\b`, Severity: 3, Type: "pci"},
	{Name: "American Express", Regex: `\b3[47][0-9]{13}\b`, Severity: 3, Type: "pci"},
	{Name: "Discover Card", Regex: `\b6(?:011|5[0-9]{2})[0-9]{12}\b`, Severity: 3, Type: "pci"},
	{Name: "JCB Card", Regex: `\b(?:2131|1800|35\d{3})\d{11}\b`, Severity: 3, Type: "pci"},
	{Name: "CVV Code", Regex: `\b(CVV|CVC|CVV2|CVC2|CVN|CVN2|CID|CAV)\s*?[^A-Za-z0-9\s]\s*?\d{3,4}\b`, Severity: 3, Type: "pci"},
	{Name: "Card Expiry Date", Regex: `\b(0[1-9]|1[0-2])[/-]\d{2,4}\b`, Severity: 2, Type: "pci"},
	{Name: "Card Holder Name", Regex: `\b(?:CARD[- ]?HOLDER|NAME ON CARD)[: ]+[A-Z][A-Za-z\- ]+\b`, Severity: 2, Type: "pci"},
	{Name: "Merchant ID", Regex: `\b(?:MERCHANT|MID)[: ]+\d{6,20}\b`, Severity: 2, Type: "pci"},
	{Name: "Payment Gateway API Key", Regex: `\b(?:STRIPE|PAYPAL|SQUARE|BRAINTREE|AUTHORIZE\.NET)[: ]+[A-Za-z0-9_-]{20,}\b`, Severity: 3, Type: "pci"},
}

var Parser = []model.Parser{
	{
		Parser:         "JSON",
		ParserFunction: `scanner.JSON`,
		Internal:       true,
		FileExt:        ".json",
	},
	{
		Parser:         "All",
		ParserFunction: `scanner.All`,
		Internal:       true,
		FileExt:        "*",
	},
}
