using System.Collections.Frozen;

namespace DataTransfer.Client.Services;

/// <summary>
///     File types that can run code when opened, or are commonly used to deliver malware or phishing. Common archives
///     (zip, 7z, rar) and documents are deliberately not listed, so the warning stays meaningful.
/// </summary>
public static class RiskyFileTypes
{
    private static readonly FrozenSet<string> Extensions = new[]
    {
        // Windows programs and installers
        "exe", "com", "scr", "pif", "cpl", "msi", "msix", "msixbundle", "msp", "appx", "appxbundle", "appref-ms",
        "application", "gadget", "dll", "sys", "drv", "ocx",

        // Scripts
        "bat", "cmd", "ps1", "psm1", "vbs", "vbe", "js", "jse", "mjs", "wsf", "wsh", "wsc", "sct", "hta", "jar", "py",
        "pyw", "sh", "bash", "command", "applescript", "scpt", "reg", "inf", "msc",

        // Shortcuts and shell files that can launch programs
        "lnk", "url", "scf", "library-ms", "search-ms", "settingcontent-ms",

        // macOS and Linux applications and packages
        "app", "pkg", "mpkg", "dmg", "workflow", "action", "deb", "rpm", "appimage", "run", "bin",

        // Disk images, often used to bypass download protection
        "iso", "img", "vhd", "vhdx",

        // Office documents with macros, add-ins and other formats abused for malware
        "docm", "dotm", "xlsm", "xltm", "xlam", "xll", "pptm", "potm", "ppam", "ppsm", "sldm", "one", "chm",

        // Web pages opened from disk, a common way to deliver phishing
        "htm", "html", "xhtml", "mht", "mhtml"
    }.ToFrozenSet(StringComparer.OrdinalIgnoreCase);

    /// <summary>Only the last extension counts, so <c>invoice.pdf.exe</c> is risky and <c>setup.exe.txt</c> is not.</summary>
    public static bool IsRisky(string? fileName) =>
        Path.GetExtension(fileName) is { Length: > 1 } extension && Extensions.Contains(extension[1..]);
}