wulf-pulse/lib/services/remediation-default-params.ts

/**
 * Remediation Default-Params Derivation (Phase 22, Wave 0)
 *
 * Pure transform: given an action type (from campaign-classifier.ts's
 * `mapVerdictToActions` vocabulary) and bounded evidence fields, returns the
 * default `params` object an operator sees pre-filled in the Action Area
 * before approving (feeds `ApproveActionInput.params` in
 * lib/services/remediation-service.ts). No DB/fetch imports — pure function.
 */

export interface DefaultParamEvidence {
  requesterEmail: string | null;
  senderEmail: string | null;
  senderDomain: string | null;
  messageId: string | null;
}

/**
 * Exhaustive per-action-type default-params table (UI-SPEC Action Area
 * Spec). Unknown/future action types fall through to `{}` rather than
 * throwing, so newly introduced action types never break the Action Area.
 */
export function deriveDefaultParams(actionType: string, evidence: DefaultParamEvidence): Record<string, unknown> {
  switch (actionType) {
    case 'no_action':
      return {};
    case 'warn_user':
      return { recipientEmail: evidence.requesterEmail ?? '', message: '' };
    case 'block_sender':
      return { senderEmail: evidence.senderEmail ?? '', senderDomain: evidence.senderDomain ?? '' };
    case 'purge_message':
      return { messageId: evidence.messageId ?? '', mailboxes: [] };
    case 'reset_password':
      return { userPrincipalName: evidence.requesterEmail ?? '' };
    case 'isolate_endpoint':
      return { deviceId: '' };
    case 'disable_forwarding_rule':
      return { userPrincipalName: evidence.requesterEmail ?? '', ruleName: '' };
    case 'acknowledge_user':
      return {};
    default:
      return {};
  }
}