{% extends "base.html" %}
{% block title %}Findings · ai-protect{% endblock %}

{% block content %}
  {% if system_status %}
  <section class="system-status dark-panel" style="display:flex;align-items:center;gap:14px;padding:10px 16px;margin-bottom:14px;border:1px solid #213047;border-radius:8px">
    {% set lamp_color = {'green':'#23c45e', 'yellow':'#eab308', 'red':'#ef4444'}[system_status.level] %}
    <span title="overall: {{ system_status.level }}"
          style="display:inline-block;width:14px;height:14px;border-radius:50%;background:{{ lamp_color }};box-shadow:0 0 8px {{ lamp_color }}"></span>
    <span style="font-weight:600;color:{{ lamp_color }};text-transform:uppercase;letter-spacing:0.05em;font-size:12px">{{ system_status.level }}</span>
    <span class="muted small">system status</span>
    <span style="flex:1"></span>
    {% for comp_name, comp in system_status.components.items() %}
      {% set c = {'green':'#23c45e', 'yellow':'#eab308', 'red':'#ef4444'}[comp.level] %}
      <span title="{{ comp.detail }}" class="small mono dark-pill" style="display:inline-flex;align-items:center;gap:6px;padding:3px 9px;border-radius:12px">
        <span style="display:inline-block;width:8px;height:8px;border-radius:50%;background:{{ c }}"></span>
        {{ comp_name }}
      </span>
    {% endfor %}
  </section>
  {% endif %}
  <section class="hero">
    {% if stats_scope == "filtered" %}
      <div class="hero-scope" style="display:flex;align-items:center;gap:14px;flex-wrap:wrap">
        <span style="flex:1">
          Showing <strong>filtered</strong> view
          {% if filter_app %} · app <span class="mono">{{ filter_app }}</span>{% endif %}
          {% if filter_severity %} · severity <span class="mono">{{ filter_severity }}</span>{% endif %}
          {% if filter_adapter %} · adapter <span class="mono">{{ filter_adapter }}</span>{% endif %}
          {% if filter_category %} · category <span class="mono">{{ filter_category }}</span>{% endif %}
          {% if filter_fixable %} · ⚡ has fix{% endif %}
          · numbers below reflect this filter ({{ global_total }} total across all apps · <a href="{{ url_for('index') }}">clear</a>)
        </span>
        {# Bulk-dismiss: writes a manual_dismiss Change per finding in the
           current filter. Reason required. Useful for the unverified-intel
           cleanup case: filter to adapter=intel_match&app=X then dismiss
           the lot with one well-documented reason. #}
        <details style="margin-left:auto">
          <summary class="btn btn-secondary" style="cursor:pointer;display:inline-block">Bulk-dismiss {{ stats.total }} filtered</summary>
          <form method="POST" action="{{ url_for('findings_bulk_dismiss') }}"
                style="margin-top:8px;padding:10px;background:#0c1421;border:1px solid #213047;border-radius:6px;min-width:360px"
                onsubmit="return confirm('Dismiss {{ stats.total }} finding(s)? Each gets an applied manual_dismiss Change recorded under your actor name. Use case: clearing unverified intel matches you have eyeballed and confirmed do not apply.')">
            {% if filter_app %}<input type="hidden" name="app" value="{{ filter_app }}">{% endif %}
            {% if filter_severity %}<input type="hidden" name="severity" value="{{ filter_severity }}">{% endif %}
            {% if filter_adapter %}<input type="hidden" name="adapter" value="{{ filter_adapter }}">{% endif %}
            {% if filter_category %}<input type="hidden" name="category" value="{{ filter_category }}">{% endif %}
            <input type="text" name="reason" required minlength="3"
                   placeholder="Reason (recorded on every Change)"
                   style="width:100%;padding:6px 8px;margin-bottom:6px;color:#e6edf5;background:#13202f;border:1px solid #213047;border-radius:4px">
            <label class="small muted" style="display:block;margin:4px 0">
              <input type="checkbox" name="unverified" value="on">
              limit to <code>intel_match_unverified</code> only (skip verified intel + scanner findings)
            </label>
            <button type="submit" class="btn btn-primary" style="margin-top:6px">Dismiss filtered</button>
          </form>
        </details>
      </div>
    {% endif %}
    <div class="hero-stats">
      <div class="stat stat-total">
        <div class="stat-num">{{ stats.total }}</div>
        <div class="stat-label">findings{% if stats_scope == "filtered" %} (filtered){% endif %}</div>
      </div>
      <div class="stat stat-high">
        <div class="stat-num">{{ stats.high_or_above }}</div>
        <div class="stat-label">HIGH or CRITICAL</div>
      </div>
      <div class="stat">
        <div class="stat-num">{{ stats.by_app|length }}</div>
        <div class="stat-label">{% if stats_scope == "filtered" %}apps in view{% else %}apps scanned{% endif %}</div>
      </div>
      <div class="stat">
        <div class="stat-num">{{ stats.by_adapter|length }}</div>
        <div class="stat-label">adapters firing</div>
      </div>
    </div>

    {#
      _url(): build a /  URL preserving every currently-active filter while
      overriding one. Passing None for `value` clears that single filter.
      Used by every pill / dropdown so navigation never silently drops
      filters the user has set (e.g. clicking the "critical" pill while
      viewing app=example-ads-studio must stay on that app).
    #}
    {% macro _url(severity=None, category=None, app=None, adapter=None, fixable=None, override=None, clear=None) -%}
      {%- set qs = {} -%}
      {%- if filter_severity %}{% set _ = qs.update({'severity': filter_severity}) %}{% endif -%}
      {%- if filter_category %}{% set _ = qs.update({'category': filter_category}) %}{% endif -%}
      {%- if filter_app %}{% set _ = qs.update({'app': filter_app}) %}{% endif -%}
      {%- if filter_adapter %}{% set _ = qs.update({'adapter': filter_adapter}) %}{% endif -%}
      {%- if filter_fixable %}{% set _ = qs.update({'fixable': 1}) %}{% endif -%}
      {#- override `clear` first (drop the named filter), then apply explicit set -#}
      {%- if clear %}{% set _ = qs.pop(clear, None) %}{% endif -%}
      {%- if override == 'severity' %}{% set _ = qs.update({'severity': severity}) %}{% endif -%}
      {%- if override == 'category' %}{% set _ = qs.update({'category': category}) %}{% endif -%}
      {%- if override == 'app' %}{% set _ = qs.update({'app': app}) %}{% endif -%}
      {%- if override == 'adapter' %}{% set _ = qs.update({'adapter': adapter}) %}{% endif -%}
      {%- if override == 'fixable' %}{% set _ = qs.update({'fixable': 1}) %}{% endif -%}
      {{ url_for('index', **qs) }}
    {%- endmacro %}

    <div class="severity-row">
      {#- "all" pill = drop severity + fixable, keep everything else
          (app/adapter/category remain sticky). -#}
      <a class="severity-pill sev-all{% if not filter_severity and not filter_fixable %} active{% endif %}"
         href="{% set qs = {} %}{% if filter_category %}{% set _ = qs.update({'category': filter_category}) %}{% endif %}{% if filter_app %}{% set _ = qs.update({'app': filter_app}) %}{% endif %}{% if filter_adapter %}{% set _ = qs.update({'adapter': filter_adapter}) %}{% endif %}{{ url_for('index', **qs) }}">
        all <strong>{{ pill_all_count }}</strong>
      </a>
      {% for sev in severities %}
        {% set cnt = pill_severity_counts.get(sev, 0) %}
        <a class="severity-pill sev-{{ sev }}{% if filter_severity == sev %} active{% endif %}"
           href="{% if filter_severity == sev %}{{ _url(clear='severity') }}{% else %}{{ _url(severity=sev, override='severity') }}{% endif %}">
          {{ sev }} <strong>{{ cnt }}</strong>
        </a>
      {% endfor %}
      <a class="severity-pill sev-fixable{% if filter_fixable %} active{% endif %}"
         href="{% if filter_fixable %}{{ _url(clear='fixable') }}{% else %}{{ _url(override='fixable') }}{% endif %}">
        ⚡ has fix <strong>{{ fixable_count }}</strong>
      </a>
      {# Unverified-intel toggle: by default the dashboard hides
         intel_match_unverified findings (token-overlap noise that grows
         to hundreds per app and drowns real scanner signal). Click to
         re-include in the active view; click again to hide. #}
      {% if include_unverified %}
        <a class="severity-pill sev-info active"
           href="{{ url_for('index') }}"
           title="Unverified intel matches are currently included in the active view. Click to hide them again.">
          intel unverified: shown · hide →
        </a>
      {% elif hidden_unverified_count %}
        <a class="severity-pill sev-low"
           href="{{ url_for('index', include_unverified=1) }}"
           title="Token-overlap intel matches are hidden from the active view. Click to include them for triage / bulk-dismiss.">
          intel unverified hidden <strong>{{ hidden_unverified_count }}</strong>
        </a>
      {% endif %}
    </div>
  </section>

  <section class="filters">
    <div class="filter-group">
      <label>App</label>
      <select data-filter-key="app" class="filter-select">
        <option value="">all apps</option>
        {% for a in apps %}
          <option value="{{ a }}" {% if filter_app == a %}selected{% endif %}>{{ a }}</option>
        {% endfor %}
      </select>
    </div>
    <div class="filter-group">
      <label>Adapter</label>
      <select data-filter-key="adapter" class="filter-select">
        <option value="">all adapters</option>
        {% for a in adapters %}
          <option value="{{ a }}" {% if filter_adapter == a %}selected{% endif %}>{{ a }}</option>
        {% endfor %}
      </select>
    </div>
    <div class="filter-group">
      <label>Category</label>
      <select data-filter-key="category" class="filter-select">
        <option value="">all categories</option>
        {% for c in categories %}
          <option value="{{ c }}" {% if filter_category == c %}selected{% endif %}>{{ c }}</option>
        {% endfor %}
      </select>
    </div>
    {% if filter_severity or filter_app or filter_adapter or filter_category or filter_fixable %}
      <a class="clear-filters" href="{{ url_for('index') }}">clear filters</a>
    {% endif %}
    <a class="download-csv" href="{{ url_for('findings_csv', severity=filter_severity, app=filter_app, adapter=filter_adapter, category=filter_category, fixable=(1 if filter_fixable else None)) }}">
      ⬇ CSV{% if filter_severity or filter_app or filter_adapter or filter_category or filter_fixable %} (filtered){% endif %}
    </a>
    <a class="download-pdf" href="{{ url_for('findings_pdf', severity=filter_severity, app=filter_app, adapter=filter_adapter, category=filter_category, fixable=(1 if filter_fixable else None)) }}">
      ⬇ PDF{% if filter_severity or filter_app or filter_adapter or filter_category or filter_fixable %} (filtered){% else %} (full){% endif %}
    </a>
  </section>

  <div id="bulk-bar" class="bulk-bar" hidden>
    <span class="bulk-count"><strong id="bulk-count">0</strong> selected</span>
    <button id="bulk-fix-btn" class="btn btn-primary">⚡ Fix selected</button>
    <button id="bulk-clear-btn" class="btn btn-secondary">Clear</button>
    <span id="bulk-progress" class="bulk-progress" hidden></span>
  </div>

  <section id="bulk-results" class="bulk-results" hidden>
    <div class="bulk-results-header">
      <h3>Bulk fix results <span id="bulk-results-summary" class="bulk-results-summary"></span></h3>
      <button id="bulk-results-close" class="btn btn-secondary">Hide</button>
    </div>
    <div id="bulk-results-body"></div>
  </section>

  <section class="findings-list">
    {% if findings %}
      <table class="findings">
        <thead>
          <tr>
            <th class="col-check"><input type="checkbox" id="select-all" title="Select all visible (fixable)"></th>
            <th>Severity</th>
            <th>App</th>
            <th>Tier</th>
            <th>Adapter</th>
            <th>Category</th>
            <th>Title</th>
            <th>Affected</th>
            <th>Fix</th>
          </tr>
        </thead>
        <tbody>
          {% for f in findings %}
          {% set tool_meta = catalog.get(f.adapter, {}) %}
          <tr class="finding-row sev-row-{{ f.severity.value }}" data-finding-id="{{ f.finding_id }}">
            <td class="col-check">
              {% if fixable.get(f.finding_id) %}
                <input type="checkbox" class="row-check" name="finding_ids" value="{{ f.finding_id }}">
              {% endif %}
            </td>
            <td>
              <span class="sev-badge sev-{{ f.severity.value }}">{{ f.severity.value }}</span>
              {% if f.evidence.get('intel_match_unverified') %}
                <span class="sev-badge sev-low" title="Unverified intel match — token overlap with a feed advisory; verify the product actually applies before treating as a real finding.">unverified</span>
              {% endif %}
            </td>
            <td class="mono">{{ f.app_name }}</td>
            <td><span class="tier-badge tier-{{ f.tier }}">T{{ f.tier }}</span></td>
            <td class="mono">{{ f.adapter }}</td>
            <td><span class="cat">{{ f.category.value }}</span></td>
            <td>
              <button type="button" class="row-toggle" aria-expanded="false" data-target="d-{{ f.finding_id }}" title="Show details">+</button>
              <a href="{{ url_for('finding_detail', finding_id=f.finding_id) }}">{{ f.title }}</a>
            </td>
            <td class="mono small">
              {% if f.evidence.get('file') %}{{ f.evidence['file'] | replace('/opt/app/', '') }}
                {% if f.evidence.get('line') %}:{{ f.evidence['line'] }}{% endif %}
                {% if f.evidence.get('start_line') %}:{{ f.evidence['start_line'] }}{% endif %}
              {% elif f.affected.get('file') %}{{ f.affected['file'] | replace('/opt/app/', '') }}
              {% elif f.affected.get('target') %}{{ f.affected['target'] }}
              {% elif f.affected.get('app') %}—
              {% endif %}
            </td>
            <td>
              {% if fixable.get(f.finding_id) %}
                <form method="POST" action="{{ url_for('propose_change', finding_id=f.finding_id) }}" style="display:inline">
                  <button type="submit" class="btn btn-primary" style="padding:3px 9px;font-size:11px">Fix</button>
                </form>
              {% else %}
                <span class="small muted">—</span>
              {% endif %}
            </td>
          </tr>
          <tr class="finding-detail-row" id="d-{{ f.finding_id }}" hidden>
            <td colspan="9">
              <div class="finding-detail">
                <dl class="finding-kv">
                  <dt>Description</dt>
                  <dd>{{ f.description or "—" }}</dd>
                  <dt>Stage</dt>
                  <dd class="mono">{{ f.stage }}</dd>
                  <dt>Tool / Source</dt>
                  <dd>
                    <span class="mono">{{ f.adapter }}</span>
                    {% if tool_meta.get('source_url') %}
                      — <a href="{{ tool_meta.source_url }}" target="_blank" rel="noopener">{{ tool_meta.source_url }}</a>
                    {% endif %}
                    {% if tool_meta.get('description') %}
                      <div class="small muted" style="margin-top:4px">{{ tool_meta.description }}</div>
                    {% endif %}
                  </dd>
                  {% if f.evidence %}
                    <dt>Evidence</dt>
                    <dd>
                      <table class="kv-inner">
                        {% for k, v in f.evidence.items() %}
                          {% if v is not none and v != '' %}
                            <tr><th>{{ k }}</th><td class="mono small">{{ v|string|truncate(800, killwords=False, end='…') }}</td></tr>
                          {% endif %}
                        {% endfor %}
                      </table>
                    </dd>
                  {% endif %}
                  {% if f.affected %}
                    <dt>Affected</dt>
                    <dd>
                      <table class="kv-inner">
                        {% for k, v in f.affected.items() %}
                          {% if v is not none and v != '' %}
                            <tr><th>{{ k }}</th><td class="mono small">{{ v|string|truncate(400, killwords=False, end='…') }}</td></tr>
                          {% endif %}
                        {% endfor %}
                      </table>
                    </dd>
                  {% endif %}
                  {% if f.compliance %}
                    <dt>Compliance</dt>
                    <dd>
                      {% for c in f.compliance %}
                        <span class="cat" style="margin-right:4px">{{ c }}</span>
                      {% endfor %}
                    </dd>
                  {% endif %}
                  {% if f.remediation %}
                    <dt>Remediation</dt>
                    <dd>{{ f.remediation }}</dd>
                  {% endif %}
                  {% if f.references %}
                    <dt>References</dt>
                    <dd>
                      {% for r in f.references %}
                        {% if r %}<div class="mono small"><a href="{{ r|httpsafe }}" target="_blank" rel="noopener">{{ r }}</a></div>{% endif %}
                      {% endfor %}
                    </dd>
                  {% endif %}
                  <dt>Finding ID</dt>
                  <dd class="mono small">{{ f.finding_id }}</dd>
                </dl>
              </div>
            </td>
          </tr>
          {% endfor %}
        </tbody>
      </table>
    {% else %}
      <div class="empty">
        No findings yet. Run a scan:
        <pre>python -m pipeline.cli --findings &lt;path&gt; run &lt;manifest&gt; --stage build</pre>
      </div>
    {% endif %}
  </section>

  <script>
  // Filter dropdowns: changing one filter must PRESERVE every other active
  // filter — so e.g. selecting a different app from /?adapter=bandit keeps
  // the adapter filter, doesn't reset to all-adapters.
  (function() {
    document.querySelectorAll('select.filter-select').forEach(sel => {
      sel.addEventListener('change', () => {
        const params = new URLSearchParams(window.location.search);
        const key = sel.dataset.filterKey;
        if (sel.value) {
          params.set(key, sel.value);
        } else {
          params.delete(key);
        }
        const qs = params.toString();
        window.location.href = '/' + (qs ? ('?' + qs) : '');
      });
    });
  })();
  // Row-detail toggles: click the "+" next to a finding title to expand the
  // inline detail row below it (server-rendered, no fetch).
  (function() {
    document.querySelectorAll('.row-toggle').forEach(btn => {
      btn.addEventListener('click', (e) => {
        e.preventDefault();
        const id = btn.getAttribute('data-target');
        const row = document.getElementById(id);
        if (!row) return;
        const open = !row.hidden;
        row.hidden = open;
        btn.textContent = open ? '+' : '−';
        btn.setAttribute('aria-expanded', String(!open));
        btn.title = open ? 'Show details' : 'Hide details';
      });
    });
  })();
  (function() {
    const bar = document.getElementById('bulk-bar');
    const countEl = document.getElementById('bulk-count');
    const fixBtn = document.getElementById('bulk-fix-btn');
    const clearBtn = document.getElementById('bulk-clear-btn');
    const progress = document.getElementById('bulk-progress');
    const selectAll = document.getElementById('select-all');
    const resultsSection = document.getElementById('bulk-results');
    const resultsBody = document.getElementById('bulk-results-body');
    const resultsSummary = document.getElementById('bulk-results-summary');
    const resultsClose = document.getElementById('bulk-results-close');

    function selected() {
      return Array.from(document.querySelectorAll('.row-check:checked'));
    }
    function refresh() {
      const n = selected().length;
      countEl.textContent = n;
      bar.hidden = (n === 0);
    }
    document.querySelectorAll('.row-check').forEach(cb => cb.addEventListener('change', refresh));
    if (selectAll) {
      selectAll.addEventListener('change', () => {
        document.querySelectorAll('.row-check').forEach(cb => { cb.checked = selectAll.checked; });
        refresh();
      });
    }
    if (clearBtn) {
      clearBtn.addEventListener('click', () => {
        document.querySelectorAll('.row-check').forEach(cb => { cb.checked = false; });
        if (selectAll) selectAll.checked = false;
        refresh();
      });
    }

    function escapeHtml(s) {
      return (s || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
    }

    function renderResult(r) {
      const status = r.status || 'failed';
      const success = (status === 'applied' || status === 'applied-tests-failed');
      const skipStates = ['no-remediator', 'no-manifest', 'no-fix-needed'];
      const cls = success ? 'ok' : (skipStates.includes(status) ? 'skip' : 'fail');
      const changeLink = r.change_id
        ? `<a href="/change/${r.change_id}" class="mono small">${r.change_id.slice(0, 8)}…</a>`
        : '<span class="small muted">—</span>';
      const errorBlock = r.error
        ? `<div class="bulk-error"><strong>error:</strong> ${escapeHtml(r.error)}</div>`
        : '';
      return `
        <div class="bulk-result bulk-result-${cls}">
          <div class="bulk-result-head">
            <span class="bulk-status bulk-status-${cls}">${escapeHtml(status)}</span>
            <span class="bulk-result-title">${escapeHtml(r.title || r.finding_id)}</span>
            <span class="bulk-result-meta mono small">${escapeHtml(r.app_name || '')} · ${changeLink}</span>
          </div>
          ${errorBlock}
          <pre class="bulk-log">${escapeHtml(r.log || '(no log)')}</pre>
        </div>`;
    }

    function summaryPill(summary) {
      const parts = [];
      for (const [k, v] of Object.entries(summary || {})) {
        const cls = (k === 'applied') ? 'ok' : (k === 'applied-tests-failed' ? 'warn' : 'fail');
        parts.push(`<span class="bulk-summary-pill bulk-summary-${cls}">${escapeHtml(k)}: ${v}</span>`);
      }
      return parts.join('');
    }

    if (fixBtn) {
      fixBtn.addEventListener('click', async () => {
        const ids = selected().map(cb => cb.value);
        if (ids.length === 0) return;
        if (!confirm(`Run propose → approve → apply for ${ids.length} finding(s)?\n\nThis writes file changes on disk (with backups). Tier 1/2 manifests require human actor — you are signed in as the configured actor.`)) return;
        fixBtn.disabled = true;
        clearBtn.disabled = true;
        bar.classList.add('bulk-running');
        progress.hidden = false;
        progress.textContent = `applying ${ids.length} fix(es)…`;
        try {
          const resp = await fetch('/findings/bulk-fix', {
            method: 'POST',
            headers: {'Content-Type': 'application/json'},
            body: JSON.stringify({finding_ids: ids}),
          });
          if (!resp.ok) {
            const txt = await resp.text();
            throw new Error(`HTTP ${resp.status}: ${txt.slice(0, 200)}`);
          }
          const data = await resp.json();
          resultsBody.innerHTML = (data.results || []).map(renderResult).join('');
          resultsSummary.innerHTML = summaryPill(data.summary || {});
          resultsSection.hidden = false;
          resultsSection.scrollIntoView({behavior: 'smooth', block: 'start'});
        } catch (e) {
          resultsBody.innerHTML = `<div class="bulk-error"><strong>request failed:</strong> ${escapeHtml(String(e))}</div>`;
          resultsSummary.innerHTML = '';
          resultsSection.hidden = false;
        } finally {
          fixBtn.disabled = false;
          clearBtn.disabled = false;
          bar.classList.remove('bulk-running');
          progress.hidden = true;
        }
      });
    }
    if (resultsClose) {
      resultsClose.addEventListener('click', () => { resultsSection.hidden = true; });
    }
  })();
  </script>
{% endblock %}