import { Callout } from "../components/Callout";

export function SecurityModelPage() {
  return (
    <div>
      <h1 id="security-model">Security Model</h1>
      <p>
        Veylant IA is designed with a Zero Trust security model. Every component assumes the
        network is hostile and authenticates and authorizes each request independently.
      </p>

      <h2 id="zero-trust">Zero Trust Architecture</h2>
      <div className="grid grid-cols-1 sm:grid-cols-2 gap-4 my-4">
        {[
          {
            title: "mTLS Between Services",
            desc: "All internal service-to-service communication uses mutual TLS. The proxy, PII service, PostgreSQL, Redis, and ClickHouse all authenticate each other via certificates.",
          },
          {
            title: "TLS 1.3 Externally",
            desc: "External traffic uses TLS 1.3 minimum. TLS 1.0 and 1.1 are disabled at the Traefik/nginx gateway level.",
          },
          {
            title: "JWT Validation",
            desc: "Every API request carries a signed JWT. The proxy validates the signature against Keycloak's JWKS endpoint on every request (cached with TTL).",
          },
          {
            title: "Network Policies",
            desc: "Kubernetes NetworkPolicies restrict pod-to-pod communication. Only the proxy can reach the PII service; only Prometheus can scrape /metrics.",
          },
        ].map((item) => (
          <div key={item.title} className="rounded-lg border bg-card p-4">
            <h3 className="font-semibold text-sm mb-2">{item.title}</h3>
            <p className="text-sm text-muted-foreground leading-relaxed">{item.desc}</p>
          </div>
        ))}
      </div>

      <h2 id="encryption">Encryption at Rest</h2>
      <ul>
        <li>
          <strong>Prompt storage</strong> — Encrypted with AES-256-GCM using the{" "}
          <code>crypto.key</code> config value (application-level, independent of disk encryption)
        </li>
        <li>
          <strong>PII pseudonymization mappings</strong> — Encrypted in Redis with AES-256-GCM per
          mapping entry
        </li>
        <li>
          <strong>API keys</strong> — Stored as SHA-256 hashes only. The prefix (e.g.{" "}
          <code>sk-vyl_ab12cd34</code>) is kept for display, but the full key is never stored
        </li>
        <li>
          <strong>HashiCorp Vault</strong> — Provider API keys and the crypto key are stored in
          Vault; 90-day rotation cycle
        </li>
      </ul>

      <h2 id="audit-security">Audit-of-the-Audit</h2>
      <p>
        All accesses to audit logs and compliance reports are themselves logged. This two-level
        audit trail satisfies requirements for sensitive data access monitoring.
      </p>

      <h2 id="semgrep">Custom Security Rules (SAST)</h2>
      <p>
        CI enforces custom Semgrep rules (<code>.semgrep.yml</code>) that catch common security
        issues specific to this codebase:
      </p>
      <div className="overflow-x-auto my-4">
        <table className="w-full text-sm border rounded-lg overflow-hidden">
          <thead>
            <tr className="bg-muted/50 border-b">
              <th className="text-left px-4 py-2.5 font-semibold">Rule</th>
              <th className="text-left px-4 py-2.5 font-semibold">What it catches</th>
            </tr>
          </thead>
          <tbody>
            {[
              { rule: "context-background-in-handler", catches: "context.Background() in HTTP handlers — use r.Context() to propagate cancellation" },
              { rule: "sql-string-concat", catches: "SQL string concatenation — use parameterized queries ($1, $2, ...)" },
              { rule: "sensitive-field-in-log", catches: "Logging password, api_key, token, secret, Authorization, email, prompt" },
              { rule: "hardcoded-api-key", catches: "String literals starting with sk- hardcoded in source" },
              { rule: "request-body-without-limit", catches: "json.NewDecoder(r.Body) without http.MaxBytesReader" },
              { rule: "python-eval-exec", catches: "eval() or exec() on variables in the PII service" },
            ].map((row) => (
              <tr key={row.rule} className="border-b last:border-0">
                <td className="px-4 py-2.5 font-mono text-xs">{row.rule}</td>
                <td className="px-4 py-2.5 text-xs text-muted-foreground">{row.catches}</td>
              </tr>
            ))}
          </tbody>
        </table>
      </div>

      <h2 id="pentest">Penetration Test Results (v1.0.0)</h2>
      <Callout type="tip" title="Pentest passed — February 2026">
        Grey-box penetration test completed June 9–20, 2026. Results:
        <ul className="mt-2 space-y-1">
          <li>
            <strong>Critical:</strong> 0
          </li>
          <li>
            <strong>High:</strong> 0
          </li>
          <li>
            <strong>Medium:</strong> 2 (remediated before launch)
          </li>
          <li>
            <strong>Low:</strong> 3 (accepted risk, backlog)
          </li>
        </ul>
        Full report available to enterprise customers under NDA.
      </Callout>

      <h2 id="ci-pipeline">CI Security Pipeline</h2>
      <ul>
        <li><strong>Semgrep</strong> — SAST on every PR</li>
        <li><strong>Trivy</strong> — Container image scan (CRITICAL/HIGH blocking)</li>
        <li><strong>gitleaks</strong> — Secret detection in commits and history</li>
        <li><strong>OWASP ZAP</strong> — DAST (non-blocking, main branch only)</li>
      </ul>
    </div>
  );
}
