{% extends "base.html" %}
{% block title %}{{ analysis.server_name }} - Pre-Patch Report{% endblock %}
{% block head %}{% if run.is_running %}<meta http-equiv="refresh" content="3">{% endif %}{% endblock %}
{% block heading %}Pre-Patch Report: {{ analysis.server_name }}{% endblock %}
{% block header_actions %}<div class="header-actions">
  {% if analysis.server_id and not run.is_running %}
    <form method="post" action="/analysis/{{ run.id }}/servers/{{ analysis.id }}/reanalyze" class="inline-form" title="Re-collect this server's facts (read-only) and fetch all of its CVEs from Canonical again, bypassing the cache">
      <button type="submit" class="btn btn-secondary">Re-analyze</button>
    </form>
  {% endif %}
  <a href="/analysis/{{ run.id }}/servers/{{ analysis.id }}/export.xlsx" class="btn btn-primary" download>Export to Excel</a>
  <a href="/analysis/{{ run.id }}" class="btn btn-secondary">All Servers</a>
</div>{% endblock %}
{% block content %}
{% set amazon = analysis.os_id == "amzn" %}
{% macro severity_cell(f) %}<span class="badge {{ severity_classes[f.severity] }}"{% if f.nvd_note %} title="{{ f.nvd_note }}"{% endif %}>{{ f.severity }}</span>{% if f.priority %}<div class="muted small">{{ "ALAS Severity" if analysis.os_id == "amzn" else "Ubuntu Priority" }}: {{ f.priority }}</div>{% endif %}{% endmacro %}
{% macro cvss_cell(f) %}{% if f.cvss_score is not none %}<span{% if f.cvss_vector %} title="{{ f.cvss_vector }}"{% endif %}>{{ f.cvss_label }}</span>{% else %}<span class="muted">—</span>{% endif %}
  <div class="muted small">{% if f.nvd_status is none %}not captured{% elif f.nvd_status in ("ok", "stale") %}Source: {{ "NVD" if f.cvss_source == "nvd@nist.gov" else (f.cvss_source or "unknown") }}{% if f.cvss_source_type and f.cvss_source != "nvd@nist.gov" %} ({{ f.cvss_source_type }}){% endif %}{% if f.nvd_status == "stale" %} &middot; stale cache{% endif %}{% else %}{{ nvd_status_labels.get(f.nvd_status, f.nvd_status) }}{% endif %}</div>{% endmacro %}
{% macro findings_table(groups) %}
  {% if groups %}
    <div class="table-scroll">
    <table class="table findings-table">
      {% if analysis.os_id == "amzn" %}
      <thead><tr><th>CVE</th><th>Severity</th><th>CVSS</th><th>Source RPM</th><th>Installed Version</th><th>Amazon Fixed Version (Advisory)</th><th>Repository Candidate</th><th>Remediation Result</th><th>Installed Binary Package(s)</th></tr></thead>
      {% else %}
      <thead><tr><th>CVE</th><th>Severity</th><th>CVSS</th><th>Ubuntu Source Package</th><th>Installed Version</th><th>Canonical Fixed Version</th><th>Repository Candidate</th><th>Remediation Result</th><th>Installed Binary Package(s)</th></tr></thead>
      {% endif %}
      <tbody>
      {% for g in groups %}
          <tr>
            <td><span class="badge badge-neutral">{{ g.cve_count }} CVE{{ "s" if g.cve_count != 1 else "" }}</span>
              {% if g.cve_count > 1 %}
                <details><summary>Affected CVEs</summary>
                  <ul class="plain-list">{% for f in g.rows %}<li><code>{{ f.cve }}</code> {{ severity_cell(f) }} {{ cvss_cell(f) }}</li>{% endfor %}</ul>
                </details>
              {% else %}<div><code>{{ g.cves[0] }}</code></div>{% endif %}
            </td>
            <td>{{ severity_cell(g.highest_row) }}</td>
            <td class="cvss">{{ cvss_cell(g.highest_row) }}</td>
            <td><strong>{{ g.source or '-' }}</strong></td>
            <td><code>{{ g.installed_version or "-" }}</code></td>
            <td>{% if g.fixed_version %}<code>{{ g.fixed_version }}</code>{% for pocket in g.pockets %} <span class="muted small">({{ pocket }})</span>{% endfor %}{% else %}-{% endif %}</td>
            <td><code>{{ g.candidate_version or "-" }}</code></td>
            <td><span class="badge {{ status_classes.get(g.status, 'badge-neutral') }}">{{ status_labels.get(g.status, g.status) }}</span>
                {% if g.detail %}<div class="muted small finding-detail">{{ g.detail }}</div>{% endif %}</td>
            <td class="pkg-list">
              {% if g.binary_packages|length > 6 %}
                <details><summary>{{ g.binary_packages|length }} packages</summary>{% for b in g.binary_packages %}<code>{{ b }}</code> {% endfor %}</details>
              {% else %}
                {% for b in g.binary_packages %}<code>{{ b }}</code> {% else %}<span class="muted">-</span>{% endfor %}
              {% endif %}
            </td>
          </tr>
      {% endfor %}
      </tbody>
    </table>
    </div>
  {% else %}
    <p class="muted small">None.</p>
  {% endif %}
{% endmacro %}
{% set bucket_classes = {"action": "badge-danger", "investigate": "badge-warning", "no_action": "badge-success"} %}
{% if run.is_running and run.progress_message %}
  <p class="progress-message">{{ run.progress_message }}&hellip; <span class="muted small">(this page refreshes automatically)</span></p>
{% endif %}
{% if not is_latest %}
  <div class="alert alert-warning">This is a historical report from analysis #{{ run.id }}. A newer analysis exists.</div>
{% endif %}

<div class="card">
  <div class="card-header">
    <h2>Server</h2>
    {% if analysis.status == "complete" %}<span class="badge badge-success">ANALYSIS COMPLETE</span>
    {% elif analysis.status == "failed" %}<span class="badge badge-danger">ANALYSIS FAILED</span>
    {% elif analysis.status == "unsupported" %}<span class="badge badge-neutral">{{ "OS NOT SUPPORTED" if (analysis.error or "").endswith("(end of life)") else "OS NOT SUPPORTED YET" }}</span>
    {% else %}<span class="badge badge-warning">{{ analysis.status|upper }}</span>{% endif %}
  </div>
  {% if analysis.error and analysis.status == "unsupported" %}<div class="alert alert-warning">{{ analysis.error }}</div>
  {% elif analysis.error %}<div class="alert alert-error">{{ analysis.error }}</div>{% endif %}
  <dl class="kv report-header">
    <dt>Server Name</dt><dd>{{ analysis.server_name }}</dd>
    {% if analysis.display_name %}<dt>Display Name</dt><dd>{{ analysis.display_name }}</dd>{% endif %}
    <dt>IP</dt><dd><code>{{ analysis.ip_address or "-" }}</code></dd>
    <dt>Remote Hostname</dt><dd>{{ analysis.remote_hostname or "-" }}</dd>
    <dt>{{ "Ubuntu" if analysis.os_id in (none, "ubuntu") else "Operating System" }}</dt><dd>{{ analysis.os_pretty_name or "-" }}</dd>
    <dt>{{ "Releasever" if amazon else "Codename" }}</dt><dd>{{ analysis.os_codename or "-" }}</dd>
    <dt>Architecture</dt><dd>{{ analysis.architecture or "-" }}</dd>
    <dt>Running Kernel</dt><dd>{{ analysis.running_kernel or "-" }}</dd>
    <dt>Analysis Time</dt><dd>{{ (analysis.completed_at or analysis.started_at or run.started_at)|timestamp }}</dd>
    {% if amazon %}
    <dt>Security Advisories</dt>
    <dd>Amazon Linux 2023 updateinfo (ALAS) of releasever {{ analysis.os_codename or "?" }} and the latest release, fetched on this workstation</dd>
    {% else %}
    <dt>Canonical Security Metadata</dt>
    <dd>{% include "_metadata_status.html" %}
        <div class="muted small">{{ run.metadata_source or "" }}</div></dd>
    {% endif %}
    <dt>Cache Lookups <span class="muted small">(whole run)</span></dt>
    <dd>{% set r = run %}{% include "_cache_stats.html" %}</dd>
    <dt>APT Metadata</dt>
    <dd>{% if analysis.apt_updated_at %}Workstation private lists{% if analysis.os_codename %} ({{ analysis.os_codename }}, {{ analysis.os_codename }}-updates, {{ analysis.os_codename }}-security{% if analysis.architecture %}; {{ analysis.architecture }}{% endif %}){% endif %} updated {{ analysis.apt_updated_at|timestamp }}{% if analysis.apt_age_hours is not none %} ({{ "%.1f"|format(analysis.apt_age_hours) }} hours before analysis){% endif %}{% else %}<span class="muted">not used</span>{% endif %}</dd>
    <dt>Current Reboot Required</dt>
    <dd>{% if analysis.current_reboot_required is none %}<span class="muted">unknown</span>{% elif analysis.current_reboot_required %}<strong>YES</strong>{% if analysis.reboot_required_packages %} <span class="muted small">({{ analysis.reboot_required_packages|join(", ") }})</span>{% endif %}{% else %}NO{% endif %}</dd>
    <dt>Expected Reboot After Planned Patch</dt>
    <dd>{% if analysis.expected_reboot is none %}<span class="muted">unknown</span>{% elif analysis.expected_reboot %}<strong>YES EXPECTED</strong>{% else %}NO EXPECTED REBOOT{% endif %}
        <div class="muted small">{{ reboot_help }}</div></dd>
  </dl>
  {% if analysis.warnings %}
    <div class="alert alert-warning"><ul class="plain-list">{% for w in analysis.warnings %}<li>{{ w }}</li>{% endfor %}</ul></div>
  {% endif %}
</div>

<div class="card patch-decision" id="patch-decision">
  <div class="card-header">
    <h2>Patch Decision</h2>
    {% set ex = patch.execution %}
    {% if ex %}<span class="badge {{ patch_badges.get(ex.state, 'badge-warning') }}">{{ patch_labels.get(ex.state, ex.state)|upper }}</span>
    {% else %}<span class="badge badge-neutral">PENDING REVIEW</span>{% endif %}
  </div>
  {% if patching_unsupported %}
    <p class="muted patching-unsupported">{{ patching_unsupported }}</p>
  {% else %}
  {% if patch.not_checked_warning %}<div class="alert alert-warning not-checked-warning">{{ patch.not_checked_warning }}</div>{% endif %}
  {% if patch.excluded_warning %}<div class="alert alert-warning excluded-warning">{{ patch.excluded_warning }}</div>{% endif %}
  {% if ex and ex.decision == "REJECTED" %}
    <p><strong>Rejected</strong> on {{ ex.decided_at|timestamp }}. No packages were downloaded, copied or installed. The report remains available for reference.</p>
  {% elif ex %}
    <p>Approved on {{ ex.decided_at|timestamp }}. <a href="/patch/{{ ex.id }}" class="btn btn-secondary btn-sm">View Patch Execution #{{ ex.id }}</a></p>
  {% else %}
    <dl class="kv">
      <dt>Local Staging</dt><dd>{% if patch.local_path %}<code>{{ patch.local_path }}</code>{% else %}<span class="text-danger">unavailable</span>{% endif %}
          <div class="muted small">From Settings &rarr; Local Patch Download Directory</div></dd>
      <dt>Remote Staging</dt><dd><code>{{ patch.remote_path or "-" }}</code></dd>
      <dt>Expected Reboot</dt><dd>{% if analysis.expected_reboot is none %}unknown{% elif analysis.expected_reboot %}<strong>YES EXPECTED</strong>{% else %}NO{% endif %}</dd>
      <dt>Packages to Update</dt><dd>{{ patch.packages }} ({{ patch.debs }} .deb file{{ "" if patch.debs == 1 else "s" }})</dd>
      <dt>Download Size</dt><dd>{{ patch.download_bytes|filesize }}</dd>
    </dl>
    {% if patch.reasons %}
      <div class="alert alert-warning patch-blocked"><strong>Patching is not available for this report.</strong>
        <ul class="plain-list">{% for r in patch.reasons %}<li>{{ r }}</li>{% endfor %}</ul></div>
    {% endif %}
    {% if patch.unpatched_notes %}
      <details class="small"><summary>{{ patch.unpatched_notes|length }} finding(s) cannot be fixed by this patch</summary>
        <ul class="plain-list">{% for n in patch.unpatched_notes %}<li>{{ n }}</li>{% endfor %}</ul></details>
    {% endif %}
    <div class="form-actions">
      <form method="post" action="/analysis/{{ run.id }}/servers/{{ analysis.id }}/reject"
            data-confirm="Reject patching for {{ analysis.server_name }}? No action will be taken on the server.">
        <input type="hidden" name="confirm" value="yes">
        <button type="submit" class="btn btn-danger-outline">Reject</button>
      </form>
      {% if patch.allowed %}
        <a href="/analysis/{{ run.id }}/servers/{{ analysis.id }}/approve" class="btn btn-primary">Approve &amp; Patch</a>
      {% else %}
        <button type="button" class="btn btn-primary" disabled>Approve &amp; Patch</button>
      {% endif %}
    </div>
  {% endif %}
  {% endif %}
</div>

<div class="card">
  <h2>Summary</h2>
  <div class="summary-grid">
    <div class="summary-item"><span class="summary-value">{{ summary.reported }}</span><span class="summary-label">Reported CVEs</span></div>
    <div class="summary-item {% if summary.count('PATCH_AVAILABLE') %}summary-danger{% endif %}"><span class="summary-value">{{ summary.count("PATCH_AVAILABLE") }}</span><span class="summary-label">Patch available</span></div>
    <div class="summary-item"><span class="summary-value">{{ summary.count("ALREADY_FIXED") }}</span><span class="summary-label">Already fixed</span></div>
    <div class="summary-item"><span class="summary-value">{{ summary.count("NOT_AFFECTED") }}</span><span class="summary-label">Not affected</span></div>
    <div class="summary-item"><span class="summary-value">{{ summary.count("PACKAGE_NOT_INSTALLED") }}</span><span class="summary-label">Package not installed</span></div>
    <div class="summary-item {% if summary.count('FIX_NOT_IN_CONFIGURED_REPOS', 'PRO_OR_ESM_REQUIRED') %}summary-warning{% endif %}"><span class="summary-value">{{ summary.count("FIX_NOT_IN_CONFIGURED_REPOS", "PRO_OR_ESM_REQUIRED") }}</span><span class="summary-label">Published fix requires repository access</span></div>
    <div class="summary-item {% if summary.count('NO_FIX_PUBLISHED', 'PENDING_OR_DEFERRED') %}summary-warning{% endif %}"><span class="summary-value">{{ summary.count("NO_FIX_PUBLISHED", "PENDING_OR_DEFERRED") }}</span><span class="summary-label">No published fix / deferred</span></div>
    <div class="summary-item {% if summary.count('UNKNOWN', 'METADATA_UNAVAILABLE', 'ANALYSIS_ERROR', 'NOT_ANALYZED') %}summary-warning{% endif %}"><span class="summary-value">{{ summary.count("UNKNOWN", "METADATA_UNAVAILABLE", "ANALYSIS_ERROR", "NOT_ANALYZED") }}</span><span class="summary-label">Needs investigation / errors</span></div>
    <div class="summary-item"><span class="summary-value">{{ summary.packages }}</span><span class="summary-label">Binary packages to update</span></div>
    <div class="summary-item"><span class="summary-value">{{ summary.debs }}</span><span class="summary-label">.deb files required</span></div>
    <div class="summary-item"><span class="summary-value">{{ summary.download_bytes|filesize }}</span><span class="summary-label">Estimated download size</span></div>
    <div class="summary-item {% if analysis.expected_reboot %}summary-warning{% endif %}"><span class="summary-value">{% if analysis.expected_reboot is none %}?{% elif analysis.expected_reboot %}YES{% else %}NO{% endif %}</span><span class="summary-label">Expected reboot</span></div>
  </div>
  <p class="muted small severity-breakdown">Severity (NVD CVSS, per reported CVE):
    {% for sev in severities %}<span class="badge {{ severity_classes[sev] }}">{{ sev }}: {{ summary.by_severity[sev] }}</span>{% endfor %}
  </p>
  <p class="muted small bucket-summary">By action (per reported CVE):
    {% for key, title, n in summary.buckets %}<span class="badge {{ bucket_classes[key] if n else 'badge-neutral' }}">{{ title }}: {{ n }} CVE{{ "s" if n != 1 else "" }}</span>{% endfor %}
  </p>
  {% if summary.by_status %}
    <p class="muted small status-breakdown">By status:
      {% for status, count in summary.by_status|dictsort %}
        <span class="badge {{ status_classes.get(status, 'badge-neutral') }}">{{ status_labels.get(status, "Not analyzed" if status == "NOT_ANALYZED" else status) }}: {{ count }}</span>
      {% endfor %}
    </p>
  {% endif %}
  {% if summary.unresolved %}
    <div class="alert alert-warning">{{ summary.unresolved }} package(s) in the plan could not be resolved to an exact .deb file. See the package plan below.</div>
  {% endif %}
</div>

<div class="card">
  <h2>CVE Findings</h2>
  {% if analysis.findings %}
    <p class="bucket-counts">
      {% for b in finding_buckets %}<span class="badge {{ bucket_classes[b.key] if b.count else 'badge-neutral' }}">{{ b.title }}: {{ b.count }}</span>
        <span class="muted small">({{ b.cve_count }} CVE{{ "s" if b.cve_count != 1 else "" }})</span>{% endfor %}
    </p>
    {% for b in finding_buckets %}
      {% if b.key == "no_action" %}
        <details class="report-details bucket bucket-{{ b.key }}">
          <summary><strong>{{ b.title }}</strong> <span class="muted small">({{ b.count }})</span></summary>
          {{ findings_table(b.groups) }}
        </details>
      {% else %}
        <h3 class="bucket bucket-{{ b.key }}">{{ b.title }} <span class="muted small">({{ b.count }})</span></h3>
        {% if b.key == "investigate" and b.count and analysis.server_id and not run.is_running %}
          <form method="post" action="/analysis/{{ run.id }}/servers/{{ analysis.id }}/retry-investigate" class="inline-form">
            <button type="submit" class="btn btn-secondary btn-sm">Retry these CVEs ({{ b.cve_count }})</button>
          </form>
          <span class="muted small">Fetches these CVEs from Canonical again (bypassing the cache) and re-analyzes this server.</span>
        {% endif %}
        {{ findings_table(b.groups) }}
      {% endif %}
    {% endfor %}
  {% else %}
    <p class="muted">No findings{% if analysis.status == "failed" %} - the analysis of this server failed before CVEs could be evaluated. Reported CVEs: {{ analysis.reported_cves|join(", ") }}{% elif analysis.status == "unsupported" %} - this operating system is not supported yet, so CVEs were not evaluated. Reported CVEs: {{ analysis.reported_cves|join(", ") }}{% endif %}.</p>
  {% endif %}
</div>

<div class="card">
  <h2>Package / .deb Plan</h2>
  {% if analysis.plan %}
    <p class="muted small">Planned only &mdash; nothing has been downloaded. Target versions are the current APT candidates of the Ubuntu archive for this server's release and architecture, resolved on this workstation.</p>
    <div class="table-scroll">
    <table class="table plan-table">
      <thead><tr><th>Binary Package</th><th>Current Version</th><th>Target Version</th><th>.deb Filename</th><th class="num">Size</th><th>Related CVEs</th><th>Reboot Impact</th></tr></thead>
      <tbody>
        {% for p in analysis.plan %}
          <tr class="{% if p.status != 'planned' %}row-warning{% endif %}">
            <td><strong>{{ p.binary_package }}</strong> <span class="muted small">{{ p.architecture }}</span>
                {% if p.is_dependency %}<div class="muted small">dependency{% if p.current_version is none %} (new package){% endif %}</div>{% endif %}</td>
            <td><code>{{ p.current_version or "not installed" }}</code></td>
            <td><code>{{ p.target_version }}</code></td>
            <td>{% if p.deb_filename %}<code>{{ p.deb_filename }}</code>{% else %}<span class="text-danger">Unable to resolve package download plan</span><div class="muted small">{{ p.reason }}</div>{% endif %}</td>
            <td class="num">{{ p.size|filesize }}</td>
            <td class="cve-list">{% for c in p.cves %}<code>{{ c }}</code>{% else %}<span class="muted small">required dependency</span>{% endfor %}</td>
            <td>{{ p.reboot_impact or "No reboot expected" }}</td>
          </tr>
        {% endfor %}
      </tbody>
    </table>
    </div>
  {% elif patching_unsupported %}
    <p class="muted">Package planning is not supported yet for this operating system.</p>
  {% else %}
    <p class="muted">No package updates are planned for this server{% if patch.not_checked_warning %} for the CVEs that were checked{% endif %}.</p>
    {% if patch.not_checked_warning %}<div class="alert alert-warning">{{ patch.not_checked_warning }}</div>{% endif %}
  {% endif %}
</div>

{% if analysis.plan or analysis.apt_arguments %}
<div class="card">
  <details class="report-details">
    <summary><strong>Technical details</strong> <span class="muted small">(download URIs, checksums, APT invocation)</span></summary>
    {% if analysis.apt_arguments %}
      <p class="small">APT invocation used for planning on the workstation (simulation / <code>--print-uris</code> only, against the private APT state):</p>
      <pre>apt-get {{ analysis.apt_arguments|join(" ") }}</pre>
    {% endif %}
    <div class="table-scroll">
    <table class="table small">
      <thead><tr><th>.deb</th><th>Source Package</th><th>URI</th><th>Checksum</th></tr></thead>
      <tbody>
        {% for p in analysis.plan %}
          <tr>
            <td><code>{{ p.deb_filename or p.binary_package }}</code></td>
            <td>{{ p.source_package or "-" }}</td>
            <td class="wrap">{% if p.uri %}<code>{{ p.uri }}</code>{% else %}-{% endif %}</td>
            <td class="wrap">{% if p.checksum %}<code>{{ p.checksum }}</code>{% else %}-{% endif %}</td>
          </tr>
        {% endfor %}
      </tbody>
    </table>
    </div>
    {% if analysis.expected_reboot_reason %}<p class="small">Expected reboot: {{ analysis.expected_reboot_reason }}</p>{% endif %}
  </details>
</div>
{% endif %}
{% endblock %}