"""
Cache for the built-in app→CVE scanner: (product_key, version) → CVE list.
Keeps OSV / NVD-CPE lookups bounded (same software version across many hosts
= one query) and under NVD's rate limit. Refreshed on a TTL.
"""
from sqlalchemy import Column, Integer, String, Text, DateTime, func

from app.models.base import Base


class AppCveCache(Base):
    __tablename__ = "app_cve_cache"

    id = Column(Integer, primary_key=True, index=True)
    product_key = Column(String(160), nullable=False, index=True)  # cpe:a:vendor:product | osv:eco:name
    version = Column(String(120), nullable=False)
    cves = Column(Text, nullable=True)  # JSON [{cve, cvss, severity, fixed}]
    fetched_at = Column(DateTime, nullable=False, server_default=func.now())
