"""Scoring without a CVSS — run: python tests/test_severity_floor.py

Both scores multiply the CVSS in, so a CVE the vendor never scored came out at
zero and sorted below a medium that happened to have one. Chrome is the common
case: Google states "Chromium security severity: Critical" in prose and NVD
frequently never scores those records at all.

The band's FLOOR is used as the stand-in, so the estimate can only understate a
real score, never inflate one.
"""
import os
import sys

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from app.models.vulnerability import Vulnerability, VulnerabilitySeverity as S


def _v(sev, cvss):
    return Vulnerability(cve_id="CVE-X", severity=sev, cvss_score=cvss,
                         epss_score=0.002, epss_percentile=0.5,
                         kev_listed=False, euvd_listed=False)


def demo():
    crit_noscore = _v(S.critical, None)
    crit_scored = _v(S.critical, 9.8)
    med_scored = _v(S.medium, 5.0)

    # Used to be None / 0 — now scored, and below the real 9.8.
    assert crit_noscore.calculate_cpr_score() is not None
    assert crit_noscore.calculate_cpr_score() < crit_scored.calculate_cpr_score()
    # The whole point: an unscored critical outranks a scored medium.
    assert crit_noscore.calculate_cpr_score() > med_scored.calculate_cpr_score()
    assert (crit_noscore.calculate_priority_breakdown()["total"]
            > med_scored.calculate_priority_breakdown()["total"])

    # Each band lands on its floor, never above it.
    for sev, floor in ((S.critical, 9.0), (S.high, 7.0), (S.medium, 4.0), (S.low, 0.1)):
        assert _v(sev, None)._severity_floor() == floor

    # A real score always wins over the estimate.
    assert _v(S.critical, 9.8).calculate_cpr_score() == \
        _v(S.low, 9.8).calculate_cpr_score()

    print("severity floor OK")


if __name__ == "__main__":
    demo()
