"""Chromium severity from prose — run: python tests/test_chromium_severity.py

Chrome CVE records carry no metrics block at all. Google states the severity
in the description instead: "… (Chromium security severity: Critical)". Losing
it means every fresh Chrome CVE sits at the neutral 'medium' placeholder, so a
Critical sandbox escape sorts level with a Low UI glitch — in the queue and in
the digest mail.
"""
import os
import sys

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from app.services.cvelistv5_scan_service import _cvss_from_record


def _rec(desc, metrics=None):
    cna = {"descriptions": [{"lang": "en", "value": desc}]}
    if metrics:
        cna["metrics"] = metrics
    return {"containers": {"cna": cna}}


def demo():
    # Verbatim description from CVE-2026-17650.
    crit = _rec("Use after free in Compositing in Google Chrome prior to "
                "151.0.7922.72 allowed a remote attacker who had compromised "
                "the renderer process to potentially perform a sandbox escape "
                "via a crafted HTML page. (Chromium security severity: Critical)")
    assert _cvss_from_record(crit) == (None, "critical")

    assert _cvss_from_record(_rec("... (Chromium security severity: High)"))[1] == "high"
    assert _cvss_from_record(_rec("... (Chromium security severity: Low)"))[1] == "low"

    # No such phrase → unchanged behaviour, no severity invented.
    assert _cvss_from_record(_rec("Some other product's flaw.")) == (None, None)

    # A real score always wins over the prose.
    scored = _rec("... (Chromium security severity: Low)",
                  metrics=[{"cvssV3_1": {"baseScore": 9.8, "baseSeverity": "CRITICAL"}}])
    assert _cvss_from_record(scored) == (9.8, "critical")

    print("chromium severity OK")


if __name__ == "__main__":
    demo()
