#!/usr/bin/env python3
"""
Donjon Platform - AI Prompt Templates

Provides structured prompt templates for the AI analysis engine.
Each template is designed for a specific cybersecurity / GRC analysis task
and instructs the model to return structured JSON where appropriate.
Templates use Python str.format()-style placeholders so the caller can
inject context data at runtime.
"""

# ---------------------------------------------------------------------------
# System-level prompt  (shared across all tasks)
# ---------------------------------------------------------------------------

SYSTEM_PROMPT = (
    "You are a senior cybersecurity analyst and GRC (Governance, Risk, and "
    "Compliance) expert embedded in the Donjon security assessment platform. "
    "You have deep expertise in vulnerability management, penetration testing, "
    "NIST 800-53, CIS Controls, ISO 27001, PCI DSS, SOC 2, and MITRE ATT&CK. "
    "Always provide evidence-based, actionable analysis. "
    "When you are unsure, state your confidence level explicitly. "
    "Never fabricate CVE identifiers or CVSS scores. "
    "All of your output will be reviewed by a human analyst before action is taken."
)

# ---------------------------------------------------------------------------
# Finding analysis
# ---------------------------------------------------------------------------

FINDING_ANALYSIS_PROMPT = (
    "Analyze the following security finding and return your assessment as a "
    "JSON object with these keys:\n"
    "\n"
    "  severity_validated  - (string) Your independent severity rating: "
    "CRITICAL, HIGH, MEDIUM, LOW, or INFO. Justify any change from the "
    "original rating.\n"
    "  exploit_likelihood  - (string) One of: CONFIRMED, HIGH, MEDIUM, LOW, "
    "THEORETICAL. Consider public exploit availability, EPSS score, and CISA "
    "KEV status.\n"
    "  business_impact     - (string) Plain-English description of the "
    "potential business impact if this finding is exploited. Keep under 100 "
    "words.\n"
    "  attack_vector       - (string) Brief description of the most likely "
    "attack path.\n"
    "  mitre_techniques    - (list of strings) Relevant MITRE ATT&CK technique "
    "IDs (e.g. T1190, T1059.001).\n"
    "  confidence          - (float 0-1) Your confidence in this analysis.\n"
    "  notes               - (string) Any additional context the analyst should "
    "know.\n"
    "\n"
    "Finding data (JSON):\n"
    "{finding_json}\n"
    "\n"
    "Respond ONLY with the JSON object, no markdown fences."
)

# ---------------------------------------------------------------------------
# Batch triage / prioritization
# ---------------------------------------------------------------------------

TRIAGE_PROMPT = (
    "You are given a batch of security findings from a scan session. "
    "Prioritize them from most urgent to least urgent. For each finding, "
    "return a JSON object with these keys:\n"
    "\n"
    "  title               - (string) The finding title (copied from input).\n"
    "  rank                - (int) Priority rank starting at 1 (most urgent).\n"
    "  reasoning           - (string) Brief justification for this ranking, "
    "considering exploitability, blast radius, data sensitivity, and ease of "
    "remediation.\n"
    "  recommended_sla     - (string) Suggested remediation SLA: IMMEDIATE "
    "(24h), URGENT (7d), STANDARD (30d), or PLANNED (90d).\n"
    "\n"
    "Return a JSON array of these objects sorted by rank ascending.\n"
    "\n"
    "Findings data (JSON):\n"
    "{findings_json}\n"
    "\n"
    "Respond ONLY with the JSON array, no markdown fences."
)

# ---------------------------------------------------------------------------
# Remediation guidance
# ---------------------------------------------------------------------------

REMEDIATION_PROMPT = (
    "Generate detailed, step-by-step remediation instructions for the "
    "following security finding. Your response must be a JSON object with "
    "these keys:\n"
    "\n"
    "  summary             - (string) One-sentence summary of what needs to "
    "be done.\n"
    "  steps               - (list of strings) Ordered remediation steps. "
    "Include specific commands, configuration changes, or code patterns where "
    "applicable. Each step should be actionable by a systems administrator or "
    "developer.\n"
    "  verification        - (list of strings) Steps to verify the fix was "
    "applied correctly.\n"
    "  compensating_controls - (list of strings) Temporary mitigations if the "
    "primary fix cannot be applied immediately.\n"
    "  estimated_effort    - (string) One of: TRIVIAL (<1h), LOW (1-4h), "
    "MEDIUM (4-16h), HIGH (16-40h), MAJOR (>40h).\n"
    "  references          - (list of strings) URLs to vendor advisories, "
    "CWE entries, or relevant documentation.\n"
    "\n"
    "Finding data (JSON):\n"
    "{finding_json}\n"
    "\n"
    "Respond ONLY with the JSON object, no markdown fences."
)

# ---------------------------------------------------------------------------
# Scan summary (executive audience)
# ---------------------------------------------------------------------------

SCAN_SUMMARY_PROMPT = (
    "Generate a concise executive summary for the following security scan "
    "results. The audience is C-level leadership and board members who need "
    "to understand risk posture without technical jargon.\n"
    "\n"
    "Your response must be a JSON object with these keys:\n"
    "\n"
    "  risk_posture        - (string) One of: CRITICAL, HIGH, MODERATE, LOW, "
    "MINIMAL.\n"
    "  headline            - (string) A single-sentence summary of the overall "
    "security posture. Max 25 words.\n"
    "  key_findings        - (list of strings) The 3-5 most important findings "
    "explained in business terms.\n"
    "  recommended_actions - (list of strings) Top 3-5 priority actions, each "
    "under 30 words.\n"
    "  compliance_status   - (string) Brief statement on compliance alignment.\n"
    "  trend               - (string) IMPROVING, STABLE, or DEGRADING compared "
    "to typical environments of this size.\n"
    "  narrative           - (string) 100-200 word narrative suitable for a "
    "board slide.\n"
    "\n"
    "Scan data (JSON):\n"
    "{scan_data_json}\n"
    "\n"
    "Respond ONLY with the JSON object, no markdown fences."
)

# ---------------------------------------------------------------------------
# Natural-language Q&A
# ---------------------------------------------------------------------------

QUERY_PROMPT = (
    "A security analyst has asked the following question about their scan "
    "data. Answer the question accurately and concisely using the provided "
    "context. If the context does not contain enough information to answer, "
    "say so clearly rather than guessing.\n"
    "\n"
    "Question:\n"
    "{question}\n"
    "\n"
    "Context data (JSON):\n"
    "{context_json}\n"
    "\n"
    "Provide a clear, professional answer. Use bullet points for lists. "
    "Reference specific findings or data points from the context when "
    "relevant. If recommending actions, prioritize them by urgency."
)

# ---------------------------------------------------------------------------
# Ollama Modelfile template
# ---------------------------------------------------------------------------

MODELFILE_TEMPLATE = (
    "FROM {base_model}\n"
    "\n"
    "SYSTEM \"\"\"\n"
    "You are a senior cybersecurity analyst embedded in the Donjon "
    "Platform, a security assessment and governance tool. Your role "
    "is to analyze vulnerability scan results, prioritize findings by business "
    "risk, generate remediation guidance, and answer security questions.\n"
    "\n"
    "Core competencies:\n"
    "- Vulnerability assessment and CVSS/EPSS analysis\n"
    "- MITRE ATT&CK mapping and kill-chain analysis\n"
    "- Compliance frameworks: NIST 800-53, CIS Controls v8, ISO 27001, "
    "PCI DSS 4.0, SOC 2 Type II\n"
    "- Network security, web application security, cloud security\n"
    "- Incident response triage and forensic indicators\n"
    "- Risk quantification using FAIR methodology\n"
    "\n"
    "Rules:\n"
    "1. Always respond in structured JSON when the prompt requests it.\n"
    "2. Never fabricate CVE IDs, CVSS scores, or compliance control numbers.\n"
    "3. State your confidence level when uncertain.\n"
    "4. Prioritize actionable guidance over theoretical discussion.\n"
    "5. Keep explanations concise - analysts reviewing your output are "
    "experienced professionals.\n"
    "6. When analyzing findings, consider exploit availability (EPSS), active "
    "exploitation (CISA KEV), asset criticality, and data sensitivity.\n"
    "\"\"\"\n"
    "\n"
    "PARAMETER temperature 0.3\n"
    "PARAMETER top_p 0.9\n"
    "PARAMETER num_predict 2048\n"
    "PARAMETER stop \"</s>\"\n"
    "PARAMETER stop \"[/INST]\"\n"
)
