/**
 * Hardening / optimization tips surfaced in the browser encyclopedia's
 * "Optimization" subtabs. These are actionable settings the user can
 * flip INSIDE the browser itself — Warden doesn't apply them, it just
 * documents the strongest posture each browser supports.
 *
 * Keyed by browser id with a tier-based fallback so every browser
 * gets sensible advice even if it has no bespoke list. Kept short +
 * concrete — each line is one thing the user can go do right now.
 */
import type { Browser } from './browsers';

type TipMap = Record<string, string[]>;

// ─── Security hardening ──────────────────────────────────────────────
const SECURITY_TIPS: TipMap = {
  brave: [
    'Settings → Security → enable “HTTPS by Default” (Strict).',
    'brave://flags → set “Disable JavaScript JIT” for a smaller attack surface.',
    'Keep auto-update on so Chromium CVEs are patched within days.',
  ],
  vanadium: [
    'Hardened defaults — MTE, CFI, hardened_malloc, JIT off by default. Little to tune.',
    'Leave “Allow JavaScript JIT” off unless a site truly needs it.',
  ],
  helium: [
    'chrome://flags → disable JavaScript JIT to shrink the attack surface.',
    'Enable HTTPS-Only mode in Security settings.',
  ],
  chrome: [
    'Settings → Privacy and security → enable “Always use secure connections”.',
    'Turn on Enhanced Safe Browsing for real-time phishing/malware checks.',
    'Keep the app updated via Play Store auto-update.',
  ],
  firefox: [
    'Settings → enable “HTTPS-Only Mode” in all tabs.',
    'about:config → javascript.options.* — only if you know what you’re changing.',
    'Update promptly; Gecko CVEs land on a slower cadence than Chromium.',
  ],
  ironfox: [
    'Ships hardened defaults — keep them; avoid loosening about:config.',
    'Enable HTTPS-Only Mode for every tab.',
    'Update via F-Droid / its own channel as soon as releases drop.',
  ],
  tor: [
    'Keep the Security Level at “Safest” for high-risk browsing.',
    'Never resize the window or install add-ons — both break anonymity.',
    'Let it update itself; outdated Tor Browser is a real risk.',
  ],
  focus: [
    'Nothing to tune — every session is ephemeral and JIT posture is fixed.',
    'Tap the erase button (or just close) to wipe the session.',
  ],
  duckduckgo: [
    'Enable “Fire Button” auto-clear on app exit.',
    'Keep app updates on; the engine tracks Android System WebView.',
  ],
};

// ─── Privacy hardening ───────────────────────────────────────────────
const PRIVACY_TIPS: TipMap = {
  brave: [
    'Set Shields to “Aggressive” for trackers + ads globally.',
    'Enable “Strict, may break sites” fingerprinting protection.',
    'brave://settings/privacy → WebRTC IP handling → “Disable non-proxied UDP” so WebRTC can’t leak your real IP past a proxy/VPN.',
    'Block third-party cookies; turn on “Forget me when I close this site”.',
    'Disable Brave Rewards / News if you don’t use them.',
  ],
  vanadium: [
    'No built-in blocker — pair with a system DNS/firewall (RethinkDNS, etc.).',
    'Route social + video links through Warden’s privacy proxies.',
    'WebRTC IP is masked by default — leave Vanadium’s WebRTC policy untouched.',
    'Use a per-site JS allowlist rather than enabling it globally.',
  ],
  helium: [
    'Install uBlock Origin from the Web Store (Manifest V2 supported).',
    'Keep WebRTC IP shielding on (default) so STUN can’t expose your real IP.',
    'Block third-party cookies in Site settings.',
  ],
  chrome: [
    'Privacy Sandbox → turn OFF Ad topics, Site-suggested ads, Ad measurement.',
    'Block third-party cookies.',
    'No WebRTC IP-leak toggle on Android Chrome — route through a VPN/proxy that handles WebRTC, or switch to Brave/Vanadium which mask it.',
    'Route trackable links through Warden’s privacy proxies.',
  ],
  firefox: [
    'Enhanced Tracking Protection → set to “Strict”.',
    'Install uBlock Origin (full MV2 support on Firefox Android).',
    'about:config → privacy.resistFingerprinting = true (may break some sites).',
    'about:config → media.peerconnection.ice.default_address_only = true to stop WebRTC leaking local/VPN-bypass IPs.',
    'Enable “Delete browsing data on quit”.',
  ],
  ironfox: [
    'Arkenfox-style defaults are pre-applied — keep RFP enabled.',
    'WebRTC is locked down out of the box (no host IP exposure) — don’t loosen it.',
    'Add uBlock Origin for cosmetic + extra filter lists.',
    'Leave “Delete data on quit” on for ephemeral sessions.',
  ],
  tor: [
    'Don’t log into personal accounts — it links your circuits.',
    'WebRTC is disabled entirely — never re-enable it; it would deanonymise you.',
    'Use .onion versions of sites when offered.',
    'Leave fingerprint defenses untouched; they’re tuned for the herd.',
  ],
  focus: [
    'Already maximal — no profile, no history, trackers blocked by default.',
    'Set the default search to a private engine in Settings.',
  ],
  duckduckgo: [
    'Enable “Global Privacy Control” in settings.',
    'Turn on email protection / tracker-blocking if you use DDG accounts.',
    'Use the Fire Button liberally to clear state.',
  ],
};

function tierSecurityFallback(b: Browser): string[] {
  return [
    'Enable HTTPS-Only / “secure connections” mode.',
    'Keep the browser auto-updating so engine CVEs are patched fast.',
    'Disable JavaScript JIT in flags if the browser exposes the option.',
  ];
}

function tierPrivacyFallback(b: Browser): string[] {
  return [
    'Set tracker/ad blocking to the strictest level available.',
    'Block third-party cookies and clear data on exit.',
    'Disable or restrict WebRTC so it can’t leak your real IP past a proxy/VPN.',
    'Route social + video links through Warden’s privacy proxies.',
  ];
}

export function securityTips(b: Browser): string[] {
  return SECURITY_TIPS[b.id] ?? tierSecurityFallback(b);
}

export function privacyTips(b: Browser): string[] {
  return PRIVACY_TIPS[b.id] ?? tierPrivacyFallback(b);
}