"""Exchange Server SE detection — run: python tests/test_exchange_se.py

A complete blind spot in Wazuh (wazuh/wazuh#36200). The data exists in both
sources; what makes it delicate is the inventory, which lists FIVE kinds of
"Exchange" row on one host and only one of them carries the real build:

  Microsoft Exchange Server Subscription Edition          15.2.2562.27  <- this
  Microsoft Exchange Server                               15.2.2562.17
  Microsoft Exchange Server Language Pack - German        15.2.2562.17
  Hotfix Update for … Subscription Edition (KB5066373)    1
  (…twelve more language packs)

The KB row is the dangerous one: its version is the literal "1", which
compares below every fix build ever published.
"""
import os
import sys

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from app.services.app_cve_scanner_service import resolve_product
from app.services import cvelistv5_scan_service as c5


def demo():
    # Only the product entry resolves — on either path.
    se = "Microsoft Exchange Server Subscription Edition"
    assert (resolve_product(se) or {}).get("key") == \
        "cpe:microsoft:exchange_server_subscription_edition"
    assert c5.resolve(se) == "exchange-se"

    for other in ("Microsoft Exchange Server",
                  "Microsoft Exchange Server Language Pack - German",
                  "Microsoft Exchange Server Language Pack - Chinese (Traditional)",
                  "Hotfix Update for Exchange Server Subscription Edition (KB5066373)"):
        assert resolve_product(other) is None, other
        assert c5.resolve(other) is None, other

    # cvelistV5 names the product with an RTM suffix.
    assert c5._pair_key(
        "Microsoft", "Microsoft Exchange Server Subscription Edition RTM") == "exchange-se"

    # CVE-2026-42897: affected below 15.02.2562.043. Wazuh writes the same
    # build without the leading zeros — comparing as numbers makes that a
    # non-issue, which is precisely where string matching fails.
    hit = lambda v: c5._affected(v, "15.02.0.0", "15.02.2562.043", None)
    assert hit("15.2.2562.27")     # tester's host, Sep25 hotfix
    assert hit("15.2.2562.17")     # RTM
    assert not hit("15.2.2562.43")  # the fix itself
    assert not hit("15.2.2562.45")  # Jul26SU, newer still

    print("exchange se OK")


if __name__ == "__main__":
    demo()
