//! Rules Engine for Anomaly Detection
//!
//! Applies business rules and filters to detected anomalies.

use super::{AnomalyResult, AnomalySeverity, AnomalyType};

/// Rules engine for filtering and enhancing anomalies
#[derive(Default)]
pub struct RulesEngine {
    // Rules configuration would go here
}

impl RulesEngine {
    /// Create new rules engine
    pub fn new() -> Self {
        Self::default()
    }

    /// Apply rules to filter and enhance anomalies
    pub fn apply_rules(&self, anomalies: &[AnomalyResult]) -> Vec<AnomalyResult> {
        let mut filtered = Vec::new();

        for anomaly in anomalies {
            if self.should_include_anomaly(anomaly) {
                let enhanced = self.enhance_anomaly(anomaly.clone());
                filtered.push(enhanced);
            }
        }

        // Sort by severity and confidence
        filtered.sort_by(|a, b| match (a.severity.clone(), b.severity.clone()) {
            (AnomalySeverity::Critical, AnomalySeverity::Critical) => b
                .confidence
                .partial_cmp(&a.confidence)
                .unwrap_or(std::cmp::Ordering::Equal),
            (AnomalySeverity::Critical, _) => std::cmp::Ordering::Less,
            (_, AnomalySeverity::Critical) => std::cmp::Ordering::Greater,
            (AnomalySeverity::High, AnomalySeverity::High) => b
                .confidence
                .partial_cmp(&a.confidence)
                .unwrap_or(std::cmp::Ordering::Equal),
            (AnomalySeverity::High, _) => std::cmp::Ordering::Less,
            (_, AnomalySeverity::High) => std::cmp::Ordering::Greater,
            _ => b
                .confidence
                .partial_cmp(&a.confidence)
                .unwrap_or(std::cmp::Ordering::Equal),
        });

        filtered
    }

    /// Determine if anomaly should be included
    fn should_include_anomaly(&self, anomaly: &AnomalyResult) -> bool {
        // Apply business rules for filtering
        match anomaly.anomaly_type {
            AnomalyType::VolumeAnomaly => anomaly.confidence > 0.6,
            AnomalyType::PolicyViolationSpike => anomaly.confidence > 0.5,
            AnomalyType::UnusualAccessPattern => anomaly.confidence > 0.7,
            _ => anomaly.confidence > 0.6,
        }
    }

    /// Enhance anomaly with additional context
    fn enhance_anomaly(&self, mut anomaly: AnomalyResult) -> AnomalyResult {
        // Add context-specific recommendations
        match anomaly.anomaly_type {
            AnomalyType::PolicyViolationSpike => {
                if !anomaly
                    .recommended_actions
                    .iter()
                    .any(|a| a.contains("security team"))
                {
                    anomaly
                        .recommended_actions
                        .push("Notify security team immediately".to_string());
                }
            }
            AnomalyType::GeographicAnomaly => {
                if !anomaly
                    .recommended_actions
                    .iter()
                    .any(|a| a.contains("travel"))
                {
                    anomaly
                        .recommended_actions
                        .push("Check employee travel records".to_string());
                }
            }
            _ => {}
        }

        anomaly
    }
}
