{% extends "base.html" %}
{% from "_macros.html" import findings_badges, empty_state, info_tip %}
{% set verdict_projects = projects | selectattr("design_verdict") | list %}
{% block title %}{{ skill.nav_label }} — secfoo{% endblock %}
{% block content %}
{% from "_page.html" import page_head %}
{{ page_head(skill.id, "Activity", skill.name, skill.description) }}

{% if run_count == 0 %}
{% call empty_state("No " ~ skill.name ~ " runs yet", "/assessments", "Go to assessments", "u-mt-6") %}
  The figures below fill in after the first run. Start one from an
  assessment's <strong>Run Assessment</strong> page, or run
  <code>secfoo run --skill {{ skill.id }}</code>.
{% endcall %}
{% endif %}

{% if dash %}
{% include "activities/architecture_dashboard.html" %}
{% endif %}

{% if tm_dash %}
{% include "activities/threat_modeling_dashboard.html" %}
{% endif %}

{% if sca_dash %}
{% include "activities/sca_dashboard.html" %}
{% endif %}

{% if sast_dash %}
{% include "activities/sast_dashboard.html" %}
{% endif %}

{% if secret_dash %}
{% include "activities/secret_scanning_dashboard.html" %}
{% endif %}

{% if not tm_dash and not dash and not sca_dash and not sast_dash and not secret_dash %}
{# All three program dashboards above already cover coverage, findings,
   and trust-boundary counts with more specific tiles -- this generic block
   would just duplicate them. #}
<div class="stat-card-grid u-mt-8">
  <div class="stat-card has-info">
    {% call info_tip("Projects covered") %}
    <p>Projects with at least one run of this activity.</p>
    <p>A project with only a failed run is still listed. Coverage on the program dashboards counts successful reviews only.</p>
    {% endcall %}
    <span class="stat-card__value">{{ projects | length }}</span>
    <span class="stat-card__label">Projects covered</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Runs") %}
    <p>How many times this activity has been run, across those projects.</p>
    <p>Repeats count. This is not the number of projects.</p>
    {% endcall %}
    <span class="stat-card__value">{{ run_count }}</span>
    <span class="stat-card__label">Runs</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Total findings") %}
    <p>Finding counts written on this activity's runs, added together.</p>
    <p>Repeat runs count again, so this can be higher than the open findings you would fix today.</p>
    {% endcall %}
    <span class="stat-card__value">{{ severity.total }}</span>
    <span class="stat-card__label">Total findings</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Critical + High") %}
    <p>The critical and high counts from those same runs, added together.</p>
    <p>Medium, low, and info findings are in Total findings and not in this number.</p>
    {% endcall %}
    <span class="stat-card__value">{{ severity.critical + severity.high }}</span>
    <span class="stat-card__label">Critical + High</span>
  </div>
  {% if verdict_projects %}
  <div class="stat-card has-info">
    {% call info_tip("Projects not cleanly Sound") %}
    <p>Projects whose latest design verdict is anything other than <strong>Sound</strong>.</p>
    <p>The first number is those projects. The second is every project that has a verdict.</p>
    {% endcall %}
    <span class="stat-card__value">{{ verdict_projects | rejectattr("verdict_label", "equalto", "Sound") | list | length }}/{{ verdict_projects | length }}</span>
    <span class="stat-card__label">Projects not cleanly Sound</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Trust boundaries identified") %}
    <p>Trust boundaries called out in the latest review of each project, added together.</p>
    <p>A boundary is a place data crosses from one trust level to another, such as from the internet into an API.</p>
    {% endcall %}
    <span class="stat-card__value">{{ projects | sum(attribute="boundary_count") }}</span>
    <span class="stat-card__label">Trust boundaries identified</span>
  </div>
  {% endif %}
</div>
{% endif %}

{% if recent_verdicts %}
<div class="card u-mt-8 has-info">
  {% call info_tip("Design verdicts") %}
  <p>The design verdict from each project's latest successful review, and the reason the report gave.</p>
  <p>Open a row to read the full review. Only the latest verdict per project is shown.</p>
  {% endcall %}
  <div class="u-d-flex u-justify-space-between u-items-baseline u-gap-3 u-flex-wrap">
    <h4 class="card__title u-m-0">Design verdicts</h4>
    <span class="ds-caption u-color-text-muted">
      {% if verdict_count > recent_verdicts | length %}Latest {{ recent_verdicts | length }} of {{ verdict_count }} projects{% else %}Latest review per project{% endif %}
    </span>
  </div>
  <div class="table-wrap widget-scroll u-mt-4" data-scroll-rows="10">
    <table class="table verdict-table">
      <thead>
        <tr><th>Project</th><th>Verdict</th><th>Why</th><th>Reviewed</th></tr>
      </thead>
      <tbody>
        {% for p in recent_verdicts %}
        <tr class="run-row" data-href="/runs/{{ p.latest_success_run_uuid }}" tabindex="0">
          <td class="u-ws-nowrap">{{ p.project_display_name }}</td>
          <td class="u-ws-nowrap"><span class="badge {{ p.design_verdict | design_verdict_badge }}">{{ p.verdict_label }}</span></td>
          <td><span class="verdict-reason u-color-text-muted" title="{{ p.design_verdict }}">{{ p.verdict_reason or "—" }}</span></td>
          <td class="u-ws-nowrap u-color-text-muted">{{ (p.latest_success_at or "")[:10] or "—" }}</td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
  </div>
</div>
{% endif %}

{% if not dash and not sca_dash and not sast_dash and not secret_dash %}
{# Security Architecture Review's and SCA's own program dashboards above
   already have their own severity/disposition breakdowns -- a raw
   severity-count bar here would just be a second, less specific cut of
   the same findings. #}
<div class="card u-mt-8 has-info">
  {% call info_tip("Findings by severity") %}
  <p>Severity counts written on this activity's runs.</p>
  <p>Repeat runs count again. A project scanned twice contributes both scans.</p>
  {% endcall %}
  <h4 class="card__title">Findings by severity</h4>
  {% for row in severity_rows %}
  <div class="severity-bar">
    <span class="severity-bar__dot severity-bar__dot--{{ row.key }}"></span>
    <span class="severity-bar__label">{{ row.label }}</span>
    <div class="severity-bar__track"><div class="severity-bar__fill severity-bar__fill--{{ row.key }}" data-bar-width="{{ row.percent }}"></div></div>
    <span class="severity-bar__count">{{ row.count }}</span>
  </div>
  {% endfor %}
</div>
{% endif %}

{% if diagrams_available and skill.id != "threat-modeling" %}
<h2 class="u-mt-12">Architecture diagram</h2>
<p class="ds-body u-color-text-muted u-max-w-44rem">
  Data flow diagram from the selected project's most recent successful review.
</p>
{% if diagram_projects | length > 1 %}
<form method="get" action="/activities/{{ skill.id }}" class="u-mt-4 u-max-w-20rem">
  <select class="select" name="diagram_project" data-autosubmit>
    {% for p in diagram_projects %}
    <option value="{{ p.project_id }}" {% if selected_diagram_project and p.project_id == selected_diagram_project.project_id %}selected{% endif %}>{{ p.project_display_name }}</option>
    {% endfor %}
  </select>
</form>
{% endif %}
{% if selected_diagram_project %}
<a href="/runs/{{ selected_diagram_project.latest_run_uuid }}" class="card u-decoration-none u-color-inherit u-d-block u-mt-6 u-max-w-48rem">
  <span class="card__eyebrow">{{ selected_diagram_project.project_display_name }}</span>
  {% if selected_diagram_project.design_verdict %}
  <div class="verdict-summary u-mb-3">
    <span class="badge {{ selected_diagram_project.design_verdict | design_verdict_badge }}">{{ selected_diagram_project.verdict_label }}</span>
    {% if selected_diagram_project.verdict_reason %}
    <p class="ds-body-sm u-color-text-muted u-m-0">{{ selected_diagram_project.verdict_reason }}</p>
    {% endif %}
  </div>
  {% endif %}
  {% if mermaid_available %}
  <div class="mermaid-figure u-m-0">
    <pre class="mermaid">{{ selected_diagram_project.diagram_source }}</pre>
  </div>
  {% else %}
  <pre class="u-m-0 u-font-caption u-font-mono u-color-text-muted u-ws-pre-wrap u-max-h-20rem u-overflow-auto">{{ selected_diagram_project.diagram_source }}</pre>
  {% endif %}
</a>
{% endif %}
{% if not mermaid_available %}
<div class="alert alert--info u-mt-4">
  <div>Showing raw diagram source. Run <code>secfoo vendor mermaid</code> to render these as pictures.</div>
</div>
{% endif %}
{% endif %}

<div class="u-d-flex u-justify-space-between u-items-baseline u-gap-3 u-flex-wrap u-mt-12">
  <h2 class="u-m-0" id="by-project">By project</h2>
  {% if by_project_total > by_project_rows | length %}
  <span class="ds-caption u-color-text-muted">Latest {{ by_project_rows | length }} of {{ by_project_total }}</span>
  {% endif %}
</div>
{% if by_project_rows %}
<div class="table-wrap widget-scroll" data-scroll-rows="10">
  <table class="table">
    <thead>
      <tr>
        <th>Project</th><th>Runs</th><th>Latest</th><th>Status</th>
        {% if verdict_projects %}<th>Boundaries</th>{% endif %}
        <th>Findings</th><th></th>
        {% if review_states is not none %}<th>Review status</th>{% endif %}
      </tr>
    </thead>
    <tbody>
      {% for p in by_project_rows %}
      <tr class="run-row" data-href="/runs/{{ p.latest_run_uuid }}" tabindex="0">
        <td>
          {{ p.project_display_name }}
          <br><span class="ds-caption">{{ p.project_kind }}</span>
        </td>
        <td>{{ p.run_count }}</td>
        <td>{{ p.latest_started_at | fmt_time }}</td>
        <td><span class="badge {{ p.latest_status | status_badge }}">{{ p.latest_status }}</span></td>
        {% if verdict_projects %}<td>{{ p.boundary_count or "-" }}</td>{% endif %}
        <td><div class="findings-cell">{{ findings_badges(p) }}</div></td>
        <td>
          {% if p.latest_assessment_id %}
          <a class="btn btn--ghost btn--sm" href="/assessments/{{ p.latest_assessment_id }}">Assessment</a>
          {% endif %}
        </td>
        {% if review_states is not none %}
        {% set rs = review_states.get(p.project_id) %}
        <td class="u-ws-nowrap">
          {% if not p.latest_success_run_uuid %}<span class="badge badge--error">No successful review</span>
          {% elif rs and rs.state == "boundary_changed" %}<span class="badge badge--warning">Trust boundary changed</span>
          {% elif rs and rs.state == "stale" %}<span class="badge badge--warning">Stale ({{ rs.days_since_review }}d)</span>
          {% else %}<span class="badge badge--success">Current</span>{% endif %}
        </td>
        {% endif %}
      </tr>
      {% endfor %}
    </tbody>
  </table>
</div>
{% else %}
<div class="alert alert--info">
  <div>
    No project has been scanned with this activity yet. Start one from an
    assessment's <strong>Run Assessment</strong> page, or run
    <code>secfoo run --skill {{ skill.id }}</code>.
  </div>
</div>
{% endif %}

{% if diagrams_available and skill.id != "threat-modeling" and mermaid_available %}
{# Same loader as run_detail.html -- see that template for why it's
   vendored locally (works offline) and loaded as a classic script rather
   than an ES module import (the bundle is an IIFE that assigns
   globalThis.mermaid, not an ES module). The init/run call itself lives
   in the external mermaid-init.js file below, not inline here -- the
   portal's CSP (default-src 'self', no 'unsafe-inline') silently blocks
   inline JS, so it never actually ran there even though the library
   file loaded fine. #}
<script src="/static/vendor/mermaid.min.js"></script>
<script src="/static/js/mermaid-init.js"></script>
{% endif %}
{% endblock %}