"""Is the running container actually on the current scanner code?

Copy-pasted one-liners kept failing on invisible characters picked up from
chat, so the checks live here instead. Run inside the backend container:

    docker compose exec backend python tools/diagnose_scan.py

Each line states what it expects, so the output is readable without looking
anything up. A failing line means the container is running older code — every
other symptom is downstream of that.
"""
import sys

sys.path.insert(0, "/app")

CHECKS = []


def check(name, expect):
    def deco(fn):
        CHECKS.append((name, expect, fn))
        return fn
    return deco


@check("Adobe add-on is ignored", "None")
def _adobe():
    from app.services.app_cve_scanner_service import resolve_product
    return resolve_product(
        "Asian Language And Spelling Dictionaries Support For Adobe Acrobat Reader")


@check("Teams build shapes are not compared", "[]")
def _teams():
    from app.services.msrc_scan_service import affected_cves
    return affected_cves([{"cve": "X", "build": "25060212643"}],
                         "26183.1903.4892.4448", branch_match=False)


@check("Node 24.13.1 IS affected by CVE-2026-56846", "True")
def _node():
    from app.services.cvelistv5_scan_service import _affected, _ranges_from_affected
    rg = _ranges_from_affected({
        "vendor": "nodejs", "product": "node", "defaultStatus": "unaffected",
        "versions": [{"version": "24.18.0", "lessThanOrEqual": "24.18.0",
                      "versionType": "semver", "status": "affected"}]})
    return any(_affected("24.13.1", s, lt, lte) for s, lt, lte in rg)


@check("Node 22.23.2 is NOT affected by it", "False")
def _node_other_line():
    from app.services.cvelistv5_scan_service import _affected, _ranges_from_affected
    rg = _ranges_from_affected({
        "vendor": "nodejs", "product": "node", "defaultStatus": "unaffected",
        "versions": [{"version": "24.18.0", "lessThanOrEqual": "24.18.0",
                      "versionType": "semver", "status": "affected"}]})
    return any(_affected("22.23.2", s, lt, lte) for s, lt, lte in rg)


@check("Browser-extension CPEs rejected on Windows", "False")
def _target_sw():
    from app.services.app_cve_scanner_service import _platform_ok
    return _platform_ok(["chrome"], "windows")


@check("cvelistV5 index key", "cvelistv5_product_index_v19")
def _index():
    from app.services.cvelistv5_scan_service import _INDEX_SETTING
    return _INDEX_SETTING


@check("NVD result cache prefix", "v3:")
def _cache():
    from app.services.app_cve_scanner_service import CACHE_PREFIX
    return CACHE_PREFIX


def main():
    bad = 0
    for name, expect, fn in CHECKS:
        try:
            got = fn()
        except Exception as e:
            got = f"ERROR: {e}"
        ok = str(got) == expect
        bad += 0 if ok else 1
        print(f"[{'ok ' if ok else 'BAD'}] {name}")
        print(f"      expected {expect!r}, got {got!r}")
    print()
    if bad:
        print(f"{bad} check(s) failed — this container is NOT running the current code.")
    else:
        print("All checks current. If findings still look wrong, the cause is "
              "elsewhere — send the scan log.")
    return 1 if bad else 0


if __name__ == "__main__":
    sys.exit(main())
