export function subjectName(subject = "") {
  const commonName = /(?:^|,)CN=([^,]+)/.exec(subject)?.[1];
  return commonName ?? (subject || "Unnamed certificate");
}

export function verdictCopy(result, hasUserDecision) {
  if (hasUserDecision) {
    return result.verdict.trusted
      ? {
          eyebrow: "Local decision",
          title: "You trust this connection",
          detail: "The decision is limited to the displayed host and port in this simulation.",
        }
      : {
          eyebrow: "Local decision",
          title: "You do not trust this connection",
          detail: "The connection remains blocked by your explicit decision.",
        };
  }

  if (result.facts.validation === "success") {
    return {
      eyebrow: "Firefox validation",
      title: "The conventional certificate path is valid",
      detail: "Trust plugins may still add evidence, warnings, or a stricter local verdict.",
    };
  }

  return {
    eyebrow: "Decision required",
    title: "Firefox could not verify this identity",
    detail:
      result.facts.failure?.summary ??
      "Review the broken path and attributed plugin findings before deciding.",
  };
}

export function chainRows(facts) {
  const chain = facts.constructedChain.length
    ? facts.constructedChain
    : facts.presentedChain;
  const failedFingerprint = facts.failure?.certificateSha256;

  return chain.map((certificate, index) => ({
    ...certificate,
    name: subjectName(certificate.subject),
    role:
      index === 0 ? "Leaf certificate" : index === chain.length - 1 ? "Root candidate" : "Intermediate CA",
    edge: edgeDescription(facts, certificate, index, chain.length),
    failed: certificate.sha256 === failedFingerprint,
  }));
}

function edgeDescription(facts, certificate, index, chainLength) {
  if (certificate.sha256 === facts.failure?.certificateSha256) {
    const messages = {
      "unknown-issuer": "Not anchored in current Firefox trust",
      expired: "Certificate validity period has ended",
      "hostname-mismatch": `Does not identify ${facts.hostname}`,
      "explicitly-distrusted-authority": "Explicitly distrusted by local Browsec policy",
    };
    return messages[facts.failure.code] ?? facts.failure.summary;
  }

  return index === chainLength - 1
    ? "Trusted by current Firefox policy"
    : "Signature links to next issuer";
}