OWASP Juice Shop - 安全测试流水线：ZAP 与 CI 集成的基线扫描

// Juice Shop 漏洞分布分析
const vulnerabilityProfile = {
  injection: ['SQL注入', 'NoSQL注入', 'LDAP注入'],
  xss: ['反射型XSS', '存储型XSS', 'DOM型XSS'],
  auth: ['弱认证', '会话管理', '权限绕过'],
  sensitive: ['敏感数据暴露', '配置错误'],
  access: ['访问控制缺失', '权限提升'],
  crypto: ['弱加密', '随机数问题'],
  injection2: ['命令注入', '路径遍历'],
  xxe: ['XXE外部实体注入'],
  security: ['安全配置错误', '依赖漏洞'],
  logging: ['日志不足', '监控缺失']
};

/**
 * 安全测试目标分层策略
 * 根据业务影响和攻击概率划分优先级
 */
class SecurityTestTargets {
  constructor() {
    this.criticalPaths = [
      '/rest/user/login',           // 认证接口
      '/rest/basket/order',         // 订单接口
      '/api/Products',              // 产品接口
      '/rest/file-upload'           // 文件上传
    ];
    
    this.highRiskPages = [
      '/#/login',                   // 登录页面
      '/#/register',                // 注册页面
      '/#/basket',                  // 购物车
      '/#/profile'                  // 用户资料
    ];
    
    this.mediumRiskPages = [
      '/#/',                        // 首页
      '/#/search',                  // 搜索页面
      '/#/about'                    // 关于页面
    ];
  }

  /**
   * 获取测试优先级配置
   * @returns {Object} 优先级配置对象
   */
  getTestPriority() {
    return {
      critical: {
        paths: this.criticalPaths,
        scanType: 'active',
        threshold: 0, // 任何问题都失败
        timeout: 300000 // 5分钟超时
      },
      high: {
        paths: this.highRiskPages,
        scanType: 'baseline',
        threshold: 2, // 允许2个低风险问题
        timeout: 180000 // 3分钟超时
      },
      medium: {
        paths: this.mediumRiskPages,
        scanType: 'passive',
        threshold: 5, // 允许5个信息级问题
        timeout: 120000 // 2分钟超时
      }
    };
  }
}

/**
 * ZAP 扫描引擎核心实现
 * 提供统一的扫描接口和配置管理
 */
class ZAPScanner {
  constructor(config = {}) {
    this.config = {
      zapHost: config.zapHost || 'localhost',
      zapPort: config.zapPort || 8080,
      apiKey: config.apiKey || '',
      targetUrl: config.targetUrl || 'http://localhost:3000',
      ...config
    };
    
    this.scanResults = {
      baseline: null,
      active: null,
      alerts: [],
      statistics: {}
    };
  }

  /**
   * 初始化 ZAP 连接
   * @returns {Promise<boolean>} 连接是否成功
   */
  async initialize() {
    try {
      const response = await this.makeRequest('GET', '/JSON/core/view/version/');
      console.log('ZAP版本:', response.version);
      return true;
    } catch (error) {
      console.error('ZAP连接失败:', error.message);
      return false;
    }
  }

  /**
   * 执行基线扫描
   * @param {Object} options 扫描选项
   * @returns {Promise<Object>} 扫描结果
   */
  async runBaselineScan(options = {}) {
    const scanConfig = {
      target: this.config.targetUrl,
      maxDepth: options.maxDepth || 5,
      maxChildren: options.maxChildren || 10,
      contextName: options.contextName || 'default',
      ...options
    };

    try {
      console.log(`开始基线扫描: ${scanConfig.target}`);
      
      // 1. 启动 Spider
      const spiderId = await this.startSpider(scanConfig);
      await this.waitForSpider(spiderId);
      
      // 2. 执行被动扫描
      await this.waitForPassiveScan();
      
      // 3. 生成报告
      const results = await this.generateReport('baseline');
      
      this.scanResults.baseline = results;
      return results;
      
    } catch (error) {
      console.error('基线扫描失败:', error);
      throw error;
    }
  }

  /**
   * 执行主动扫描
   * @param {Object} options 扫描选项
   * @returns {Promise<Object>} 扫描结果
   */
  async runActiveScan(options = {}) {
    const scanConfig = {
      target: this.config.targetUrl,
      policy: options.policy || 'Default Policy',
      maxScanDuration: options.maxScanDuration || 3600000, // 1小时
      ...options
    };

    try {
      console.log(`开始主动扫描: ${scanConfig.target}`);
      
      // 1. 创建扫描上下文
      const contextId = await this.createContext(scanConfig);
      
      // 2. 添加认证信息（如果需要）
      if (scanConfig.auth) {
        await this.setAuthentication(contextId, scanConfig.auth);
      }
      
      // 3. 启动主动扫描
      const scanId = await this.startActiveScan(contextId, scanConfig);
      await this.waitForActiveScan(scanId);
      
      // 4. 生成报告
      const results = await this.generateReport('active');
      
      this.scanResults.active = results;
      return results;
      
    } catch (error) {
      console.error('主动扫描失败:', error);
      throw error;
    }
  }

  /**
   * 启动 Spider 爬虫
   * @param {Object} config 扫描配置
   * @returns {Promise<string>} Spider ID
   */
  async startSpider(config) {
    const params = new URLSearchParams({
      url: config.target,
      maxDepth: config.maxDepth,
      maxChildren: config.maxChildren,
      contextName: config.contextName
    });

    const response = await this.makeRequest('GET', `/JSON/spider/action/scan/?${params}`);
    return response.scan;
  }

  /**
   * 等待 Spider 完成
   * @param {string} spiderId Spider ID
   * @returns {Promise<void>}
   */
  async waitForSpider(spiderId) {
    return new Promise((resolve, reject) => {
      const checkStatus = async () => {
        try {
          const status = await this.makeRequest('GET', `/JSON/spider/view/status/?scanId=${spiderId}`);
          const progress = parseInt(status.status);
          
          console.log(`Spider进度: ${progress}%`);
          
          if (progress >= 100) {
            resolve();
          } else {
            setTimeout(checkStatus, 5000); // 5秒后再次检查
          }
        } catch (error) {
          reject(error);
        }
      };
      
      checkStatus();
    });
  }

  /**
   * 等待被动扫描完成
   * @returns {Promise<void>}
   */
  async waitForPassiveScan() {
    return new Promise((resolve, reject) => {
      const checkStatus = async () => {
        try {
          const recordsToScan = await this.makeRequest('GET', '/JSON/pscan/view/recordsToScan/');
          const count = parseInt(recordsToScan.recordsToScan);
          
          console.log(`被动扫描剩余: ${count} 条记录`);
          
          if (count === 0) {
            resolve();
          } else {
            setTimeout(checkStatus, 3000); // 3秒后再次检查
          }
        } catch (error) {
          reject(error);
        }
      };
      
      checkStatus();
    });
  }

  /**
   * 启动主动扫描
   * @param {string} contextId 上下文ID
   * @param {Object} config 扫描配置
   * @returns {Promise<string>} 扫描ID
   */
  async startActiveScan(contextId, config) {
    const params = new URLSearchParams({
      url: config.target,
      contextId: contextId,
      policyId: config.policy,
      maxScanDuration: config.maxScanDuration
    });

    const response = await this.makeRequest('GET', `/JSON/ascan/action/scan/?${params}`);
    return response.scan;
  }

  /**
   * 等待主动扫描完成
   * @param {string} scanId 扫描ID
   * @returns {Promise<void>}
   */
  async waitForActiveScan(scanId) {
    return new Promise((resolve, reject) => {
      const checkStatus = async () => {
        try {
          const status = await this.makeRequest('GET', `/JSON/ascan/view/status/?scanId=${scanId}`);
          const progress = parseInt(status.status);
          
          console.log(`主动扫描进度: ${progress}%`);
          
          if (progress >= 100) {
            resolve();
          } else {
            setTimeout(checkStatus, 10000); // 10秒后再次检查
          }
        } catch (error) {
          reject(error);
        }
      };
      
      checkStatus();
    });
  }

  /**
   * 生成扫描报告
   * @param {string} scanType 扫描类型
   * @returns {Promise<Object>} 报告数据
   */
  async generateReport(scanType) {
    try {
      // 获取告警信息
      const alerts = await this.makeRequest('GET', '/JSON/core/view/alerts/');
      
      // 获取统计信息
      const stats = await this.makeRequest('GET', '/JSON/stats/view/sites/');
      
      const report = {
        scanType: scanType,
        timestamp: new Date().toISOString(),
        target: this.config.targetUrl,
        alerts: alerts.alerts || [],
        statistics: stats,
        summary: this.generateSummary(alerts.alerts || [])
      };
      
      return report;
      
    } catch (error) {
      console.error('生成报告失败:', error);
      throw error;
    }
  }

  /**
   * 生成扫描摘要
   * @param {Array} alerts 告警列表
   * @returns {Object} 摘要信息
   */
  generateSummary(alerts) {
    const summary = {
      total: alerts.length,
      high: 0,
      medium: 0,
      low: 0,
      informational: 0
    };

    alerts.forEach(alert => {
      const risk = alert.risk.toLowerCase();
      if (risk.includes('high')) summary.high++;
      else if (risk.includes('medium')) summary.medium++;
      else if (risk.includes('low')) summary.low++;
      else summary.informational++;
    });

    return summary;
  }

  /**
   * 发送 HTTP 请求到 ZAP API
   * @param {string} method HTTP 方法
   * @param {string} endpoint API 端点
   * @param {Object} data 请求数据
   * @returns {Promise<Object>} 响应数据
   */
  async makeRequest(method, endpoint, data = null) {
    const url = `http://${this.config.zapHost}:${this.config.zapPort}${endpoint}`;
    
    const options = {
      method: method,
      headers: {
        'Content-Type': 'application/json'
      }
    };

    if (this.config.apiKey) {
      url += `${endpoint.includes('?') ? '&' : '?'}apikey=${this.config.apiKey}`;
    }

    try {
      const response = await fetch(url, options);
      
      if (!response.ok) {
        throw new Error(`ZAP API请求失败: ${response.status} ${response.statusText}`);
      }
      
      return await response.json();
    } catch (error) {
      throw new Error(`ZAP API通信错误: ${error.message}`);
    }
  }
}

/**
 * 高级安全扫描策略实现
 * 支持多阶段扫描和智能决策
 */
class AdvancedScanStrategy {
  constructor() {
    this.strategies = new Map();
    this.scanHistory = [];
    this.riskThresholds = {
      critical: 0,
      high: 1,
      medium: 3,
      low: 5
    };
  }

  /**
   * 注册扫描策略
   * @param {string} name 策略名称
   * @param {Object} strategy 策略配置
   */
  registerStrategy(name, strategy) {
    this.strategies.set(name, {
      ...strategy,
      name: name,
      registeredAt: new Date()
    });
  }

  /**
   * 执行智能扫描决策
   * @param {Object} context 扫描上下文
   * @returns {Promise<Object>} 扫描结果
   */
  async executeIntelligentScan(context) {
    // 1. 分析变更影响
    const changeImpact = await this.analyzeChangeImpact(context);
    
    // 2. 选择扫描策略
    const strategy = this.selectScanStrategy(changeImpact);
    
    // 3. 执行扫描
    const results = await this.executeScan(strategy, context);
    
    // 4. 分析结果
    const analysis = this.analyzeResults(results, strategy);
    
    // 5. 记录历史
    this.recordScanHistory({
      context: context,
      strategy: strategy,
      results: results,
      analysis: analysis,
      timestamp: new Date()
    });
    
    return {
      strategy: strategy.name,
      results: results,
      analysis: analysis,
      recommendation: this.generateRecommendation(analysis)
    };
  }

  /**
   * 分析代码变更影响
   * @param {Object} context 上下文信息
   * @returns {Promise<Object>} 影响分析结果
   */
  async analyzeChangeImpact(context) {
    const impact = {
      files: context.changedFiles || [],
      components: new Set(),
      riskLevel: 'low',
      scanScope: 'partial'
    };

    // 分析变更文件类型
    context.changedFiles.forEach(file => {
      if (file.includes('auth') || file.includes('login')) {
        impact.components.add('authentication');
        impact.riskLevel = 'high';
      } else if (file.includes('api') || file.includes('controller')) {
        impact.components.add('api');
        impact.riskLevel = impact.riskLevel === 'high' ? 'high' : 'medium';
      } else if (file.includes('model') || file.includes('database')) {
        impact.components.add('database');
        impact.riskLevel = impact.riskLevel === 'high' ? 'high' : 'medium';
      } else if (file.includes('view') || file.includes('template')) {
        impact.components.add('frontend');
        impact.riskLevel = impact.riskLevel === 'low' ? 'low' : 'medium';
      }
    });

    // 确定扫描范围
    if (impact.riskLevel === 'high' || impact.components.has('authentication')) {
      impact.scanScope = 'full';
    } else if (impact.components.size > 1) {
      impact.scanScope = 'comprehensive';
    }

    return impact;
  }

  /**
   * 选择扫描策略
   * @param {Object} impact 影响分析
   * @returns {Object} 扫描策略
   */
  selectScanStrategy(impact) {
    if (impact.scanScope === 'full') {
      return this.strategies.get('comprehensive');
    } else if (impact.scanScope === 'comprehensive') {
      return this.strategies.get('targeted');
    } else {
      return this.strategies.get('baseline');
    }
  }

  /**
   * 执行扫描
   * @param {Object} strategy 扫描策略
   * @param {Object} context 执行上下文
   * @returns {Promise<Object>} 扫描结果
   */
  async executeScan(strategy, context) {
    const scanner = new ZAPScanner(strategy.zapConfig);
    
    await scanner.initialize();
    
    const results = {};
    
    // 执行策略中定义的扫描阶段
    for (const phase of strategy.phases) {
      console.log(`执行扫描阶段: ${phase.name}`);
      
      switch (phase.type) {
        case 'baseline':
          results.baseline = await scanner.runBaselineScan(phase.config);
          break;
        case 'active':
          results.active = await scanner.runActiveScan(phase.config);
          break;
        case 'custom':
          results.custom = await this.executeCustomScan(phase, context);
          break;
      }
      
      // 检查是否需要提前终止
      if (this.shouldStopEarly(results, strategy)) {
        console.log('达到停止条件，提前终止扫描');
        break;
      }
    }
    
    return results;
  }

  /**
   * 分析扫描结果
   * @param {Object} results 扫描结果
   * @param {Object} strategy 扫描策略
   * @returns {Object} 分析结果
   */
  analyzeResults(results, strategy) {
    const analysis = {
      totalAlerts: 0,
      riskDistribution: { high: 0, medium: 0, low: 0, informational: 0 },
      criticalIssues: [],
      recommendations: [],
      passThreshold: true
    };

    // 聚合所有扫描阶段的告警
    Object.values(results).forEach(result => {
      if (result && result.alerts) {
        result.alerts.forEach(alert => {
          analysis.totalAlerts++;
          const risk = alert.risk.toLowerCase();
          
          if (risk.includes('high')) {
            analysis.riskDistribution.high++;
            if (alert.alert.includes('Critical') || alert.alert.includes('SQL Injection')) {
              analysis.criticalIssues.push(alert);
            }
          } else if (risk.includes('medium')) {
            analysis.riskDistribution.medium++;
          } else if (risk.includes('low')) {
            analysis.riskDistribution.low++;
          } else {
            analysis.riskDistribution.informational++;
          }
        });
      }
    });

    // 检查是否通过阈值
    const thresholds = strategy.thresholds || this.riskThresholds;
    if (analysis.riskDistribution.high > thresholds.high ||
        analysis.riskDistribution.medium > thresholds.medium ||
        analysis.riskDistribution.low > thresholds.low) {
      analysis.passThreshold = false;
    }

    // 生成建议
    analysis.recommendations = this.generateRecommendations(analysis);

    return analysis;
  }

  /**
   * 生成修复建议
   * @param {Object} analysis 分析结果
   * @returns {Array} 建议列表
   */
  generateRecommendations(analysis) {
    const recommendations = [];

    if (analysis.criticalIssues.length > 0) {
      recommendations.push({
        priority: 'critical',
        title: '立即修复关键安全漏洞',
        description: `发现 ${analysis.criticalIssues.length} 个关键安全问题，需要立即修复`,
        actions: analysis.criticalIssues.map(issue => ({
          issue: issue.alert,
          url: issue.url,
          recommendation: this.getFixRecommendation(issue.alert)
        }))
      });
    }

    if (analysis.riskDistribution.high > 0) {
      recommendations.push({
        priority: 'high',
        title: '修复高风险安全问题',
        description: `发现 ${analysis.riskDistribution.high} 个高风险安全问题`,
        actions: ['进行代码安全审查', '实施输入验证', '加强访问控制']
      });
    }

    if (analysis.totalAlerts > 10) {
      recommendations.push({
        priority: 'medium',
        title: '优化安全配置',
        description: '安全问题数量较多，建议优化整体安全配置',
        actions: ['更新安全策略', '加强安全培训', '定期安全扫描']
      });
    }

    return recommendations;
  }

  /**
   * 获取特定问题的修复建议
   * @param {string} issue 问题类型
   * @returns {string} 修复建议
   */
  getFixRecommendation(issue) {
    const recommendations = {
      'SQL Injection': '使用参数化查询或ORM，避免字符串拼接SQL',
      'Cross Site Scripting': '实施输出编码和CSP策略',
      'Broken Authentication': '加强密码策略和会话管理',
      'Sensitive Data Exposure': '加密敏感数据，使用HTTPS',
      'Security Misconfiguration': '遵循安全配置最佳实践',
      'default': '参考OWASP安全指南进行修复'
    };

    return recommendations[issue] || recommendations['default'];
  }

  /**
   * 记录扫描历史
   * @param {Object} record 扫描记录
   */
  recordScanHistory(record) {
    this.scanHistory.push(record);
    
    // 保持历史记录在合理范围内
    if (this.scanHistory.length > 100) {
      this.scanHistory = this.scanHistory.slice(-50);
    }
  }

  /**
   * 生成综合建议
   * @param {Object} analysis 分析结果
   * @returns {Object} 综合建议
   */
  generateRecommendation(analysis) {
    return {
      shouldDeploy: analysis.passThreshold,
      priority: analysis.criticalIssues.length > 0 ? 'critical' : 
                analysis.riskDistribution.high > 0 ? 'high' : 'medium',
      nextSteps: analysis.recommendations,
      estimatedFixTime: this.estimateFixTime(analysis),
      securityScore: this.calculateSecurityScore(analysis)
    };
  }

  /**
   * 估算修复时间
   * @param {Object} analysis 分析结果
   * @returns {string} 时间估算
   */
  estimateFixTime(analysis) {
    let hours = 0;
    
    hours += analysis.criticalIssues.length * 4; // 每个关键问题4小时
    hours += analysis.riskDistribution.high * 2;  // 每个高风险问题2小时
    hours += analysis.riskDistribution.medium * 1; // 每个中风险问题1小时
    hours += analysis.riskDistribution.low * 0.5;   // 每个低风险问题0.5小时
    
    return `${Math.ceil(hours)} 小时`;
  }

  /**
   * 计算安全评分
   * @param {Object} analysis 分析结果
   * @returns {number} 安全评分 (0-100)
   */
  calculateSecurityScore(analysis) {
    let score = 100;
    
    score -= analysis.criticalIssues.length * 25;
    score -= analysis.riskDistribution.high * 10;
    score -= analysis.riskDistribution.medium * 5;
    score -= analysis.riskDistribution.low * 2;
    score -= analysis.riskDistribution.informational * 0.5;
    
    return Math.max(0, Math.round(score));
  }
}

/**
 * 安全门控系统实现
 * 根据扫描结果决定是否允许部署
 */
class SecurityGateSystem {
  constructor(config = {}) {
    this.config = {
      thresholds: {
        critical: 0,
        high: config.highThreshold || 2,
        medium: config.mediumThreshold || 5,
        low: config.lowThreshold || 10
      },
      policies: {
        requireApproval: config.requireApproval || false,
        blockOnCritical: config.blockOnCritical !== false,
        allowOverride: config.allowOverride || false
      },
      ...config
    };
    
    this.approvers = new Set(config.approvers || []);
    this.overrides = new Map();
  }

  /**
   * 评估安全门控
   * @param {Object} scanResults 扫描结果
   * @param {Object} context 上下文信息
   * @returns {Promise<Object>} 评估结果
   */
  async evaluateGate(scanResults, context = {}) {
    const evaluation = {
      passed: false,
      blocked: false,
      requiresApproval: false,
      reasons: [],
      recommendations: [],
      riskScore: 0,
      canOverride: false
    };

    // 1. 计算风险评分
    evaluation.riskScore = this.calculateRiskScore(scanResults);
    
    // 2. 检查关键问题
    const criticalIssues = this.findCriticalIssues(scanResults);
    if (criticalIssues.length > 0) {
      evaluation.blocked = this.config.policies.blockOnCritical;
      evaluation.reasons.push(`发现 ${criticalIssues.length} 个关键安全问题`);
      evaluation.recommendations.push(...this.getCriticalRecommendations(criticalIssues));
    }

    // 3. 检查阈值违规
    const thresholdViolations = this.checkThresholds(scanResults);
    if (thresholdViolations.length > 0) {
      evaluation.passed = false;
      evaluation.reasons.push(...thresholdViolations.map(v => v.message));
      evaluation.recommendations.push(...thresholdViolations.map(v => v.recommendation));
    }

    // 4. 确定是否需要审批
    if (evaluation.riskScore > 70 || !evaluation.passed) {
      evaluation.requiresApproval = this.config.policies.requireApproval;
    }

    // 5. 检查是否可以覆盖
    evaluation.canOverride = this.config.policies.allowOverride && 
                           !evaluation.blocked && 
                           context.hasPermission;

    // 6. 最终决策
    if (!evaluation.blocked && thresholdViolations.length === 0) {
      evaluation.passed = true;
    }

    // 7. 记录评估历史
    this.recordEvaluation({
      timestamp: new Date(),
      scanResults: scanResults,
      context: context,
      evaluation: evaluation
    });

    return evaluation;
  }

  /**
   * 计算风险评分
   * @param {Object} scanResults 扫描结果
   * @returns {number} 风险评分 (0-100)
   */
  calculateRiskScore(scanResults) {
    let score = 0;
    
    if (!scanResults || !scanResults.alerts) {
      return score;
    }

    scanResults.alerts.forEach(alert => {
      const risk = alert.risk.toLowerCase();
      const confidence = alert.confidence.toLowerCase();
      
      let riskWeight = 0;
      let confidenceMultiplier = 1;
      
      // 风险权重
      if (risk.includes('critical')) riskWeight = 50;
      else if (risk.includes('high')) riskWeight = 25;
      else if (risk.includes('medium')) riskWeight = 10;
      else if (risk.includes('low')) riskWeight = 5;
      else riskWeight = 1;
      
      // 置信度乘数
      if (confidence.includes('high')) confidenceMultiplier = 1.0;
      else if (confidence.includes('medium')) confidenceMultiplier = 0.7;
      else if (confidence.includes('low')) confidenceMultiplier = 0.4;
      
      score += riskWeight * confidenceMultiplier;
    });

    return Math.min(100, Math.round(score));
  }

  /**
   * 查找关键安全问题
   * @param {Object} scanResults 扫描结果
   * @returns {Array} 关键问题列表
   */
  findCriticalIssues(scanResults) {
    const criticalIssues = [];
    const criticalPatterns = [
      'SQL Injection',
      'Remote Code Execution',
      'XXE',
      'Deserialization',
      'Insecure Direct Object Reference',
      'Authentication Bypass'
    ];

    if (!scanResults || !scanResults.alerts) {
      return criticalIssues;
    }

    scanResults.alerts.forEach(alert => {
      if (criticalPatterns.some(pattern => alert.alert.includes(pattern))) {
        criticalIssues.push({
          type: alert.alert,
          url: alert.url,
          risk: alert.risk,
          description: alert.desc,
          solution: alert.solution
        });
      }
    });

    return criticalIssues;
  }

  /**
   * 检查阈值违规
   * @param {Object} scanResults 扫描结果
   * @returns {Array} 违规列表
   */
  checkThresholds(scanResults) {
    const violations = [];
    
    if (!scanResults || !scanResults.alerts) {
      return violations;
    }

    const distribution = this.getRiskDistribution(scanResults.alerts);
    const thresholds = this.config.thresholds;

    Object.entries(thresholds).forEach(([risk, threshold]) => {
      const count = distribution[risk] || 0;
      if (count > threshold) {
        violations.push({
          risk: risk,
          count: count,
          threshold: threshold,
          message: `${risk} 风险问题数量 (${count}) 超过阈值 (${threshold})`,
          recommendation: `需要修复 ${count - threshold} 个 ${risk} 风险问题`
        });
      }
    });

    return violations;
  }

  /**
   * 获取风险分布
   * @param {Array} alerts 告警列表
   * @returns {Object} 风险分布
   */
  getRiskDistribution(alerts) {
    const distribution = {
      critical: 0,
      high: 0,
      medium: 0,
      low: 0,
      informational: 0
    };

    alerts.forEach(alert => {
      const risk = alert.risk.toLowerCase();
      if (risk.includes('critical')) distribution.critical++;
      else if (risk.includes('high')) distribution.high++;
      else if (risk.includes('medium')) distribution.medium++;
      else if (risk.includes('low')) distribution.low++;
      else distribution.informational++;
    });

    return distribution;
  }

  /**
   * 获取关键问题修复建议
   * @param {Array} criticalIssues 关键问题列表
   * @returns {Array} 修复建议
   */
  getCriticalRecommendations(criticalIssues) {
    const recommendations = [];
    
    criticalIssues.forEach(issue => {
      recommendations.push({
        priority: 'critical',
        issue: issue.type,
        url: issue.url,
        action: '立即修复',
        estimate: '2-4小时',
        resources: this.getFixResources(issue.type)
      });
    });

    return recommendations;
  }

  /**
   * 获取修复资源
   * @param {string} issueType 问题类型
   * @returns {Array} 资源链接
   */
  getFixResources(issueType) {
    const resources = {
      'SQL Injection': [
        'https://owasp.org/www-community/attacks/SQL_Injection',
        'https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html'
      ],
      'Remote Code Execution': [
        'https://owasp.org/www-project-top-ten/2017/A1_2017-Injection',
        'https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html'
      ],
      'default': [
        'https://owasp.org/www-project-top-ten/',
        'https://cheatsheetseries.owasp.org/'
      ]
    };

    return resources[issueType] || resources['default'];
  }

  /**
   * 记录评估历史
   * @param {Object} record 评估记录
   */
  recordEvaluation(record) {
    // 这里可以集成数据库或日志系统
    console.log('安全门控评估记录:', {
      timestamp: record.timestamp,
      passed: record.evaluation.passed,
      blocked: record.evaluation.blocked,
      riskScore: record.evaluation.riskScore
    });
  }

  /**
   * 请求安全审批
   * @param {Object} evaluation 评估结果
   * @param {string} requester 请求者
   * @returns {Promise<string>} 审批ID
   */
  async requestApproval(evaluation, requester) {
    const approvalId = `approval-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
    
    const approvalRequest = {
      id: approvalId,
      timestamp: new Date(),
      requester: requester,
      evaluation: evaluation,
      status: 'pending',
      approvers: Array.from(this.approvers),
      comments: []
    };

    // 这里可以集成审批系统（如Jira、ServiceNow等）
    console.log('创建安全审批请求:', approvalRequest);
    
    return approvalId;
  }

  /**
   * 处理审批响应
   * @param {string} approvalId 审批ID
   * @param {string} approver 审批者
   * @param {boolean} approved 是否批准
   * @param {string} comments 评论
   * @returns {Promise<Object>} 处理结果
   */
  async processApproval(approvalId, approver, approved, comments = '') {
    if (!this.approvers.has(approver)) {
      throw new Error(`用户 ${approver} 没有审批权限`);
    }

    const approval = {
      id: approvalId,
      approver: approver,
      approved: approved,
      comments: comments,
      timestamp: new Date()
    };

    this.overrides.set(approvalId, approval);
    
    console.log('安全审批处理:', approval);
    
    return approval;
  }
}