{# Extended SCA Reachability dashboard: coverage, a severity/reachability
   breakdown, an ecosystem breakdown, and a short "Top vulnerabilities"
   preview linking out to the full, project-filterable register at
   /activities/sca-reachability/vulnerabilities
   (sca_vulnerabilities_list.html) -- each row backed by a real OSV.dev
   match when one exists, or the report's own "unverified" finding when it
   doesn't (never a fabricated CVE ID -- see web/sca_dashboard.py for
   what's real vs. approximated). #}

{% from "_macros.html" import info_tip %}

<span class="ds-overline u-d-block u-mt-8">Program dashboard</span>

{% if sca_dash.osv_unreachable %}
<div class="alert alert--warning u-mt-4">
  <div>OSV.dev was unreachable during the last enrichment pass -- some rows below may show as "not looked up" until the next successful pass.</div>
</div>
{% endif %}

<div class="stat-card-grid u-mt-4">
  <div class="stat-card has-info">
    {% call info_tip("Coverage") %}
    <p>Share of in-scope systems that have at least one successful SCA reachability review.</p>
    <p>In scope means every project that has an assessment.</p>
    {% endcall %}
    <span class="stat-card__value">{{ sca_dash.coverage_pct }}%</span>
    <span class="stat-card__label">Coverage — {{ sca_dash.coverage_reviewed }} / {{ sca_dash.coverage_in_scope }} in-scope systems</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Distinct vulnerabilities") %}
    <p>Unique package vulnerabilities across projects. The same package and CVE in two projects counts once.</p>
    <p>A finding with no real CVE stays separate unless the issue text actually matches another one. secfoo never invents a CVE id.</p>
    {% endcall %}
    <span class="stat-card__value">{{ sca_dash.vulnerabilities | length }}</span>
    <span class="stat-card__label">Distinct vulnerabilities across all projects</span>
  </div>
  <div class="stat-card has-info{% if sca_dash.reachability_counts.reachable %} stat-card--error u-border-t-error{% endif %}">
    {% call info_tip("Reachable") %}
    <p>Vulnerabilities a review marked <strong>reachable</strong>: the vulnerable code is on a path the application can actually hit.</p>
    <p>Not reachable and conditionally reachable are counted separately, on each vulnerability's row.</p>
    {% endcall %}
    <span class="stat-card__value{% if sca_dash.reachability_counts.reachable %} u-color-error{% endif %}">{{ sca_dash.reachability_counts.reachable }}</span>
    <span class="stat-card__label">Reachable</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Unrecognized ecosystem") %}
    <p>Findings whose package ecosystem OSV.dev does not recognize, so they could not be checked against a known advisory.</p>
    <p>They stay in the register as the report wrote them. They are not dropped.</p>
    {% endcall %}
    <span class="stat-card__value">{{ sca_dash.unmapped_ecosystem_count }}</span>
    <span class="stat-card__label">Findings with an ecosystem OSV.dev doesn't recognize</span>
  </div>
</div>

<div class="u-d-grid u-cols-1fr-1fr u-gap-6 u-mt-8">
  <div class="card has-info">
    {% call info_tip("Severity") %}
    <p>Counts from each finding's own Risk Register severity.</p>
    <p>This is the rating the review wrote. It is not translated from a CVSS score.</p>
    {% endcall %}
    <h4 class="card__title">Severity</h4>
    <p class="card__body u-mb-4">
      From each finding's own Risk Register severity -- never translated from a CVSS score.
    </p>
    {% set severity_total = sca_dash.severity_counts.high + sca_dash.severity_counts.medium + sca_dash.severity_counts.low %}
    <div class="donut-row u-mt-4">
      <div class="donut" data-donut-gradient="{{ sca_severity_gradient }}">
        <div class="donut__hole">{{ severity_total }}</div>
      </div>
      <div class="donut-legend">
        <span class="donut-legend__item"><span class="donut-legend__dot u-bg-error"></span>High ({{ sca_dash.severity_counts.high }})</span>
        <span class="donut-legend__item"><span class="donut-legend__dot u-bg-warning"></span>Medium ({{ sca_dash.severity_counts.medium }})</span>
        <span class="donut-legend__item"><span class="donut-legend__dot u-bg-teal-500"></span>Low ({{ sca_dash.severity_counts.low }})</span>
      </div>
    </div>
  </div>

  <div class="card has-info">
    {% call info_tip("Vulnerabilities by ecosystem") %}
    <p>How the vulnerabilities above split by package ecosystem, such as npm or PyPI.</p>
    <p>This is not a count of every dependency in every manifest. Only findings are included.</p>
    {% endcall %}
    <h4 class="card__title">Vulnerabilities by ecosystem</h4>
    <p class="card__body u-mb-4">
      A breakdown of the findings above, not of every dependency in every manifest.
    </p>
    {% if sca_dash.ecosystem_counts %}
    <div class="widget-scroll" data-scroll-rows="10">
    {% for ecosystem, count in sca_dash.ecosystem_counts %}
    <div class="severity-bar">
      <span class="severity-bar__dot severity-bar__dot--low"></span>
      <span class="severity-bar__label u-w-8rem">{{ ecosystem }}</span>
      <div class="severity-bar__track"><div class="severity-bar__fill severity-bar__fill--low" data-bar-width="{{ (count / sca_dash.ecosystem_counts[0][1] * 100) }}"></div></div>
      <span class="severity-bar__count">{{ count }}</span>
    </div>
    {% endfor %}
    </div>
    {% else %}
    <p class="ds-body u-color-text-muted">No vulnerabilities yet.</p>
    {% endif %}
  </div>
</div>

{% set top_vulnerabilities = sca_dash.vulnerabilities[:5] %}
<div class="u-d-flex u-justify-space-between u-items-flex-end u-flex-wrap u-gap-4 u-mt-10">
  <div>
    <h2 class="u-m-0 heading-with-info">Top vulnerabilities
      {% call info_tip("Top vulnerabilities", inline=True) %}
      <p>The five highest-severity vulnerabilities across projects.</p>
      <p>Reachability and a fixed version, when the report or OSV.dev has one, are on each row.</p>
      {% endcall %}
    </h2>
    <p class="ds-body u-color-text-muted u-mt-1">The highest-severity vulnerabilities across all projects.</p>
  </div>
  <a class="btn btn--outline btn--sm" href="/activities/{{ skill.id }}/vulnerabilities">View all vulnerabilities ({{ sca_dash.vulnerabilities | length }}) &rarr;</a>
</div>

{% if top_vulnerabilities %}
<div class="table-wrap u-mt-4">
  <table class="table">
    <thead>
      <tr>
        <th>Severity</th><th>CVE / Issue</th><th>Package</th><th>Version</th>
        <th>Reachability</th><th>Fixed in</th><th>Applications</th>
      </tr>
    </thead>
    <tbody>
      {% for v in top_vulnerabilities %}
      <tr class="run-row" data-href="/activities/{{ skill.id }}/vulnerabilities/{{ v.key }}" tabindex="0">
        <td><span class="badge {{ v.severity | severity_badge }}">{{ v.severity }}</span></td>
        <td>
          {% if v.cve_id %}{{ v.cve_id }}{% else %}<span class="badge badge--neutral">unverified</span> {{ v.issue }}{% endif %}
        </td>
        <td><code>{{ v.package }}</code></td>
        <td>{{ v.version }}</td>
        <td>{{ v.reachability }}</td>
        <td>{{ v.fixed_in }}</td>
        <td>{{ v.affected_projects | length }}</td>
      </tr>
      {% endfor %}
    </tbody>
  </table>
</div>
{% else %}
<div class="alert alert--info u-mt-4"><div>No vulnerabilities identified yet.</div></div>
{% endif %}

<div class="u-border-b-border u-mt-8"></div>