rules:
  # =============================================================================
  # APEX (SALESFORCE) POST-QUANTUM CRYPTOGRAPHIC VULNERABILITY RULES
  # =============================================================================
  # Uses pattern-regex because opengrep's Apex AST parser does not yet support
  # pattern/pattern-either for method call matching. Regex approach is reliable
  # and covers all Salesforce Crypto class API patterns.
  # =============================================================================

  # ---------------------------------------------------------------------------
  # HASH FUNCTION VULNERABILITIES (Grover's Algorithm)
  # ---------------------------------------------------------------------------

  - id: apex-use-of-md5-quantum
    pattern-regex: "Crypto\\.generateDigest\\s*\\(\\s*['\"]MD5['\"]"
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: apex-use-of-sha1-quantum
    pattern-regex: "Crypto\\.generateDigest\\s*\\(\\s*['\"]SHA-?1['\"]"
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  # ---------------------------------------------------------------------------
  # SYMMETRIC CRYPTOGRAPHY VULNERABILITIES (Grover's Algorithm)
  # ---------------------------------------------------------------------------

  - id: apex-use-of-des-quantum
    pattern-regex: "Crypto\\.(encrypt|decrypt)\\s*\\(\\s*['\"]DES['\"]"
    message: >-
      DES has a 56-bit key -- completely broken classically and trivially quantum-vulnerable. Migrate to
      AES-256-GCM.
    severity: ERROR
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: apex-use-of-3des-quantum
    pattern-regex: "Crypto\\.(encrypt|decrypt)\\s*\\(\\s*['\"](?:3DES|TripleDES|DESede)['\"]"
    message: >-
      3DES has 112-bit effective key strength -- broken classically and quantum-vulnerable. NIST deprecated
      3DES in 2023. Migrate to AES-256-GCM.
    severity: ERROR
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: apex-use-of-aes128-quantum
    pattern-regex: "Crypto\\.(encrypt|decrypt|encryptWithManagedIV|decryptWithManagedIV)\\s*\\(\\s*['\"]AES128['\"]"
    message: >-
      AES-128/192 provide only 64/96-bit quantum security under Grover's algorithm. Use AES-256 for
      128-bit post-quantum security.
    severity: WARNING
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 5

  # ---------------------------------------------------------------------------
  # MAC VULNERABILITIES
  # ---------------------------------------------------------------------------

  - id: apex-use-of-hmac-md5-quantum
    pattern-regex: "Crypto\\.generateMac\\s*\\(\\s*['\"](?i:hmacMD5|HmacMD5)['\"]"
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: WARNING
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7

  - id: apex-use-of-hmac-sha1-quantum
    pattern-regex: "Crypto\\.generateMac\\s*\\(\\s*['\"](?i:hmacSHA1|HmacSHA1)['\"]"
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: WARNING
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 6

  # ---------------------------------------------------------------------------
  # SIGNATURE VULNERABILITIES (Shor's Algorithm)
  # ---------------------------------------------------------------------------

  - id: apex-rsa-signature-callout-quantum
    pattern-regex: "Crypto\\.sign\\s*\\(\\s*['\"]RSA(?:-SHA(?:1|256))?['\"]"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  # ---------------------------------------------------------------------------
  # WEAK AES KEY SIZE
  # ---------------------------------------------------------------------------

  - id: apex-weak-aes-key-size-quantum
    pattern-regex: "Crypto\\.generateAesKey\\s*\\(\\s*128\\s*\\)"
    message: >-
      AES-128/192 provide only 64/96-bit quantum security under Grover's algorithm. Use AES-256 for
      128-bit post-quantum security.
    severity: WARNING
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 5
