#!/usr/bin/env python3
"""SAP architecture best-practice rules, ported from the PAA architecture-validator
(github.tools.sap/platform-adoption-advisory/architecture-validator, input/rules.json
+ src/rules/*.ts). Run directly on our clean semantic spec (typed components +
connections + nested blocks) — no SPARQL/OWL/LLM-recognizer needed."""

def _flat(spec):
    """Return [(label_lower, id, [ancestor_block_labels_lower])] for all components."""
    out = []
    def walk(blocks, anc):
        for b in blocks:
            la = anc + [(b.get("label") or "").lower()]
            for c in b.get("components", []):
                out.append((c["label"].lower(), c["id"], la))
            walk(b.get("blocks", []), la)
    walk(spec.get("blocks", []), [])
    return out

def _has(comps, *kw):
    return any(any(k in lbl for k in kw) for lbl, _, _ in comps)

def _ids(comps, *kw):
    return [cid for lbl, cid, _ in comps if any(k in lbl for k in kw)]

LLM_KW   = ("gpt", "llm", "openai", "open ai", "generative ai", "claude", "gemini",
            "anthropic", "foundation model", "large language model", "mistral", "llama")
HUB_KW   = ("generative ai hub", "ai core")
IDP_KW   = ("azure ad", "azure active directory", "entra", "okta", "ping identity",
            "auth0", "3rd party identity", "third party identity", "external identity provider")
IAS_KW   = ("cloud identity services", "identity authentication", "identity provisioning", "ias")
BUILD_KW = ("build process automation", "build apps", "build work zone", "build workzone",
            "business application studio", "build code")
ONPREM_KW = ("s/4hana", "s4hana", "sap ecc", "on-premise", "on premise")
EVENT_KW = ("event mesh", "advanced event mesh", "event hub", "cloud application event hub")

def check_rules(spec):
    """Return a list of best-practice violations (empty = compliant)."""
    c = _flat(spec)
    v = []

    # R6: GenAI/LLM must be consumed via SAP Generative AI Hub / SAP AI Core
    if _has(c, *LLM_KW) and not _has(c, *HUB_KW):
        v.append("GenAI/LLM service present but not via SAP Generative AI Hub or SAP AI Core "
                 "(add 'SAP Generative AI Hub').")
    # R12: AI Core / Gen AI Hub require a management interface
    if _has(c, "ai core", "generative ai hub") and not _has(c, "ai launchpad", "ai core api"):
        v.append("SAP AI Core/Generative AI Hub present but no management interface "
                 "(add 'SAP AI Launchpad').")
    # R5: custom ML models must be managed via AI Core
    if _has(c, "custom model", "ml model", "machine learning model", "trained model") and not _has(c, "ai core"):
        v.append("Custom ML model present but not managed via SAP AI Core.")
    # R4: external IdPs must go through SAP Cloud Identity Services (IAS)
    if _has(c, *IDP_KW) and not _has(c, *IAS_KW):
        v.append("External identity provider present but not integrated via SAP Cloud Identity "
                 "Services (add 'Identity Authentication').")
    # R2: Copilot / AI agents must integrate via Joule
    if _has(c, "copilot", "ai agent", "ai assistant") and not _has(c, "joule"):
        v.append("Copilot/AI agent present but not integrated via SAP Joule.")
    # R10: Joule must be contained within an SAP system superArea
    for lbl, cid, anc in c:
        if "joule" in lbl and not any(any(s in a for s in ("btp", "s/4", "s4hana", "cloud solution",
                                     "on-premise", "sap")) for a in anc):
            v.append("SAP Joule is not contained within an SAP system block.")
            break
    # R3: on-premise/S4 integration needs Cloud Connector or Private Link
    if _has(c, *ONPREM_KW) and not _has(c, "cloud connector", "private link"):
        v.append("S/4HANA / on-premise system present but no Cloud Connector or Private Link.")
    # R1: CAP integrating to external systems needs a Destination service
    if _has(c, "cloud application programming", "cap application", "(cap)") and not _has(c, "destination service"):
        v.append("CAP application present but no SAP Destination service for external integration.")
    # R14: Cloud Connector tunnels to the SAP Connectivity service (complete the secure chain)
    if _has(c, "cloud connector") and not _has(c, "connectivity service"):
        v.append("Cloud Connector present but no SAP Connectivity service (incomplete on-prem tunnel).")
    # R13: event-driven architecture must use an SAP Event service
    event_hint = any("event" in lbl for lbl, _, _ in c) or \
        any("event" in (e.get("label","") or "").lower() for e in spec.get("connections", []))
    if event_hint and not _has(c, *EVENT_KW):
        v.append("Event-driven architecture but no SAP Event Mesh / Advanced Event Mesh / Event Hub.")
    return v

if __name__ == "__main__":
    import sys, json
    spec = json.load(open(sys.argv[1]))
    for x in check_rules(spec): print("VIOLATION:", x)