{% extends "base.html" %}
{% block title %}{{ finding.title }} · ai-protect{% endblock %}
{% block autorefresh %}window.AI_PROTECT_NO_AUTOREFRESH = true;{% endblock %}

{% block content %}
  <a class="back" href="{{ url_for('index') }}">← back to all findings</a>
  <article class="finding-detail">
    <header>
      <span class="sev-badge sev-{{ finding.severity.value }}">{{ finding.severity.value }}</span>
      <span class="tier-badge tier-{{ finding.tier }}">Tier {{ finding.tier }}</span>
      <span class="cat">{{ finding.category.value }}</span>
      <h1>{{ finding.title }}</h1>
      <div class="meta">
        <span><strong>app:</strong> {{ finding.app_name }}</span>
        <span><strong>adapter:</strong> {{ finding.adapter }}</span>
        <span><strong>stage:</strong> {{ finding.stage }}</span>
        <span><strong>fingerprint:</strong> <code>{{ finding.fingerprint }}</code></span>
      </div>
    </header>

    {% if auto_resolve_change %}
    <section class="dark-panel" style="padding:10px 14px;border-left:3px solid #23c45e;border-radius:6px;margin-top:14px">
      <strong style="color:#23c45e">Auto-resolved by re-scan.</strong>
      <p class="small" style="margin:6px 0 0 0">
        Change <a href="{{ url_for('change_detail', change_id=auto_resolve_change.change_id) }}" style="color:#9ec5ea"><code>{{ auto_resolve_change.change_id }}</code></a>
        — adapter <code>{{ auto_resolve_change.rescan_adapter }}</code> did not re-emit this fingerprint
        on the most recent {{ auto_resolve_change.notes.split('stage=')[1].split(' ')[0] if 'stage=' in (auto_resolve_change.notes or '') else 'scan' }}-stage scan
        ({{ auto_resolve_change.last_state_at|localtime }}).
        The scanner is treating this finding as fixed/gone. If that's wrong (e.g. the file was moved
        rather than fixed), revert the Change from its detail page — subsequent absent re-scans
        will respect the revert and not re-auto-resolve.
      </p>
    </section>
    {% endif %}

    {% if finding.evidence.get('intel_match_unverified') %}
    <section class="dark-panel" style="padding:10px 14px;border-left:3px solid #eab308;border-radius:6px;margin-top:14px">
      <strong style="color:#eab308">Unverified intel match — review before acting.</strong>
      <p class="small" style="margin:6px 0 0 0">
        This finding came from <code>intel_match</code>, which cross-references manifest text against external CVE feeds via token overlap.
        It is <em>not</em> ground truth that the affected product is in use — only that a word in this app's manifest
        ({{ finding.evidence.get('matched_tokens', [])|join(', ') }}) appeared in the feed's CVE title/summary.
        Severity is capped at HIGH for unverified matches even when the CVE is on CISA KEV.
        Verify by opening the advisory below and confirming the product/version matches what's actually deployed —
        if it doesn't, dismiss this finding.
      </p>
      <form method="POST" action="{{ url_for('finding_dismiss', finding_id=finding.finding_id) }}"
            style="margin-top:10px;display:flex;gap:6px;align-items:flex-start;flex-wrap:wrap"
            onsubmit="return confirm('Dismiss this finding? A Change with state=applied will be written and recorded under your actor name. To undo: revert that Change from its detail page.')">
        <input type="text" name="reason" required minlength="3"
               placeholder="Why dismiss? (e.g. 'manifest mentions Kirby but we don\'t run it')"
               style="flex:1;min-width:300px;padding:5px 8px;background:#13202f;color:#e6edf5;border:1px solid #213047;border-radius:4px">
        <button type="submit" class="btn btn-secondary" style="padding:5px 14px">Dismiss</button>
      </form>
    </section>
    {% endif %}

    <section>
      <h2>Description</h2>
      <p>{{ finding.description }}</p>
    </section>

    {% if finding.remediation %}
    <section>
      <h2>Remediation</h2>
      <p>{{ finding.remediation }}</p>
    </section>
    {% endif %}

    <section>
      <h2>Evidence</h2>
      <table class="kv">
        {% for k, v in finding.evidence.items() %}
          <tr><td class="kv-key">{{ k }}</td><td class="kv-val"><pre>{{ v }}</pre></td></tr>
        {% endfor %}
      </table>
    </section>

    <section>
      <h2>Affected</h2>
      <table class="kv">
        {% for k, v in finding.affected.items() %}
          <tr><td class="kv-key">{{ k }}</td><td class="kv-val mono">{{ v }}</td></tr>
        {% endfor %}
      </table>
    </section>

    {% if finding.compliance %}
    <section>
      <h2>Compliance evidence</h2>
      <ul class="compliance-list">
        {% for c in finding.compliance %}
          <li>{{ c }}</li>
        {% endfor %}
      </ul>
    </section>
    {% endif %}

    {% if finding.references %}
    <section>
      <h2>References</h2>
      <ul>
        {% for r in finding.references %}
          <li><a href="{{ r|httpsafe }}" target="_blank" rel="noopener">{{ r }}</a></li>
        {% endfor %}
      </ul>
    </section>
    {% endif %}

    {% if cve_ids %}
    <section>
      <h2>Related intel
        <small class="muted" style="font-weight:normal;margin-left:6px">
          external feed coverage for CVE{{ 's' if cve_ids|length > 1 else '' }} mentioned in this finding
        </small>
      </h2>
      <p class="muted small">
        CVE{{ 's' if cve_ids|length > 1 else '' }} in this finding:
        {% for c in cve_ids %}<code>{{ c }}</code>{% if not loop.last %}, {% endif %}{% endfor %}.
        Intel feeds <em>supplement</em> the scanner's own data — the finding above is the source of truth for what's in your code;
        these rows show what external feeds are saying about the same CVE.
      </p>
      {% if related_intel %}
        <table class="findings">
          <thead><tr><th>CVE</th><th>Severity</th><th>CVSS</th><th>Title</th><th>Source feed</th><th>Published</th><th>Fetched</th></tr></thead>
          <tbody>
            {% for r in related_intel %}
              <tr>
                <td class="mono small">{% if r.item.link %}<a href="{{ r.item.link|httpsafe }}" target="_blank" rel="noopener">{{ r.item.cve_id }}</a>{% else %}{{ r.item.cve_id }}{% endif %}</td>
                <td>{% if r.item.severity %}<span class="sev-badge sev-{{ r.item.severity }}">{{ r.item.severity }}</span>{% else %}—{% endif %}</td>
                <td class="mono small">{{ '%.1f'|format(r.item.cvss) if r.item.cvss is not none else '—' }}</td>
                <td class="small">{{ r.item.title }}</td>
                <td class="small">{{ r.feed_name }}</td>
                <td class="mono small">{{ r.item.published }}</td>
                <td class="mono small">{{ r.item.fetched_at|localtime }}</td>
              </tr>
            {% endfor %}
          </tbody>
        </table>
      {% else %}
        <p class="muted small">No intel matches yet for these CVEs. Configured feeds may not have surfaced them, or none of your feeds cover this CVE source. Add or fetch feeds on <a href="{{ url_for('feeds_page') }}">Feeds</a>.</p>
      {% endif %}
    </section>
    {% endif %}

    <section>
      <h2>Remediation</h2>

      {% if existing_changes %}
        <p>This finding already has {{ existing_changes|length }} change(s):</p>
        <ul>
          {% for c in existing_changes %}
            <li>
              <a href="{{ url_for('change_detail', change_id=c.change_id) }}"><code>{{ c.change_id }}</code></a> —
              <span class="state-badge state-{{ c.state.value }}">{{ c.state.value }}</span>
              {{ c.summary }}
            </li>
          {% endfor %}
        </ul>
      {% endif %}

      {% if remediators %}
        <p class="muted">Auto-fix available via <strong>{{ remediators|join(', ') }}</strong>. Proposed changes are reviewable before any file is touched; backups are taken automatically.</p>
        <form method="POST" action="{{ url_for('propose_change', finding_id=finding.finding_id) }}" style="display:inline">
          <button type="submit" class="btn btn-primary">Propose remediation</button>
        </form>
      {% else %}
        <div class="warn-banner">
          <strong>No automated remediator for this finding.</strong>
          <p>
            Phase 1 covers SUPPLY_CHAIN findings (pip_audit / grype / osv_scanner) and Nuclei
            <em>missing security header</em> findings. Other categories — Bandit, Semgrep,
            secrets, MCP scope, AI red-team — go on the human path. Open a ticket against
            <code>{{ finding.adapter }}</code> + <code>{{ finding.category.value }}</code>
            for AppSec triage.
          </p>
        </div>
      {% endif %}

      <a href="{{ url_for('remediations_queue') }}" class="btn btn-secondary" style="margin-left:8px">View remediation queue</a>
    </section>
  </article>
{% endblock %}