"""Signatures statiques de navigateurs pour la détection passive d'imposteurs.

Module de données pures : aucun import, aucune logique.
Les valeurs de fingerprint H2 correspondent aux captures réelles
(format Akamai : SETTINGS|WINDOW_UPDATE|PRIORITY|PSEUDO_ORDER,
 SETTINGS au format clé:valeur séparés par des virgules).
"""

# Signatures de navigateurs légitimes.
# Clés des SETTINGS H2 :
#   1 = HEADER_TABLE_SIZE        2 = ENABLE_PUSH
#   3 = MAX_CONCURRENT_STREAMS   4 = INITIAL_WINDOW_SIZE
#   5 = MAX_FRAME_SIZE           6 = MAX_HEADER_LIST_SIZE
#   9 = UNKNOWN (Safari uniquement)
BROWSER_SIGNATURES: dict = {
    "Chrome": {
        # Chrome 119+ (Blink+BoringSSL) — stable depuis Chrome 106
        "h2_settings_exact": {1: 65536, 2: 0, 4: 6291456, 6: 262144},
        "h2_settings_forbidden_keys": [3, 5],
        "h2_window_update": 15663105,
        "h2_window_update_tolerance": 1000,
        "h2_priority_frames_expected": False,
        "pseudo_header_order": "m,a,s,p",
        "tls": {
            "ja4_families": ["Chromium", "Chrome", "Edge"],
            "grease_expected": True,
        },
        "headers_required": ["Accept-Language"],
        "headers_sec_fetch_required": True,   # Sec-Fetch-Site/Mode/Dest
        "headers_ch_ua_required": True,        # Sec-CH-UA
        "headers_sec_fetch_forbidden": False,
        "accept_language_required": True,
    },
    "Firefox": {
        # Firefox 90+ (Gecko+NSS)
        "h2_settings_exact": {1: 65536, 4: 131072, 5: 16384},
        "h2_settings_forbidden_keys": [2, 3, 6],
        "h2_window_update": 12517377,
        "h2_window_update_tolerance": 1000,
        "h2_priority_frames_expected": False,  # CSV réel : PRIORITY = 0
        "pseudo_header_order": "m,p,s,a",      # ordre réel capturé (pas m,p,a,s)
        "tls": {
            "ja4_families": ["Firefox"],
            "grease_expected": False,
        },
        "headers_required": ["Accept-Language"],
        "headers_sec_fetch_required": True,
        "headers_ch_ua_required": False,       # Firefox ne supporte pas les Client Hints
        "headers_sec_fetch_forbidden": False,
        "accept_language_required": True,
    },
    "Safari": {
        # Safari 15+ (WebKit, iOS et macOS)
        # SETTINGS observés : 1:4096, 3:100, 4:65535
        # La clé 4 (INITIAL_WINDOW_SIZE=65535) distingue Safari de Chrome/Firefox
        "h2_settings_exact": {1: 4096, 3: 100, 4: 65535},
        "h2_settings_forbidden_keys": [2, 5, 6],
        "h2_window_update": 10485760,
        "h2_window_update_tolerance": 1000,
        "h2_priority_frames_expected": False,
        "pseudo_header_order": "m,a,s,p",      # identique à Chrome (WU=10485760 distingue)
        "tls": {
            "ja4_families": ["Safari"],
            "grease_expected": False,
        },
        "headers_required": ["Accept-Language"],
        "headers_sec_fetch_required": False,   # Safari ne supporte pas Sec-Fetch-*
        "headers_ch_ua_required": False,       # Safari ne supporte pas les Client Hints
        "headers_sec_fetch_forbidden": True,   # Présence = incohérence
        "accept_language_required": True,
    },
}

# Signatures d'outils non-navigateur (signaux de rejet rapide).
NON_BROWSER_SIGNATURES: dict = {
    "curl": {
        "h2_window_update": 0,            # pas de WINDOW_UPDATE frame
        "pseudo_header_order": "m,p,s,a",
    },
    "python_httpx": {
        "h2_window_update": 0,
        "h2_settings_window": 65535,      # INITIAL_WINDOW_SIZE typique
    },
    "go_net_http": {
        "h2_window_update": 1073676289,   # valeur distincte go net/http
    },
}

# Seuils de décision : score minimum pour valider un bypass LEGITIMATE_BROWSER.
BROWSER_THRESHOLDS: dict = {
    "Chrome":  0.72,
    "Firefox": 0.68,
    "Safari":  0.68,
}

# Poids des dimensions de scoring (somme = 1.00).
DIMENSION_WEIGHTS: dict = {
    "h2_settings":   0.30,
    "h2_window":     0.15,
    "pseudo_order":  0.15,
    "h2_priority":   0.10,
    "http_headers":  0.15,
    "tls_structure": 0.10,
    "ja4_dict":      0.05,
}
