# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
"""Pytest conftest for generate-cve-json.

The Python tool loads all project-specific values from a TOML config
the adopting project ships at:

  <adopter-tracker>/.apache-magpie-overrides/tools/cve-tool-vulnogram/cve-json-config.toml

The tool reads that config relative to ``cwd`` (or via the
``CVE_JSON_CONFIG`` environment variable / the ``--config`` CLI flag).

For the framework's own pytest suite (run from this repository, no
adopter present), we point ``CVE_JSON_CONFIG`` at the test fixture at
``tests/fixtures/cve-json-config.toml``. The fixture mirrors one
adopter's configuration so the existing tests keep their assertions;
**it is not the framework's default configuration** — adopters write
their own per the schema in the package README.
"""

from __future__ import annotations

import os
from pathlib import Path

_FIXTURE_CONFIG = Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml"
assert _FIXTURE_CONFIG.exists(), f"missing test fixture: {_FIXTURE_CONFIG}"
os.environ.setdefault("CVE_JSON_CONFIG", str(_FIXTURE_CONFIG))

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
"""Tests for the CLI surface and `gh`-shelling-out helpers.

These cover the parts of `generate_cve_json.cve_json` that don't have
existing unit tests in `test_generate_cve_json.py`:

- `parse_args` (CLI argument shape);
- `main` (orchestration, all error paths, --stdin / --output / --attach
  / --no-envelope flags);
- `fetch_issue`, `_gh_api_json`, `_fetch_issue` (gh subprocess wrappers
  with mocked `subprocess.run`);
- `_splice_attachment_into_body` (in-place attachment splicing);
- `attach_to_issue` (idempotent attachment with mocked gh).
"""

from __future__ import annotations

import io
import json
import subprocess
from pathlib import Path
from unittest.mock import MagicMock, patch

import pytest

from generate_cve_json import cve_json


def _issue_body(
    *,
    summary: str = "An RCE in the FooOperator.",
    affected: str = ">= 3.0.0, < 3.1.0",
    cwe: str = "CWE-352",
    severity: str = "high",
    credited: str = "Alice <alice@example.com>",
    cve_tool: str = "CVE-2026-12345",
    extra: dict[str, str] | None = None,
) -> str:
    """Build a minimal issue body with the standard tracker fields."""
    fields = {
        "Short public summary for publish": summary,
        "Affected versions": affected,
        "Security mailing list thread": "https://lists.example.org/thread.html/abc",
        "Public advisory URL": "",
        "Reporter credited as": credited,
        "PR with the fix": "https://github.com/upstream/repo/pull/4242",
        "Remediation developer": "",
        "CWE": cwe,
        "Severity": severity,
        "CVE tool link": cve_tool,
    }
    if extra:
        fields.update(extra)
    return "\n".join(f"### {k}\n{v}\n" for k, v in fields.items())


# --- parse_args ------------------------------------------------------------


class TestParseArgs:
    def test_minimal_positional(self):
        args = cve_json.parse_args(["123"])
        assert args.issue == "123"
        assert args.stdin is False
        assert args.attach is False
        assert args.no_envelope is False
        assert args.advisory_url == []
        assert args.remediation_developer == []
        assert args.product_for == []
        assert args.config is None

    def test_stdin_no_positional(self):
        args = cve_json.parse_args(["--stdin"])
        assert args.issue is None
        assert args.stdin is True

    def test_repeatable_flags_accumulate(self):
        args = cve_json.parse_args(
            [
                "123",
                "--advisory-url",
                "https://a.example/1",
                "--advisory-url",
                "https://a.example/2",
                "--remediation-developer",
                "Carol",
                "--product-for",
                "pkg-a=Display A",
                "--product-for",
                "pkg-b=Display B",
            ]
        )
        assert args.advisory_url == ["https://a.example/1", "https://a.example/2"]
        assert args.remediation_developer == ["Carol"]
        assert args.product_for == ["pkg-a=Display A", "pkg-b=Display B"]

    def test_overrides(self, tmp_path):
        cfg = tmp_path / "c.toml"
        args = cve_json.parse_args(
            [
                "42",
                "--config",
                str(cfg),
                "--repo",
                "owner/repo",
                "--cve-id",
                "CVE-2099-0001",
                "--title",
                "Example Title",
                "--vendor",
                "Foo",
                "--product",
                "Bar",
                "--package-name",
                "bar-py",
                "--collection-url",
                "https://pypi.org/project/bar",
                "--org-id",
                "org-1",
                "--version-start",
                "1.0.0",
                "--discovery",
                "INTERNAL",
                "--no-envelope",
                "--attach",
                "--output",
                str(tmp_path / "out.json"),
            ]
        )
        assert args.config == cfg
        assert args.repo == "owner/repo"
        assert args.cve_id == "CVE-2099-0001"
        assert args.no_envelope is True
        assert args.attach is True
        assert args.output == tmp_path / "out.json"


# --- _splice_attachment_into_body -----------------------------------------


class TestSpliceAttachment:
    cve_id = "CVE-2026-99999"

    def _markers(self):
        return (
            cve_json._attachment_marker_begin(self.cve_id),
            cve_json._attachment_marker_end(self.cve_id),
        )

    def _attachment(self):
        begin, end = self._markers()
        return f"{begin}\n## CVE JSON\n```json\n{{}}\n```\n{end}\n"

    def test_replaces_existing_attachment_block(self):
        begin, end = self._markers()
        body = f"### Body before\nstuff\n\n{begin}\nOLD CONTENT\n{end}\ntrailing line\n"
        result = cve_json._splice_attachment_into_body(body, self._attachment(), self.cve_id)
        assert "OLD CONTENT" not in result
        assert "## CVE JSON" in result
        # Markers are present and bracket the new content.
        assert begin in result
        assert end in result

    def test_legacy_single_marker_path(self):
        begin, _ = self._markers()
        body = f"### Body\n\n{begin}\nleftover legacy content with no end marker\n"
        result = cve_json._splice_attachment_into_body(body, self._attachment(), self.cve_id)
        assert "leftover legacy content" not in result
        assert "## CVE JSON" in result

    def test_appends_after_cve_tool_link_when_no_existing_attachment(self):
        body = _issue_body()
        result = cve_json._splice_attachment_into_body(body, self._attachment(), self.cve_id)
        assert "## CVE JSON" in result
        # The attachment lands after the CVE-tool-link section.
        cve_tool_idx = result.index("### CVE tool link")
        attach_idx = result.index("## CVE JSON")
        assert attach_idx > cve_tool_idx

    def test_appends_at_end_when_no_cve_tool_link_field(self):
        body = "### Body\nstuff\n"
        result = cve_json._splice_attachment_into_body(body, self._attachment(), self.cve_id)
        assert result.endswith(self._markers()[1] + "\n")


# --- fetch_issue (gh subprocess wrapper) ----------------------------------


class TestFetchIssue:
    def test_returns_title_body_and_labels(self):
        completed = MagicMock(
            stdout=json.dumps(
                {
                    "title": "T",
                    "body": "B",
                    "labels": [
                        {"name": "rc voting"},
                        {"name": "airflow"},
                    ],
                }
            )
        )
        with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed) as run:
            title, body, labels = cve_json.fetch_issue(42, "owner/repo")
        assert (title, body) == ("T", "B")
        assert labels == ["rc voting", "airflow"]
        # Verify the gh call shape.
        cmd = run.call_args.args[0]
        assert cmd[:3] == ["gh", "issue", "view"]
        assert "--repo" in cmd
        assert "owner/repo" in cmd
        # Verify we ask gh for labels in addition to title and body.
        json_arg_index = cmd.index("--json")
        assert "labels" in cmd[json_arg_index + 1]

    def test_returns_empty_labels_when_field_missing(self):
        # gh returns no `labels` key when the issue has no labels — we
        # default to an empty list rather than blowing up.
        completed = MagicMock(stdout=json.dumps({"title": "T", "body": "B"}))
        with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed):
            title, body, labels = cve_json.fetch_issue(42, "owner/repo")
        assert (title, body, labels) == ("T", "B", [])

    def test_gh_missing_raises_runtime_error(self):
        with patch(
            "generate_cve_json.cve_json.subprocess.run",
            side_effect=FileNotFoundError,
        ):
            with pytest.raises(RuntimeError, match="`gh` CLI not found"):
                cve_json.fetch_issue(1, "o/r")

    def test_gh_failure_raises_runtime_error(self):
        err = subprocess.CalledProcessError(returncode=1, cmd=["gh"], stderr="not found")
        with patch("generate_cve_json.cve_json.subprocess.run", side_effect=err):
            with pytest.raises(RuntimeError, match="not found"):
                cve_json.fetch_issue(1, "o/r")


# --- _gh_api_json ----------------------------------------------------------


class TestGhApiJson:
    def test_returns_parsed_json(self):
        completed = MagicMock(stdout='{"id": 7}')
        with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed) as run:
            result = cve_json._gh_api_json(["repos/o/r/issues/1"])
        assert result == {"id": 7}
        cmd = run.call_args.args[0]
        assert cmd[:2] == ["gh", "api"]
        assert cmd[2] == "repos/o/r/issues/1"

    def test_returns_empty_dict_on_empty_stdout(self):
        completed = MagicMock(stdout="   \n")
        with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed):
            assert cve_json._gh_api_json(["repos/o/r"]) == {}

    def test_writes_body_payload_to_temp_file_and_uses_input_flag(self, tmp_path):
        completed = MagicMock(stdout="{}")
        captured_args: dict = {}

        def fake_run(cmd, **_kw):
            captured_args["cmd"] = cmd
            # Read back the temp file we wrote, prove it has our payload.
            input_idx = cmd.index("--input")
            captured_args["payload"] = json.loads(Path(cmd[input_idx + 1]).read_text())
            return completed

        with patch("generate_cve_json.cve_json.subprocess.run", side_effect=fake_run):
            cve_json._gh_api_json(
                ["-X", "PATCH", "repos/o/r/issues/1"],
                body_payload={"body": "new"},
            )
        assert captured_args["payload"] == {"body": "new"}
        assert "--input" in captured_args["cmd"]

    def test_gh_missing_raises_runtime_error(self):
        with patch(
            "generate_cve_json.cve_json.subprocess.run",
            side_effect=FileNotFoundError,
        ):
            with pytest.raises(RuntimeError, match="`gh` CLI not found"):
                cve_json._gh_api_json(["x"])

    def test_gh_failure_raises_runtime_error(self):
        err = subprocess.CalledProcessError(returncode=22, cmd=["gh"], stderr="rate limited\n")
        with patch("generate_cve_json.cve_json.subprocess.run", side_effect=err):
            with pytest.raises(RuntimeError, match="rate limited"):
                cve_json._gh_api_json(["x"])


# --- _fetch_issue (REST wrapper) ------------------------------------------


class TestFetchIssueRest:
    def test_returns_dict(self):
        with patch(
            "generate_cve_json.cve_json._gh_api_json",
            return_value={"body": "x", "html_url": "u"},
        ):
            assert cve_json._fetch_issue("o/r", "42") == {
                "body": "x",
                "html_url": "u",
            }

    def test_raises_when_response_not_a_dict(self):
        with patch("generate_cve_json.cve_json._gh_api_json", return_value=[]):
            with pytest.raises(RuntimeError, match="Unexpected response shape"):
                cve_json._fetch_issue("o/r", "42")


# --- attach_to_issue -------------------------------------------------------


def _attach_kwargs() -> dict:
    """Common keyword arguments for `attach_to_issue` calls in this module."""
    return {
        "issue_number": "42",
        "repo": "o/r",
        "cve_id": "CVE-2026-12345",
        "json_text": '{"a": 1}',
        "cna": {"title": "T"},
        "cna_private_state": "DRAFT",
    }


class TestAttachToIssue:
    def test_appends_attachment_when_body_has_no_existing_marker(self):
        with (
            patch(
                "generate_cve_json.cve_json._fetch_issue",
                return_value={"body": _issue_body(), "html_url": "https://x/42"},
            ),
            patch("generate_cve_json.cve_json._gh_api_json", return_value={}) as patch_call,
        ):
            url, was_update = cve_json.attach_to_issue(**_attach_kwargs())
        assert was_update is False
        assert url.endswith("#cve-json--paste-ready-for-cve-2026-12345")
        # PATCH was called with a body that contains the begin marker.
        body_payload = patch_call.call_args.kwargs["body_payload"]["body"]
        assert cve_json._attachment_marker_begin("CVE-2026-12345") in body_payload

    def test_replaces_existing_attachment_idempotently(self):
        cve_id = "CVE-2026-12345"
        begin = cve_json._attachment_marker_begin(cve_id)
        end = cve_json._attachment_marker_end(cve_id)
        body_with_existing = _issue_body() + f"\n{begin}\nstale content\n{end}\n"
        with (
            patch(
                "generate_cve_json.cve_json._fetch_issue",
                return_value={"body": body_with_existing, "html_url": "https://x/42"},
            ),
            patch("generate_cve_json.cve_json._gh_api_json", return_value={}),
        ):
            url, was_update = cve_json.attach_to_issue(**_attach_kwargs())
        assert was_update is True
        assert url.endswith("#cve-json--paste-ready-for-cve-2026-12345")

    def test_skips_patch_when_body_unchanged(self):
        # Pre-build the attachment that _splice would produce, so the
        # spliced result is byte-identical to the existing body.
        cve_id = "CVE-2026-12345"
        attachment = cve_json._build_attachment_body(
            cve_id=cve_id,
            json_text='{"a": 1}',
            cna={"title": "T"},
            cna_private_state="DRAFT",
        )
        existing = cve_json._splice_attachment_into_body(_issue_body(), attachment, cve_id)
        with (
            patch(
                "generate_cve_json.cve_json._fetch_issue",
                return_value={"body": existing, "html_url": "https://x/42"},
            ),
            patch("generate_cve_json.cve_json._gh_api_json") as patch_call,
        ):
            url, was_update = cve_json.attach_to_issue(**_attach_kwargs())
        assert was_update is True  # had_existing was True
        patch_call.assert_not_called()
        assert url == "https://x/42"


# --- main: error paths -----------------------------------------------------


class TestMainErrors:
    def test_attach_with_stdin_returns_2(self, capsys):
        rc = cve_json.main(["--stdin", "--attach"])
        assert rc == 2
        assert "--attach cannot be combined with --stdin" in capsys.readouterr().err

    def test_attach_without_issue_returns_2(self, capsys):
        rc = cve_json.main(["--attach"])
        assert rc == 2
        assert "--attach requires the positional issue argument" in capsys.readouterr().err

    def test_missing_issue_without_stdin_returns_2(self, capsys):
        rc = cve_json.main([])
        assert rc == 2
        assert "issue number is required unless --stdin" in capsys.readouterr().err

    def test_fetch_issue_failure_returns_1(self, capsys):
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            side_effect=RuntimeError("gh boom"),
        ):
            rc = cve_json.main(["123"])
        assert rc == 1
        assert "gh boom" in capsys.readouterr().err

    def test_product_for_without_equals_returns_2(self, capsys, monkeypatch):
        monkeypatch.setattr("sys.stdin", io.StringIO(_issue_body()))
        rc = cve_json.main(["--stdin", "--product-for", "no-equals-sign"])
        assert rc == 2
        assert "PACKAGE=PRODUCT" in capsys.readouterr().err

    def test_product_for_with_empty_value_returns_2(self, capsys, monkeypatch):
        monkeypatch.setattr("sys.stdin", io.StringIO(_issue_body()))
        rc = cve_json.main(["--stdin", "--product-for", "pkg="])
        assert rc == 2
        assert "non-empty PACKAGE and PRODUCT" in capsys.readouterr().err

    def test_config_not_found_returns_2(self, tmp_path, capsys):
        rc = cve_json.main(["--stdin", "--config", str(tmp_path / "nope.toml")])
        assert rc == 2
        assert "error:" in capsys.readouterr().err

    def test_unparsable_affected_versions_returns_2(self, capsys, monkeypatch):
        # parse_affected_versions now raises ValueError on un-parseable
        # input rather than emitting a malformed `version` string. main
        # catches that and exits 2 with a clean error message — no
        # traceback shown to the user.
        body = _issue_body(affected=">= 3.0.0 (reporter verified against 3.2.1)")
        monkeypatch.setattr("sys.stdin", io.StringIO(body))
        rc = cve_json.main(["--stdin"])
        assert rc == 2
        captured = capsys.readouterr()
        assert "Could not parse" in captured.err
        assert "Affected versions" in captured.err


# --- main: happy paths -----------------------------------------------------


class TestMainHappyPath:
    def test_stdin_writes_full_envelope_to_stdout(self, monkeypatch, capsys):
        monkeypatch.setattr("sys.stdin", io.StringIO(_issue_body()))
        rc = cve_json.main(["--stdin"])
        assert rc == 0
        out = capsys.readouterr().out
        record = json.loads(out)
        # Full CVE 5.x record envelope: cveMetadata + containers.
        assert "cveMetadata" in record
        assert "containers" in record
        assert record["cveMetadata"]["cveId"] == "CVE-2026-12345"

    def test_stdin_no_envelope_emits_cna_only(self, monkeypatch, capsys):
        monkeypatch.setattr("sys.stdin", io.StringIO(_issue_body()))
        rc = cve_json.main(["--stdin", "--no-envelope"])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        # Bare CNA container — no top-level cveMetadata.
        assert "cveMetadata" not in record
        assert "title" in record
        assert "affected" in record

    def test_output_to_file(self, monkeypatch, tmp_path, capsys):
        monkeypatch.setattr("sys.stdin", io.StringIO(_issue_body()))
        out_file = tmp_path / "cve.json"
        rc = cve_json.main(["--stdin", "--output", str(out_file)])
        assert rc == 0
        # File written, not stdout.
        record = json.loads(out_file.read_text())
        assert "cveMetadata" in record
        # Friendly post-write print includes the byte count.
        assert "Wrote " in capsys.readouterr().out

    def test_fetch_path_uses_gh(self, capsys):
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), []),
        ) as fetch:
            rc = cve_json.main(["123"])
        assert rc == 0
        fetch.assert_called_once()
        record = json.loads(capsys.readouterr().out)
        assert record["cveMetadata"]["cveId"] == "CVE-2026-12345"

    def test_attach_happy_path(self, capsys):
        with (
            patch(
                "generate_cve_json.cve_json.fetch_issue",
                return_value=("Issue title", _issue_body(), []),
            ),
            patch(
                "generate_cve_json.cve_json.attach_to_issue",
                return_value=("https://x/42#cve-json--paste-ready-for-cve-2026-12345", False),
            ) as attach,
        ):
            rc = cve_json.main(["123", "--attach"])
        assert rc == 0
        attach.assert_called_once()
        out = capsys.readouterr().out
        assert "Embedded CVE JSON" in out

    def test_attach_replace_path(self, capsys):
        with (
            patch(
                "generate_cve_json.cve_json.fetch_issue",
                return_value=("Issue title", _issue_body(), []),
            ),
            patch(
                "generate_cve_json.cve_json.attach_to_issue",
                return_value=("https://x/42#anchor", True),
            ),
        ):
            rc = cve_json.main(["123", "--attach"])
        assert rc == 0
        assert "Replaced CVE JSON" in capsys.readouterr().out

    def test_attach_failure_returns_1(self, capsys):
        with (
            patch(
                "generate_cve_json.cve_json.fetch_issue",
                return_value=("T", _issue_body(), []),
            ),
            patch(
                "generate_cve_json.cve_json.attach_to_issue",
                side_effect=RuntimeError("attach boom"),
            ),
        ):
            rc = cve_json.main(["123", "--attach"])
        assert rc == 1
        assert "attach boom" in capsys.readouterr().err


# --- main: release-vote gating --------------------------------------------


class TestReleaseVoteGating:
    """End-to-end coverage for the [workflow].release_vote_gating switch
    and the --review / --draft CLI overrides.

    The state machine has three modes:

      1. Gating off (default): fully-populated CNA ⇒ REVIEW. Legacy
         behaviour preserved for non-ASF adopters.
      2. Gating on, no label / no override: CNA stays at DRAFT.
      3. Gating on + rc-voting label *or* --review: CNA ⇒ REVIEW.

    The --review / --draft flags also work in gating-off mode (manual
    overrides remain available regardless of config).
    """

    @staticmethod
    def _write_gating_on_config(tmp_path, label: str = "rc voting") -> str:
        """Write a config that mirrors the fixture but with
        release_vote_gating = true. Returns its path as a string
        suitable for the --config CLI flag.
        """
        fixture = (Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml").read_text()
        # Flip the gating flag and (optionally) the label name.
        patched = fixture.replace(
            "release_vote_gating = false",
            "release_vote_gating = true",
        ).replace(
            'rc_voting_label = "rc voting"',
            f'rc_voting_label = "{label}"',
        )
        cfg_path = tmp_path / "cve-json-config-gating-on.toml"
        cfg_path.write_text(patched)
        return str(cfg_path)

    def test_default_gating_off_emits_review(self, capsys):
        # Default config has release_vote_gating = false, so a ready
        # CNA without any vote signal still advances to REVIEW.
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), []),
        ):
            rc = cve_json.main(["123"])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "REVIEW"

    def test_gating_on_without_label_stays_draft(self, capsys, tmp_path):
        cfg = self._write_gating_on_config(tmp_path)
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), ["airflow"]),
        ):
            rc = cve_json.main(["123", "--config", cfg])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "DRAFT"

    def test_gating_on_with_label_emits_review(self, capsys, tmp_path):
        cfg = self._write_gating_on_config(tmp_path)
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), ["airflow", "rc voting"]),
        ):
            rc = cve_json.main(["123", "--config", cfg])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "REVIEW"

    def test_review_flag_overrides_gating_with_no_label(self, capsys, tmp_path):
        cfg = self._write_gating_on_config(tmp_path)
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), []),
        ):
            rc = cve_json.main(["123", "--config", cfg, "--review"])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "REVIEW"

    def test_draft_flag_overrides_gating_with_label(self, capsys, tmp_path):
        # --draft beats a "rc voting" label — used to walk a record
        # back when the RC vote failed but the label is still on the
        # tracker.
        cfg = self._write_gating_on_config(tmp_path)
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), ["rc voting"]),
        ):
            rc = cve_json.main(["123", "--config", cfg, "--draft"])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "DRAFT"

    def test_forward_state_labels_keep_state_at_review_when_rc_voting_removed(self, capsys, tmp_path):
        # After the `pr merged → fix released` transition (per the sync
        # skill's convention), the `rc voting` label is removed and
        # `fix released` is added. Without the forward-state-label
        # check, the state would walk back from REVIEW to DRAFT —
        # exactly the wrong direction for a record that is about to
        # be published. Verify every default forward-state label
        # individually keeps the state at REVIEW.
        cfg = self._write_gating_on_config(tmp_path)
        for forward_label in [
            "fix released",
            "announced - emails sent",
            "announced",
            "vendor-advisory ready",
        ]:
            with patch(
                "generate_cve_json.cve_json.fetch_issue",
                return_value=("Issue title", _issue_body(), ["airflow", forward_label]),
            ):
                rc = cve_json.main(["123", "--config", cfg])
            assert rc == 0, f"non-zero exit on label={forward_label!r}"
            record = json.loads(capsys.readouterr().out)
            assert record["CNA_private"]["state"] == "REVIEW", (
                f"forward-state label {forward_label!r} should keep state at REVIEW, "
                f"got {record['CNA_private']['state']!r}"
            )

    def test_custom_forward_state_labels_from_config(self, capsys, tmp_path):
        # Adopters can extend / replace the default forward-state-label
        # set via [workflow].forward_state_labels in the TOML config.
        fixture = (Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml").read_text()
        patched = fixture.replace(
            "release_vote_gating = false",
            'release_vote_gating = true\nforward_state_labels = ["shipped", "advisory-published"]',
        )
        cfg_path = tmp_path / "cve-json-config-custom-forward.toml"
        cfg_path.write_text(patched)
        # The default `fix released` is no longer in the set, so a
        # ready CNA with only `fix released` walks back to DRAFT.
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), ["airflow", "fix released"]),
        ):
            rc = cve_json.main(["123", "--config", str(cfg_path)])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "DRAFT"
        # `shipped` is in the configured set → REVIEW.
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=("Issue title", _issue_body(), ["airflow", "shipped"]),
        ):
            rc = cve_json.main(["123", "--config", str(cfg_path)])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "REVIEW"

    def test_review_and_draft_are_mutually_exclusive(self):
        # argparse raises SystemExit on mutually-exclusive group conflict;
        # the exit code is 2.
        with pytest.raises(SystemExit) as exc_info:
            cve_json.main(["--stdin", "--review", "--draft"])
        assert exc_info.value.code == 2

    def test_custom_rc_voting_label_from_config(self, capsys, tmp_path):
        # The label name is configurable; if a project sets a custom
        # rc_voting_label, only that label gates REVIEW. The default
        # "rc voting" label on a tracker for such a project is just
        # an unrelated tag.
        cfg = self._write_gating_on_config(tmp_path, label="release-vote-in-progress")
        with patch(
            "generate_cve_json.cve_json.fetch_issue",
            return_value=(
                "Issue title",
                _issue_body(),
                ["rc voting"],  # wrong label name — should NOT trigger
            ),
        ):
            rc = cve_json.main(["123", "--config", cfg])
        assert rc == 0
        record = json.loads(capsys.readouterr().out)
        assert record["CNA_private"]["state"] == "DRAFT"

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
from __future__ import annotations

from pathlib import Path

import pytest

from generate_cve_json.cve_json import _load_config

_DEFAULT_REL = ".apache-magpie-overrides/tools/cve-tool-vulnogram/cve-json-config.toml"
_LEGACY_REL = ".apache-magpie-overrides/tools/vulnogram/cve-json-config.toml"


def _write(root, relpath, vendor):
    p = root / relpath
    p.parent.mkdir(parents=True, exist_ok=True)
    p.write_text(f'vendor = "{vendor}"\n')
    return p


@pytest.fixture(autouse=True)
def _clean_env(monkeypatch, tmp_path):
    """Resolve config from the (empty) tmp cwd, with no env override."""
    monkeypatch.chdir(tmp_path)
    monkeypatch.delenv("CVE_JSON_CONFIG", raising=False)


def test_default_path_is_used_when_present(tmp_path, capsys):
    _write(tmp_path, _DEFAULT_REL, "New")
    assert _load_config() == {"vendor": "New"}
    assert "WARNING" not in capsys.readouterr().err


def test_legacy_path_used_with_warning_when_default_missing(tmp_path, capsys):
    _write(tmp_path, _LEGACY_REL, "Legacy")
    assert _load_config() == {"vendor": "Legacy"}
    err = capsys.readouterr().err
    assert "legacy path" in err
    assert "tools/cve-tool-vulnogram" in err  # points the adopter at the new path


def test_default_wins_over_legacy_when_both_present(tmp_path, capsys):
    _write(tmp_path, _DEFAULT_REL, "New")
    _write(tmp_path, _LEGACY_REL, "Legacy")
    assert _load_config() == {"vendor": "New"}
    assert "WARNING" not in capsys.readouterr().err


def test_missing_both_raises_pointing_at_the_new_path():
    with pytest.raises(FileNotFoundError) as exc:
        _load_config()
    assert "cve-tool-vulnogram" in str(exc.value)


def test_explicit_config_path_does_not_fall_back_to_legacy(tmp_path):
    # Legacy exists, but an explicit (missing) --config path must not silently
    # resolve to it — explicit intent wins and the error is surfaced.
    _write(tmp_path, _LEGACY_REL, "Legacy")
    with pytest.raises(FileNotFoundError):
        _load_config(tmp_path / "explicit-but-missing.toml")


def test_env_config_path_does_not_fall_back_to_legacy(tmp_path, monkeypatch):
    # Same guarantee as --config: $CVE_JSON_CONFIG naming a missing path must
    # raise, even when the legacy pre-rename config is present on disk.
    _write(tmp_path, _LEGACY_REL, "Legacy")
    monkeypatch.setenv("CVE_JSON_CONFIG", str(tmp_path / "missing.toml"))
    with pytest.raises(FileNotFoundError):
        _load_config()


@pytest.fixture
def _restore_default_config():
    """Re-point the module globals at the conftest fixture after the test.

    `_set_config_path` mutates module-level state, so a test that loads a
    different config leaks that config into every test that runs after it.
    """
    yield
    from generate_cve_json import cve_json

    cve_json._set_config_path(Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml")


def test_purl_type_is_optional_and_defaults_to_empty(_restore_default_config):
    """An adopter who has not opted in gets no `purl_type`, and no purl."""
    from generate_cve_json import cve_json

    fixture = Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml"
    cve_json._set_config_path(fixture)
    assert cve_json.DEFAULT_PURL_TYPE == ""


def test_purl_type_is_read_from_the_product_section(_restore_default_config):
    from generate_cve_json import cve_json

    fixture = Path(__file__).resolve().parent / "fixtures" / "cve-json-config-providers.toml"
    cve_json._set_config_path(fixture)
    assert cve_json.DEFAULT_PURL_TYPE == "pypi"


def test_purl_namespace_is_optional_and_defaults_to_empty(_restore_default_config):
    from generate_cve_json import cve_json

    cve_json._set_config_path(Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml")
    assert cve_json.DEFAULT_PURL_NAMESPACE == ""


def test_purl_namespace_is_read_from_the_product_section(tmp_path, _restore_default_config):
    from generate_cve_json import cve_json

    source = Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml"
    config = tmp_path / "cve-json-config.toml"
    config.write_text(
        source.read_text().replace(
            'default_collection_url = "https://pypi.python.org"',
            'default_collection_url = "https://pypi.python.org"\n'
            'purl_type = "maven"\n'
            'purl_namespace = "org.apache.example"',
        )
    )
    cve_json._set_config_path(config)
    assert cve_json.DEFAULT_PURL_TYPE == "maven"
    assert cve_json.DEFAULT_PURL_NAMESPACE == "org.apache.example"

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
"""Unit tests for pure helpers in ``generate_cve_json``.

Everything that shells out to ``gh`` or touches the network lives in
``fetch_issue``, ``attach_to_issue``, ``_gh_api_json``, and
``_find_existing_attachment_comment_id``. Those are excluded from this
test suite; they can be exercised against a live issue by running the
CLI end-to-end.
"""

from __future__ import annotations

import json
from collections.abc import Iterator
from pathlib import Path
from typing import Any

import pytest

from generate_cve_json import (
    _build_attachment_body,
    _is_cna_ready_for_review,
    _product_for_package,
    build_affected,
    build_cna_container,
    build_credits,
    build_descriptions,
    build_metrics,
    build_problem_types,
    build_references,
    classify_reference,
    combine_remediation_developers,
    compute_cna_private_state,
    compute_package_url,
    compute_purl,
    cve_json,
    emit_json,
    extract_field,
    format_version_range,
    package_identity,
    parse_affected_versions,
    parse_credits_from_field,
    parse_cve_id,
    parse_cwe,
    parse_url_list,
    resolve_purl_type,
    resolve_title,
    split_purl,
    wrap_cve_record,
)
from generate_cve_json.cve_json import is_bot_credit, normalise_severity, to_html

DEFAULT_AFFECTED_ARGS: dict[str, Any] = {
    "vendor": "Apache Software Foundation",
    "product": "Apache Example",
    "package_name": "apache-example",
    "collection_url": "https://pypi.python.org",
    "version_start": None,
}

# ---------------------------------------------------------------------------
# Issue body field extraction
# ---------------------------------------------------------------------------


class TestExtractField:
    def test_returns_value_up_to_next_field(self):
        body = (
            "### The issue description\nSummary text.\n\n### Affected versions\n>=3.0.0\n\n### CWE\nCWE-352\n"
        )
        assert extract_field(body, "Affected versions") == ">=3.0.0"
        assert extract_field(body, "CWE") == "CWE-352"

    def test_missing_field_returns_empty_string(self):
        body = "### Short public summary for publish\n\nHello.\n"
        assert extract_field(body, "CVE tool link") == ""

    def test_no_response_placeholder_is_normalised_to_empty(self):
        body = "### Severity\n\n_No response_\n"
        assert extract_field(body, "Severity") == ""

    def test_trailing_whitespace_is_stripped(self):
        body = "### Short public summary for publish\n\nHello.   \n\n### Affected versions\n\n\n"
        assert extract_field(body, "Short public summary for publish") == "Hello."

    def test_public_advisory_url_field_is_separate_from_security_mailing_list_thread(self):
        body = (
            "### Security mailing list thread\n\n"
            "https://lists.apache.org/thread/fake-security-private-hash\n\n"
            "### Public advisory URL\n\n"
            "https://lists.apache.org/thread/real-users-archive-id?users@airflow.apache.org\n\n"
            "### Reporter credited as\n\nAlice\n"
        )
        # The two fields are addressed independently by name; the private
        # security@ URL stays in the body but is never exported.
        assert (
            extract_field(body, "Security mailing list thread")
            == "https://lists.apache.org/thread/fake-security-private-hash"
        )
        assert (
            extract_field(body, "Public advisory URL")
            == "https://lists.apache.org/thread/real-users-archive-id?users@airflow.apache.org"
        )


# ---------------------------------------------------------------------------
# Credit parsing
# ---------------------------------------------------------------------------


class TestParseCreditsFromField:
    def test_newline_separated_credits_produce_multiple_entries(self):
        value = "Alice Smith\nBob Jones (Acme Corp)"
        assert parse_credits_from_field(value) == ["Alice Smith", "Bob Jones (Acme Corp)"]

    def test_comma_inside_a_credit_stays_in_the_same_credit(self):
        value = "Jane Doe, Acme Security"
        # Comma-splitting is deliberately off: "Name, Affiliation" is ONE credit.
        assert parse_credits_from_field(value) == ["Jane Doe, Acme Security"]

    def test_bullets_are_stripped(self):
        value = "- Alice\n* Bob\n+ Charlie\n1. Diana"
        assert parse_credits_from_field(value) == ["Alice", "Bob", "Charlie", "Diana"]

    def test_duplicates_are_removed_preserving_order(self):
        value = "Alice\nBob\nAlice"
        assert parse_credits_from_field(value) == ["Alice", "Bob"]

    def test_empty_field_returns_empty_list(self):
        assert parse_credits_from_field("") == []


# ---------------------------------------------------------------------------
# Bot / AI credit detection (drives `type: "tool"` in build_credits)
# ---------------------------------------------------------------------------


class TestIsBotCredit:
    @pytest.mark.parametrize(
        "name",
        [
            "dependabot[bot]",
            "github-actions[bot]",
            "renovate[bot]",
            "copilot[bot]",
            "ghsa-probot[bot]",
        ],
    )
    def test_github_bot_suffix_matches(self, name: str):
        assert is_bot_credit(name) is True

    @pytest.mark.parametrize(
        "name",
        [
            "Dependabot",
            "DEPENDABOT",
            "Snyk",
            "Renovate",
            "github-actions",
            "Claude",
            "ChatGPT",
            "Mend",
            "Whitesource",
        ],
    )
    def test_known_name_list_matches_case_insensitively(self, name: str):
        assert is_bot_credit(name) is True

    @pytest.mark.parametrize(
        "name",
        [
            "discovered by Automated Scanner v3",
            "reported via security-scanner",
            "found by Renovate during dependency sweep",
        ],
    )
    def test_known_name_matches_inside_free_form_string(self, name: str):
        assert is_bot_credit(name) is True

    @pytest.mark.parametrize(
        "name",
        [
            "claude-bot",
            "release-bot",
            "securitybot",
            "scan-ai",
            "bugbunny.ai",  # domain-style AI-service handle
            "xbow.ai",
            "triage-agent",
            "secaudit-gpt",
            "securityscanner-7",
            "automated-triage",
            "automaton",
        ],
    )
    def test_pattern_handles_match(self, name: str):
        assert is_bot_credit(name) is True

    @pytest.mark.parametrize(
        "name",
        [
            "Alice Smith",
            "Bob Jones (Acme Corp)",
            "Jane Doe, Acme Security",
            "Joe Bot",  # space breaks word boundary on *bot/-bot patterns
            "Botev Martinov",  # word boundary stops the bot suffix at "Botev"
            "Renovation Engineering Inc",  # 'renovate' substring, not whole word
            "AI Research Lab",  # uppercase free-standing; no *-ai handle shape
        ],
    )
    def test_human_names_do_not_match(self, name: str):
        assert is_bot_credit(name) is False

    def test_empty_string_does_not_match(self):
        assert is_bot_credit("") is False

    def test_whitespace_only_does_not_match(self):
        assert is_bot_credit("   ") is False


class TestBuildCreditsBotTypeAssignment:
    def test_plain_human_credit_gets_finder_type(self):
        credits = build_credits("Alice Smith", remediation_developers=[])
        assert credits == [{"lang": "en", "type": "finder", "value": "Alice Smith"}]

    def test_github_bot_suffix_credit_gets_tool_type(self):
        credits = build_credits("dependabot[bot]", remediation_developers=[])
        assert credits == [{"lang": "en", "type": "tool", "value": "dependabot[bot]"}]

    def test_known_bot_name_credit_gets_tool_type(self):
        credits = build_credits("Dependabot", remediation_developers=[])
        assert credits == [{"lang": "en", "type": "tool", "value": "Dependabot"}]

    def test_pattern_handle_credit_gets_tool_type(self):
        credits = build_credits("claude-bot", remediation_developers=[])
        assert credits == [{"lang": "en", "type": "tool", "value": "claude-bot"}]

    def test_mixed_credits_get_per_row_types(self):
        credits = build_credits(
            "Alice Smith\nDependabot\nBob Jones (Acme Corp)",
            remediation_developers=[],
        )
        assert credits == [
            {"lang": "en", "type": "finder", "value": "Alice Smith"},
            {"lang": "en", "type": "tool", "value": "Dependabot"},
            {"lang": "en", "type": "finder", "value": "Bob Jones (Acme Corp)"},
        ]

    def test_remediation_developer_type_unaffected_by_bot_policy(self):
        """Remediation-developer side is intentionally NOT routed through tool."""
        credits = build_credits(
            "Alice Smith",
            remediation_developers=["dependabot[bot]"],
        )
        # Bot lands as remediation developer with its original type — the
        # finder-side tool routing does not extend here. Skipping bots on
        # the remediation side is a separate (upstream-skill) concern.
        assert credits == [
            {"lang": "en", "type": "finder", "value": "Alice Smith"},
            {
                "lang": "en",
                "type": "remediation developer",
                "value": "dependabot[bot]",
            },
        ]


# ---------------------------------------------------------------------------
# URL list parsing
# ---------------------------------------------------------------------------


class TestParseUrlList:
    def test_multiple_urls_extracted(self):
        value = (
            "First:\nhttps://github.com/apache/airflow/pull/64114\n"
            "Second: https://github.com/apache/airflow/pull/65346"
        )
        urls = parse_url_list(value)
        assert urls == [
            "https://github.com/apache/airflow/pull/64114",
            "https://github.com/apache/airflow/pull/65346",
        ]

    def test_bare_text_with_no_urls_returns_empty(self):
        assert parse_url_list("No links here.") == []


# ---------------------------------------------------------------------------
# CVE ID / CWE parsing
# ---------------------------------------------------------------------------


class TestParseCveId:
    def test_extracts_cve_from_asf_tool_link(self):
        assert parse_cve_id("https://cveprocess.apache.org/cve5/CVE-2026-40948") == "CVE-2026-40948"

    def test_extracts_cve_from_plain_id(self):
        assert parse_cve_id("CVE-2026-40948") == "CVE-2026-40948"

    def test_missing_returns_empty(self):
        assert parse_cve_id("") == ""


class TestParseCwe:
    def test_cwe_with_title(self):
        cwe_id, description = parse_cwe("CWE-352: Cross-Site Request Forgery (CSRF)")
        assert cwe_id == "CWE-352"
        assert description == "CWE-352: Cross-Site Request Forgery (CSRF)"

    def test_cwe_without_title_emits_bare_id_as_description(self):
        cwe_id, description = parse_cwe("CWE-614")
        assert cwe_id == "CWE-614"
        assert description == "CWE-614"

    def test_no_cwe_keeps_original_text_as_description(self):
        cwe_id, description = parse_cwe("_No response_")
        assert cwe_id == ""
        assert description == "_No response_"

    def test_cwe_with_parens_around_title_strips_outer_wrapper(self):
        # `CWE-285 (Improper Authorization)` is what most projects'
        # CWE pickers serialise to. Without the strip, the result is
        # `CWE-285: (Improper Authorization)` — colon AND parens —
        # which reviewers flag as cluttered. This regression closes
        # the Arnout-reported issue on CVE-2026-46763 (2026-05-28).
        cwe_id, description = parse_cwe("CWE-285 (Improper Authorization)")
        assert cwe_id == "CWE-285"
        assert description == "CWE-285: Improper Authorization"

    def test_cwe_with_brackets_around_title_also_stripped(self):
        cwe_id, description = parse_cwe("CWE-352 [Cross-Site Request Forgery]")
        assert cwe_id == "CWE-352"
        assert description == "CWE-352: Cross-Site Request Forgery"

    def test_cwe_with_inner_parens_not_stripped(self):
        # The wrapper-strip only fires when the outer characters are
        # the wrapper. Inner parens stay; they are content.
        cwe_id, description = parse_cwe("CWE-285 Title (annotation)")
        assert cwe_id == "CWE-285"
        assert description == "CWE-285: Title (annotation)"

    def test_cwe_with_mismatched_wrappers_not_stripped(self):
        # A leading `(` without a trailing `)` is not a wrapper.
        cwe_id, description = parse_cwe("CWE-285 (Foo) Bar (Baz)")
        assert cwe_id == "CWE-285"
        assert description == "CWE-285: (Foo) Bar (Baz)"


# ---------------------------------------------------------------------------
# Affected-versions parsing
# ---------------------------------------------------------------------------


class TestParseAffectedVersions:
    def test_bare_less_than_creates_range(self):
        versions = parse_affected_versions("<3.2.0", None)
        assert versions == [
            {"lessThan": "3.2.0", "status": "affected", "version": "0", "versionType": "semver"},
        ]

    def test_inclusive_range(self):
        versions = parse_affected_versions(">=3.0.0, <3.2.0", None)
        assert versions == [
            {"lessThan": "3.2.0", "status": "affected", "version": "3.0.0", "versionType": "semver"},
        ]

    def test_less_or_equal_upper_bound(self):
        versions = parse_affected_versions("<=6.5.0", None)
        assert versions == [
            {
                "lessThanOrEqual": "6.5.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver",
            },
        ]

    def test_version_start_override_sets_low_bound(self):
        versions = parse_affected_versions(">=3.0.0, <3.2.0", "2.10.5")
        assert versions[0]["version"] == "2.10.5"

    def test_unknown_string_raises_value_error(self):
        # The parser now refuses to emit garbage: an unparsable
        # `Affected versions` field is a hard error rather than a
        # bare-string fallback. This regression closes the issue on
        # CVE-2026-46763 (2026-05-28) where the field `>= 3.0.0 (...)`
        # serialised the parenthetical clause into the JSON `version`
        # field.
        with pytest.raises(ValueError, match="Could not parse"):
            parse_affected_versions("all versions", None)

    def test_unparsable_input_error_mentions_the_value(self):
        # The error message includes the offending value so the
        # reviewer can find it in the issue body.
        with pytest.raises(ValueError, match="all versions"):
            parse_affected_versions("all versions", None)

    def test_lower_bound_only_emits_open_ended_entry(self):
        # `>=2.0.0` (no upper) — useful for trackers whose fix-shipped
        # version isn't known yet (typically providers). Still emits
        # (does not raise) but issues a warning to stderr — see the
        # warning test below.
        versions = parse_affected_versions(">=2.0.0", None)
        assert versions == [
            {"status": "affected", "version": "2.0.0", "versionType": "semver"},
        ]

    def test_lower_bound_only_with_space(self):
        versions = parse_affected_versions(">= 2.0.0", None)
        assert versions == [
            {"status": "affected", "version": "2.0.0", "versionType": "semver"},
        ]

    def test_lower_bound_only_warns_about_missing_upper_bound(self, capsys):
        # A bare lower bound has the misleading shape where CVE 5.x
        # readers interpret it as "this version alone is affected".
        # Warn so a reviewer notices and fills in `< X.Y.Z` or the
        # `< NEXT VERSION` sentinel.
        parse_affected_versions(">= 2.0.0", None)
        captured = capsys.readouterr()
        assert "bare lower bound" in captured.err
        assert "'2.0.0'" in captured.err or '"2.0.0"' in captured.err
        # No stdout chatter; warnings go to stderr only.
        assert captured.out == ""

    def test_lower_bound_with_next_version_sentinel_does_not_warn(self, capsys):
        # `< NEXT VERSION` is the documented "fix not yet released,
        # upper bound unknown" form — emitting the bare-version entry
        # is intentional, no warning.
        parse_affected_versions(">= 2.0.0, < NEXT VERSION", None)
        captured = capsys.readouterr()
        assert captured.err == ""
        assert captured.out == ""


class TestParseAffectedVersionsNextVersionPlaceholder:
    """The `< NEXT VERSION` sentinel: fix not yet released, upper bound unknown.

    Stripped before further parsing; resulting entry has no `lessThan`.
    Used predominantly for projects trackers where the wave milestone
    is date-based and the package version that ships the fix is decided
    by the release manager during the wave.
    """

    def test_just_next_version_placeholder(self):
        versions = parse_affected_versions("< NEXT VERSION", None)
        assert versions == [
            {"status": "affected", "version": "0", "versionType": "semver"},
        ]

    def test_lowercase_token_also_accepted(self):
        versions = parse_affected_versions("< next version", None)
        assert versions == [
            {"status": "affected", "version": "0", "versionType": "semver"},
        ]

    def test_lower_bound_with_next_version_upper(self):
        versions = parse_affected_versions(">= 2.0.0 < NEXT VERSION", None)
        assert versions == [
            {"status": "affected", "version": "2.0.0", "versionType": "semver"},
        ]

    def test_lower_bound_with_comma_and_next_version_upper(self):
        versions = parse_affected_versions(">= 2.0.0, < NEXT VERSION", None)
        assert versions == [
            {"status": "affected", "version": "2.0.0", "versionType": "semver"},
        ]

    def test_real_version_replacing_placeholder_round_trips(self):
        # Once the release manager knows the fix-shipped version, the
        # sync skill replaces `< NEXT VERSION` with `< X.Y.Z`. The
        # parser must produce the standard fully-bounded shape.
        versions = parse_affected_versions(">= 2.0.0, < 5.6.0", None)
        assert versions == [
            {"status": "affected", "version": "2.0.0", "lessThan": "5.6.0", "versionType": "semver"},
        ]


# ---------------------------------------------------------------------------
# Product-name resolution for Airflow packages
# ---------------------------------------------------------------------------


class TestProductForPackage:
    def test_core_package_resolves_to_apache_airflow(self):
        assert _product_for_package("apache-example") == "Apache Example"

    def test_known_provider_uses_display_map_casing(self):
        assert _product_for_package("apache-example-project-foo") == "Apache Example Project Foo"
        assert (
            _product_for_package("apache-example-project-kerfluffle") == "Apache Example Project Kerfluffle"
        )
        assert _product_for_package("apache-example-project-acme-xyz") == "Apache Example Project Acme XYZ"
        # Confirms the user-cited mapping example from the Vulnogram form:
        #   apache-example-project-bar → "Apache Example Project Bar".
        assert _product_for_package("apache-example-project-bar") == "Apache Example Project Bar"

    def test_unknown_provider_falls_back_to_title_case(self):
        assert (
            _product_for_package("apache-example-project-madeup-widget")
            == "Apache Example Project Madeup Widget"
        )

    def test_overrides_win_over_display_map(self):
        assert (
            _product_for_package(
                "apache-example-project-foo",
                product_overrides={
                    "apache-example-project-foo": "Custom ES Display",
                },
            )
            == "Custom ES Display"
        )

    def test_overrides_win_over_title_case_fallback(self):
        assert (
            _product_for_package(
                "apache-example-project-madeup-widget",
                product_overrides={
                    "apache-example-project-madeup-widget": "Apache Example Project WIDGET",
                },
            )
            == "Apache Example Project WIDGET"
        )


# ---------------------------------------------------------------------------
# Product-name resolution for projects whose subpackages use a
# convention other than `-project-` (regression coverage for the bug
# where the lookup was anchored on a hardcoded `-project-` prefix
# instead of reading the `project` group from the configured
# `package_pattern`).
# ---------------------------------------------------------------------------


class TestProductForPackageProvidersStyle:
    """Subpackage prefix is `-providers-`, not `-project-`.

    Mirrors the shape Apache Airflow ships on PyPI
    (`apache-airflow-providers-<dir>`). The lookup must read the
    `project` named group from whatever the configured
    `package_pattern` declares — the prefix is a project-level
    convention, not a generator constant.
    """

    @pytest.fixture(autouse=True)
    def _providers_config(self) -> Iterator[None]:
        from pathlib import Path

        from generate_cve_json.cve_json import _set_config_path

        fixture = Path(__file__).resolve().parent / "fixtures" / "cve-json-config-providers.toml"
        default = Path(__file__).resolve().parent / "fixtures" / "cve-json-config.toml"
        _set_config_path(fixture)
        try:
            yield
        finally:
            _set_config_path(default)

    def test_known_provider_uses_display_map_casing(self):
        # `cncf-kubernetes` is captured by the `(?P<project>...)`
        # group of the configured pattern and looked up in the
        # display map — the resolver must not fall through to
        # returning the raw package name.
        assert (
            _product_for_package("apache-example-providers-cncf-kubernetes")
            == "Apache Example CNCF Kubernetes provider"
        )

    def test_unknown_provider_falls_back_to_title_case(self):
        assert (
            _product_for_package("apache-example-providers-madeup-widget")
            == "Apache Example Madeup Widget provider"
        )

    def test_top_level_still_resolves(self):
        assert _product_for_package("apache-example") == "Apache Example"

    def test_overrides_still_win(self):
        assert (
            _product_for_package(
                "apache-example-providers-cncf-kubernetes",
                product_overrides={
                    "apache-example-providers-cncf-kubernetes": "CUSTOM",
                },
            )
            == "CUSTOM"
        )


# ---------------------------------------------------------------------------
# Multi-product `build_affected`
# ---------------------------------------------------------------------------


class TestBuildAffectedSingleProduct:
    def test_empty_field_emits_one_placeholder_entry(self):
        entries = build_affected("", **DEFAULT_AFFECTED_ARGS)
        assert len(entries) == 1
        assert entries[0]["packageURL"] == "pkg:pypi/apache-example"
        assert entries[0]["product"] == "Apache Example"

    def test_bare_version_range_uses_defaults(self):
        entries = build_affected("<3.2.2", **DEFAULT_AFFECTED_ARGS)
        assert len(entries) == 1
        assert entries[0]["packageURL"] == "pkg:pypi/apache-example"
        assert entries[0]["product"] == "Apache Example"
        assert entries[0]["versions"][0]["lessThan"] == "3.2.2"

    def test_single_line_with_package_prefix_detects_provider(self):
        entries = build_affected(
            "apache-example-project-foo <=6.5.0",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert len(entries) == 1
        assert entries[0]["packageURL"] == "pkg:pypi/apache-example-project-foo"
        assert entries[0]["product"] == "Apache Example Project Foo"
        assert entries[0]["versions"][0]["lessThanOrEqual"] == "6.5.0"

    def test_single_line_with_core_package_prefix_detects_core(self):
        entries = build_affected(
            "apache-example <3.2.2",
            vendor="Apache Software Foundation",
            product="IGNORED",
            package_name="ignored",
            collection_url="https://pypi.python.org",
            version_start=None,
        )
        assert len(entries) == 1
        # Package prefix wins over the default argument because the body
        # has said the package name explicitly.
        assert entries[0]["packageURL"] == "pkg:pypi/apache-example"
        assert entries[0]["product"] == "Apache Example"


class TestBuildAffectedMultiProduct:
    def test_two_providers_produce_two_entries(self):
        entries = build_affected(
            "apache-example-project-foo <=6.5.0\napache-example-project-kerfluffle <=1.9.0",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert len(entries) == 2
        es, os_ = entries
        assert es["packageURL"] == "pkg:pypi/apache-example-project-foo"
        assert es["product"] == "Apache Example Project Foo"
        assert es["versions"][0]["lessThanOrEqual"] == "6.5.0"
        assert os_["packageURL"] == "pkg:pypi/apache-example-project-kerfluffle"
        assert os_["product"] == "Apache Example Project Kerfluffle"
        assert os_["versions"][0]["lessThanOrEqual"] == "1.9.0"

    def test_bullet_prefixes_are_stripped(self):
        entries = build_affected(
            "- apache-example-project-foo <=6.5.0\n* apache-example-project-kerfluffle <=1.9.0",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert [e["packageURL"] for e in entries] == [
            "pkg:pypi/apache-example-project-foo",
            "pkg:pypi/apache-example-project-kerfluffle",
        ]

    def test_blank_lines_between_entries_are_ignored(self):
        entries = build_affected(
            "apache-example-project-foo <=6.5.0\n\napache-example-project-kerfluffle <=1.9.0\n",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert len(entries) == 2

    def test_mixed_known_and_unknown_provider(self):
        entries = build_affected(
            "apache-example-project-foo <=6.5.0\napache-example-project-brand-new <=0.1.0",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert entries[0]["product"] == "Apache Example Project Foo"
        assert entries[1]["product"] == "Apache Example Project Brand New"

    def test_product_overrides_applied_per_entry(self):
        entries = build_affected(
            "apache-example-project-brand-new <=0.1.0",
            product_overrides={
                "apache-example-project-brand-new": "Apache Example Project BRAND",
            },
            **DEFAULT_AFFECTED_ARGS,
        )
        assert entries[0]["product"] == "Apache Example Project BRAND"

    def test_line_without_prefix_falls_back_to_defaults(self):
        # A single line that does not carry a recognisable package
        # prefix stays in the legacy single-entry path and takes the
        # explicit product / packageName args. (The version-range
        # shape itself is incidental to what this test exercises;
        # use a parseable shape since the parser no longer accepts
        # arbitrary free-form text.)
        entries = build_affected(
            "<= 1.0.0",
            vendor="Apache Software Foundation",
            product="Apache Example Helm Chart",
            package_name="apache-example-project-helm-chart",
            collection_url="https://airflow.apache.org/",
            version_start=None,
            # A Helm chart served from the project's own site is not on a
            # package host the purl spec models, so it opts out explicitly.
            purl_type="none",
        )
        assert len(entries) == 1
        assert entries[0]["packageName"] == "apache-example-project-helm-chart"
        assert entries[0]["collectionURL"] == "https://airflow.apache.org/"
        assert entries[0]["product"] == "Apache Example Helm Chart"
        assert "packageURL" not in entries[0]

    def test_multi_line_is_deterministic(self):
        # Re-generating must produce byte-identical output, which is
        # what keeps the `--attach` idempotence guarantee intact.
        first = build_affected(
            "apache-example-project-foo <=6.5.0\napache-example-project-kerfluffle <=1.9.0",
            **DEFAULT_AFFECTED_ARGS,
        )
        second = build_affected(
            "apache-example-project-foo <=6.5.0\napache-example-project-kerfluffle <=1.9.0",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert first == second

    def test_per_line_next_version_placeholder(self):
        # The providers-tracker pattern: one line per affected package,
        # all with `< NEXT VERSION` until the wave ships.
        entries = build_affected(
            "apache-example-project-foo < NEXT VERSION\napache-example-project-kerfluffle < NEXT VERSION",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert len(entries) == 2
        es, os_ = entries
        assert es["packageURL"] == "pkg:pypi/apache-example-project-foo"
        assert es["versions"] == [
            {"status": "affected", "version": "0", "versionType": "semver"},
        ]
        assert os_["packageURL"] == "pkg:pypi/apache-example-project-kerfluffle"
        assert os_["versions"] == [
            {"status": "affected", "version": "0", "versionType": "semver"},
        ]

    def test_per_line_lower_bound_only(self):
        # Lower-bound-only line (e.g. `apache-example-project-xyz >=2.0.0`)
        # — useful when affected versions are known to start at X but the
        # fix-shipped version isn't known yet.
        entries = build_affected(
            "apache-example-project-xyz >=2.0.0",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert len(entries) == 1
        assert entries[0]["packageURL"] == "pkg:pypi/apache-example-project-xyz"
        assert entries[0]["versions"] == [
            {"status": "affected", "version": "2.0.0", "versionType": "semver"},
        ]

    def test_per_line_lower_bound_with_next_version_upper(self):
        entries = build_affected(
            "apache-example-project-xyz >= 2.0.0, < NEXT VERSION",
            **DEFAULT_AFFECTED_ARGS,
        )
        assert len(entries) == 1
        assert entries[0]["versions"] == [
            {"status": "affected", "version": "2.0.0", "versionType": "semver"},
        ]


# ---------------------------------------------------------------------------
# Reference tagging
# ---------------------------------------------------------------------------


class TestClassifyReference:
    def test_github_pr_tagged_as_patch(self):
        assert classify_reference("https://github.com/apache/airflow/pull/64114") == ["patch"]

    def test_github_commit_tagged_as_patch(self):
        assert classify_reference("https://github.com/apache/airflow/commit/abc123") == ["patch"]

    def test_lists_apache_tagged_as_vendor_advisory(self):
        assert classify_reference("https://lists.apache.org/thread/abc") == ["vendor-advisory"]

    def test_plain_doc_url_has_no_tags(self):
        assert classify_reference("https://airflow.apache.org/docs/") == []

    def test_security_apache_tagged_as_vendor_advisory(self):
        assert classify_reference("https://security.apache.org/foo") == ["vendor-advisory"]

    def test_evil_substring_in_path_is_not_tagged(self):
        # Regression: substring match would have flagged this; CodeQL
        # `py/incomplete-url-substring-sanitization`. Hostname match
        # rejects it correctly.
        assert classify_reference("https://evil.example/?q=lists.apache.org") == []
        assert classify_reference("https://evil.example/security.apache.org") == []

    def test_subdomain_is_not_treated_as_apache(self):
        assert classify_reference("https://lists.apache.org.evil.example/x") == []

    def test_malformed_url_returns_no_tags(self):
        assert classify_reference("not a url") == []

    def test_cve_org_record_tagged_as_related(self):
        # ASF Security's preferred URL form for sibling/incomplete-fix CVE
        # cross-references (Arnout Engelen, 2026-05-29 review on
        # CVE-2026-49298).
        assert classify_reference("https://www.cve.org/CVERecord?id=CVE-2026-27173") == ["related"]
        assert classify_reference("https://cve.org/CVERecord?id=CVE-2025-68438") == ["related"]

    def test_nvd_record_tagged_as_related(self):
        # NVD is the same CVE database under a different URL form; treat
        # as related too.
        assert classify_reference("https://nvd.nist.gov/vuln/detail/CVE-2026-27173") == ["related"]


class TestExtractRelatedCveIds:
    def test_extracts_single_prior_cve(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        summary = (
            "This is a variant of CWE-200 previously addressed in CVE-2025-68438; "
            "that fix did not cover the nested sensitive-keyword allowlist."
        )
        assert extract_related_cve_ids(summary) == ["CVE-2025-68438"]

    def test_extracts_multiple_distinct_in_order(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        summary = "Fix-bypass of CVE-2026-33858. Also related to CVE-2025-50213 and CVE-2025-27018."
        assert extract_related_cve_ids(summary) == [
            "CVE-2026-33858",
            "CVE-2025-50213",
            "CVE-2025-27018",
        ]

    def test_excludes_current_cve_id(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        summary = "CVE-2026-42359 fixes a PATCH-path bypass of CVE-2026-33858."
        assert extract_related_cve_ids(summary, current_cve_id="CVE-2026-42359") == [
            "CVE-2026-33858",
        ]

    def test_current_cve_id_match_is_case_insensitive(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        summary = "cve-2026-42359 fixes a PATCH-path bypass of CVE-2026-33858."
        assert extract_related_cve_ids(summary, current_cve_id="CVE-2026-42359") == [
            "CVE-2026-33858",
        ]

    def test_deduplicates_repeated_mentions(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        summary = "CVE-2025-68438 was incomplete; this CVE follows CVE-2025-68438."
        assert extract_related_cve_ids(summary) == ["CVE-2025-68438"]

    def test_substring_in_larger_token_does_not_match(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        # Word-boundary regex must not match identifiers embedded in
        # larger tokens (defensive against accidental hits).
        assert extract_related_cve_ids("seeCVE-2026-33858trailing") == []
        assert extract_related_cve_ids("CVE-2026-33858x") == []

    def test_short_form_required_at_least_four_digits(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        # CVE-YYYY-NNNN minimum (matches MITRE's 4-7 digit constraint).
        assert extract_related_cve_ids("CVE-2026-123") == []
        assert extract_related_cve_ids("CVE-2026-1234") == ["CVE-2026-1234"]

    def test_empty_string_returns_empty_list(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        assert extract_related_cve_ids("") == []

    def test_no_cve_id_in_text_returns_empty_list(self):
        from generate_cve_json.cve_json import extract_related_cve_ids

        assert extract_related_cve_ids("no CVE here, just narrative.") == []


class TestRelatedCveUrl:
    def test_url_format_matches_cve_org(self):
        from generate_cve_json.cve_json import related_cve_url

        assert related_cve_url("CVE-2026-27173") == "https://www.cve.org/CVERecord?id=CVE-2026-27173"


class TestBuildReferences:
    def test_mailing_list_field_urls_are_not_auto_included(self):
        refs = build_references(
            mailing_list_field="https://lists.apache.org/thread/fake-security-thread",
            pr_field="https://github.com/apache/airflow/pull/64114",
        )
        urls = [r["url"] for r in refs]
        assert urls == ["https://github.com/apache/airflow/pull/64114"]

    def test_explicit_advisory_url_is_included(self):
        refs = build_references(
            mailing_list_field="",
            pr_field="https://github.com/apache/airflow/pull/64114",
            extra_urls=["https://lists.apache.org/thread/real-users-archive-url"],
        )
        urls = {r["url"] for r in refs}
        assert "https://lists.apache.org/thread/real-users-archive-url" in urls
        # And it gets tagged correctly.
        by_url = {r["url"]: r for r in refs}
        advisory = by_url["https://lists.apache.org/thread/real-users-archive-url"]
        assert advisory.get("tags") == ["vendor-advisory"]

    def test_airflow_s_and_cveprocess_urls_are_filtered_out(self):
        refs = build_references(
            mailing_list_field="",
            pr_field="",
            extra_urls=[
                "https://github.com/apache-example-s/apache-example-s/issues/256",
                "https://cveprocess.apache.org/cve5/CVE-2026-40948",
                "https://github.com/apache/airflow/pull/64114",
            ],
        )
        urls = [r["url"] for r in refs]
        assert urls == ["https://github.com/apache/airflow/pull/64114"]


# ---------------------------------------------------------------------------
# Title handling
# ---------------------------------------------------------------------------


class TestResolveTitle:
    def test_strips_apache_airflow_prefix_from_issue_title(self):
        assert resolve_title("Apache Example: DAG auth bypass", "", None) == "DAG auth bypass"

    def test_override_wins(self):
        assert resolve_title("from-issue", "summary", "my override") == "my override"

    def test_falls_back_to_summary_when_empty(self):
        assert resolve_title("", "A summary. With more text.", None) == "A summary"


# ---------------------------------------------------------------------------
# Readiness helper + envelope state
# ---------------------------------------------------------------------------


def _ready_cna() -> dict:
    """Build a minimal CNA container that satisfies every readiness rule."""
    return {
        "title": "Example vulnerability",
        "descriptions": [{"lang": "en", "value": "A description."}],
        "affected": build_affected(
            ">=3.0.0, <3.2.0",
            vendor="Apache Software Foundation",
            product="Apache Example",
            package_name="apache-example",
            collection_url="https://pypi.python.org",
            version_start=None,
        ),
        "problemTypes": build_problem_types("CWE-352: CSRF"),
        "metrics": build_metrics("Low"),
        "credits": build_credits("Alice Smith", remediation_developers=["Bob"]),
        "references": build_references(
            mailing_list_field="",
            pr_field="https://github.com/apache/airflow/pull/123",
        ),
    }


class TestIsCnaReadyForReview:
    def test_fully_populated_cna_is_ready(self):
        assert _is_cna_ready_for_review(_ready_cna(), "CVE-2026-00001") is True

    def test_missing_cve_id_blocks_review(self):
        assert _is_cna_ready_for_review(_ready_cna(), "") is False

    def test_missing_title_blocks_review(self):
        cna = _ready_cna()
        cna["title"] = ""
        assert _is_cna_ready_for_review(cna, "CVE-2026-00001") is False

    def test_missing_credit_blocks_review(self):
        cna = _ready_cna()
        cna["credits"] = []
        assert _is_cna_ready_for_review(cna, "CVE-2026-00001") is False

    def test_unknown_severity_blocks_review(self):
        cna = _ready_cna()
        cna["metrics"] = build_metrics("Unknown")
        assert _is_cna_ready_for_review(cna, "CVE-2026-00001") is False

    def test_missing_cwe_blocks_review(self):
        cna = _ready_cna()
        cna["problemTypes"] = []
        assert _is_cna_ready_for_review(cna, "CVE-2026-00001") is False

    def test_missing_reference_blocks_review(self):
        cna = _ready_cna()
        cna["references"] = []
        assert _is_cna_ready_for_review(cna, "CVE-2026-00001") is False


class TestWrapCveRecord:
    def test_cve_metadata_state_is_always_published(self):
        # `cveMetadata.state` is the CVE 5.x schema field — only valid
        # values are PUBLISHED / REJECTED for a submitted record.
        # The generator hard-codes PUBLISHED regardless of workflow.
        record = wrap_cve_record(_ready_cna(), cve_id="CVE-2026-00001", org_id="org")
        assert record["cveMetadata"]["state"] == "PUBLISHED"
        assert record["cveMetadata"]["cveId"] == "CVE-2026-00001"

    def test_cve_metadata_state_published_even_when_draft(self):
        cna = _ready_cna()
        cna["credits"] = []  # make the CNA incomplete
        record = wrap_cve_record(cna, cve_id="CVE-2026-00001", org_id="org")
        # Workflow state went to DRAFT, but the CVE 5.x schema state
        # stays PUBLISHED — these are different fields.
        assert record["cveMetadata"]["state"] == "PUBLISHED"

    def test_ready_record_emits_review_workflow_state(self):
        # Legacy / non-gated default: a ready CNA advances to REVIEW
        # without any signal. This is what non-ASF adopters get when
        # they don't set [workflow].release_vote_gating in their config.
        cna = _ready_cna()
        record = wrap_cve_record(cna, cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["state"] == "REVIEW"

    def test_ready_record_gated_without_vote_stays_draft(self):
        # Gated path (ASF adopters with release_vote_gating = true): when
        # the caller signals that no vote is happening, a ready CNA
        # stays at DRAFT. REVIEW is reserved for the actual vote window.
        cna = _ready_cna()
        record = wrap_cve_record(
            cna,
            cve_id="CVE-2026-00001",
            org_id="org",
            release_vote_in_progress=False,
        )
        assert record["CNA_private"]["state"] == "DRAFT"

    def test_ready_record_gated_with_vote_emits_review(self):
        cna = _ready_cna()
        record = wrap_cve_record(
            cna,
            cve_id="CVE-2026-00001",
            org_id="org",
            release_vote_in_progress=True,
        )
        assert record["CNA_private"]["state"] == "REVIEW"

    def test_incomplete_record_emits_draft_workflow_state(self):
        cna = _ready_cna()
        cna["credits"] = []
        record = wrap_cve_record(cna, cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["state"] == "DRAFT"

    def test_vendor_advisory_reference_emits_public_workflow_state(self):
        cna = _ready_cna()
        cna["references"] = build_references(
            mailing_list_field="",
            pr_field="https://github.com/apache/airflow/pull/123",
            extra_urls=[
                "https://lists.apache.org/thread/abc123xyz789",
            ],
        )
        record = wrap_cve_record(cna, cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["state"] == "PUBLIC"

    def test_vendor_advisory_with_incomplete_fields_still_draft(self):
        # Even when the advisory URL is captured, an incomplete CNA
        # stays at DRAFT — PUBLIC requires the full review-ready set.
        cna = _ready_cna()
        cna["credits"] = []
        cna["references"] = build_references(
            mailing_list_field="",
            pr_field="https://github.com/apache/airflow/pull/123",
            extra_urls=[
                "https://lists.apache.org/thread/abc123xyz789",
            ],
        )
        record = wrap_cve_record(cna, cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["state"] == "DRAFT"

    def test_envelope_carries_cna_private_block(self):
        record = wrap_cve_record(_ready_cna(), cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["owner"] == "example"
        assert record["CNA_private"]["userslist"] == "users@example.apache.org"

    def test_emailed_is_none_in_draft_state(self):
        cna = _ready_cna()
        cna["credits"] = []
        record = wrap_cve_record(cna, cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["state"] == "DRAFT"
        assert record["CNA_private"]["emailed"] is None

    def test_emailed_is_none_in_review_state(self):
        record = wrap_cve_record(_ready_cna(), cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["state"] == "REVIEW"
        assert record["CNA_private"]["emailed"] is None

    def test_emailed_is_yes_in_public_state(self):
        cna = _ready_cna()
        cna["references"] = build_references(
            mailing_list_field="",
            pr_field="https://github.com/apache/airflow/pull/123",
            extra_urls=[
                "https://lists.apache.org/thread/abc123xyz789",
            ],
        )
        record = wrap_cve_record(cna, cve_id="CVE-2026-00001", org_id="org")
        assert record["CNA_private"]["state"] == "PUBLIC"
        assert record["CNA_private"]["emailed"] == "yes"


# ---------------------------------------------------------------------------
# compute_cna_private_state
# ---------------------------------------------------------------------------


class TestComputeCnaPrivateState:
    def test_ready_without_advisory_is_review(self):
        assert compute_cna_private_state(_ready_cna(), "CVE-2026-00001") == "REVIEW"

    def test_ready_with_advisory_is_public(self):
        cna = _ready_cna()
        cna["references"] = build_references(
            mailing_list_field="",
            pr_field="https://github.com/apache/airflow/pull/123",
            extra_urls=["https://lists.apache.org/thread/abc123xyz789"],
        )
        assert compute_cna_private_state(cna, "CVE-2026-00001") == "PUBLIC"

    def test_incomplete_is_draft(self):
        cna = _ready_cna()
        cna["credits"] = []
        assert compute_cna_private_state(cna, "CVE-2026-00001") == "DRAFT"

    def test_gated_without_vote_is_draft(self):
        # Tri-state: explicit False ⇒ DRAFT even when ready.
        assert (
            compute_cna_private_state(
                _ready_cna(),
                "CVE-2026-00001",
                release_vote_in_progress=False,
            )
            == "DRAFT"
        )

    def test_gated_with_vote_is_review(self):
        assert (
            compute_cna_private_state(
                _ready_cna(),
                "CVE-2026-00001",
                release_vote_in_progress=True,
            )
            == "REVIEW"
        )

    def test_gated_with_advisory_overrides_vote_flag(self):
        # Even when release_vote_in_progress=False, a vendor-advisory
        # reference promotes the state to PUBLIC. The PUBLIC transition
        # is not gated by the vote signal — once the advisory shipped,
        # the record IS public.
        cna = _ready_cna()
        cna["references"] = build_references(
            mailing_list_field="",
            pr_field="https://github.com/apache/airflow/pull/123",
            extra_urls=["https://lists.apache.org/thread/abc123xyz789"],
        )
        assert compute_cna_private_state(cna, "CVE-2026-00001", release_vote_in_progress=False) == "PUBLIC"


# ---------------------------------------------------------------------------
# compute_package_url
# ---------------------------------------------------------------------------


class TestComputePackageUrl:
    def test_pypi_python_org_returns_canonical_pypi_project_url(self):
        assert (
            compute_package_url("https://pypi.python.org", "apache-example")
            == "https://pypi.org/project/apache-example/"
        )

    def test_pypi_org_alias_also_supported(self):
        assert (
            compute_package_url("https://pypi.org", "apache-example")
            == "https://pypi.org/project/apache-example/"
        )

    def test_trailing_slash_is_tolerated(self):
        assert (
            compute_package_url("https://pypi.python.org/", "apache-example-project-foo")
            == "https://pypi.org/project/apache-example-project-foo/"
        )

    def test_unknown_collection_url_returns_none(self):
        assert compute_package_url("https://airflow.apache.org/", "apache-example-project-helm-chart") is None

    def test_empty_inputs_return_none(self):
        assert compute_package_url("", "apache-example") is None
        assert compute_package_url("https://pypi.python.org", "") is None


# ---------------------------------------------------------------------------
# format_version_range
# ---------------------------------------------------------------------------


class TestFormatVersionRange:
    def test_range_with_low_and_high(self):
        versions = [{"version": "2.0.0", "lessThan": "3.2.2", "status": "affected", "versionType": "semver"}]
        assert format_version_range(versions) == ">= 2.0.0, < 3.2.2"

    def test_open_lower_bound_uses_less_than_only(self):
        versions = [{"version": "0", "lessThan": "3.2.2", "status": "affected", "versionType": "semver"}]
        assert format_version_range(versions) == "< 3.2.2"

    def test_less_than_or_equal(self):
        versions = [
            {"version": "0", "lessThanOrEqual": "3.2.1", "status": "affected", "versionType": "semver"}
        ]
        assert format_version_range(versions) == "<= 3.2.1"

    def test_bare_single_version(self):
        versions = [{"version": "3.1.5", "status": "affected", "versionType": "semver"}]
        assert format_version_range(versions) == "3.1.5"

    def test_round_trip_through_parser(self):
        # parse_affected_versions(...) → format_version_range(...) should
        # reconstruct the original human-readable shape.
        for raw, expected in [
            (">= 2.0.0, < 3.2.2", ">= 2.0.0, < 3.2.2"),
            ("< 3.2.2", "< 3.2.2"),
            ("<= 3.2.1", "<= 3.2.1"),
            ("3.1.5", "3.1.5"),
        ]:
            parsed = parse_affected_versions(raw, version_start_override=None)
            assert format_version_range(parsed) == expected, raw

    def test_empty_input_returns_empty_string(self):
        assert format_version_range([]) == ""


# ---------------------------------------------------------------------------
# _build_attachment_body — the issue-body table above the embedded JSON
# ---------------------------------------------------------------------------


def _ready_cna_for_attachment() -> dict:
    """Same shape as _ready_cna(): affected[] entries as build_affected()
    actually emits them, i.e. carrying a packageURL rather than the legacy
    collectionURL / packageName pair."""
    return _ready_cna()


class TestBuildAttachmentBody:
    def test_metric_table_includes_title_state_and_size(self):
        cna = _ready_cna_for_attachment()
        body = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text='{"x": 1}',
            cna=cna,
            cna_private_state="REVIEW",
        )
        assert "| CVE ID | `CVE-2026-00001` |" in body
        assert "| Title | Example vulnerability |" in body
        assert "| Vulnogram state | `REVIEW` |" in body
        assert "| Affected packages | `apache-example` |" in body
        assert "| Size | 8 bytes |" in body

    def test_no_envelope_renders_state_placeholder(self):
        body = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text='{"x": 1}',
            cna=_ready_cna_for_attachment(),
            cna_private_state=None,
        )
        assert "| Vulnogram state | — (`--no-envelope`) |" in body

    def test_per_package_table_includes_project_url_and_versions(self):
        body = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text="{}",
            cna=_ready_cna_for_attachment(),
            cna_private_state="REVIEW",
        )
        assert "**Packages this JSON covers:**" in body
        assert "| # | Package | Product | Versions | Project URL |" in body
        assert (
            "| 1 | `apache-example` | Apache Example | `>= 3.0.0, < 3.2.0` | <https://pypi.org/project/apache-example/> |"
            in body
        )

    def test_per_package_table_renders_one_row_per_affected_entry(self):
        cna = _ready_cna_for_attachment()
        cna["affected"] = build_affected(
            "apache-example-project-foo <=6.5.0\napache-example-project-kerfluffle <=1.9.0",
            vendor="Apache Software Foundation",
            product="Apache Example",
            package_name="apache-example",
            collection_url="https://pypi.python.org",
            version_start=None,
        )
        body = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text="{}",
            cna=cna,
            cna_private_state="REVIEW",
        )
        assert (
            "| 1 | `apache-example-project-foo` | Apache Example Project Foo "
            "| `<= 6.5.0` | <https://pypi.org/project/apache-example-project-foo/> |"
        ) in body
        assert (
            "| 2 | `apache-example-project-kerfluffle` | Apache Example Project Kerfluffle "
            "| `<= 1.9.0` | <https://pypi.org/project/apache-example-project-kerfluffle/> |"
        ) in body
        assert (
            "| Affected packages | `apache-example-project-foo`, `apache-example-project-kerfluffle` |"
        ) in body

    def test_unknown_collection_url_renders_dash_in_url_column(self):
        cna = _ready_cna_for_attachment()
        cna["affected"] = [
            {
                "vendor": "Apache Software Foundation",
                "product": "Apache Example Helm Chart",
                "packageName": "apache-example-project-helm-chart",
                "collectionURL": "https://airflow.apache.org/",
                "versions": [
                    {"version": "0", "lessThan": "1.18.0", "status": "affected", "versionType": "semver"},
                ],
                "defaultStatus": "unaffected",
            }
        ]
        body = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text="{}",
            cna=cna,
            cna_private_state="REVIEW",
        )
        assert (
            "| 1 | `apache-example-project-helm-chart` | Apache Example Helm Chart | `< 1.18.0` | — |" in body
        )

    def test_pipe_in_title_is_escaped(self):
        cna = _ready_cna_for_attachment()
        cna["title"] = "Pipe | in | title"
        body = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text="{}",
            cna=cna,
            cna_private_state="REVIEW",
        )
        assert "| Title | Pipe \\| in \\| title |" in body

    def test_output_is_deterministic(self):
        first = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text='{"x": 1}',
            cna=_ready_cna_for_attachment(),
            cna_private_state="REVIEW",
        )
        second = _build_attachment_body(
            cve_id="CVE-2026-00001",
            json_text='{"x": 1}',
            cna=_ready_cna_for_attachment(),
            cna_private_state="REVIEW",
        )
        assert first == second


# ---------------------------------------------------------------------------
# combine_remediation_developers
# ---------------------------------------------------------------------------


class TestCombineRemediationDevelopers:
    def test_body_field_only(self):
        assert combine_remediation_developers("Alice Smith\nBob Jones", []) == [
            "Alice Smith",
            "Bob Jones",
        ]

    def test_cli_only(self):
        assert combine_remediation_developers("", ["Alice Smith"]) == ["Alice Smith"]

    def test_body_first_then_cli(self):
        assert combine_remediation_developers("Alice", ["Bob"]) == ["Alice", "Bob"]

    def test_duplicates_dropped_silently(self):
        # Body says Alice, CLI also says Alice — single credit, body order wins.
        assert combine_remediation_developers("Alice Smith\nBob Jones", ["Alice Smith", "Carol"]) == [
            "Alice Smith",
            "Bob Jones",
            "Carol",
        ]

    def test_no_response_field_treated_as_empty(self):
        # extract_field already collapses _No response_ to "" upstream; this
        # asserts the helper doesn't choke if a caller passes "" directly.
        assert combine_remediation_developers("", []) == []

    def test_full_name_affiliation_pattern_preserved(self):
        # Same parsing rule as Reporter credited as: "Name, Affiliation" is one credit.
        assert combine_remediation_developers("Jed Cunningham, Astronomer", []) == [
            "Jed Cunningham, Astronomer",
        ]


# ---------------------------------------------------------------------------
# normalise_severity
# ---------------------------------------------------------------------------


class TestNormaliseSeverity:
    def test_known_values_are_lowercased(self):
        for raw in ("None", "Low", "Moderate", "Medium", "High", "Important", "Critical"):
            assert normalise_severity(raw) == raw.lower()

    def test_already_lowercase_known_value_passes_through(self):
        assert normalise_severity("high") == "high"

    def test_unknown_value_is_stripped_but_not_changed(self):
        assert normalise_severity("  Informational  ") == "Informational"

    def test_mixed_case_known_value_normalised(self):
        assert normalise_severity("HIGH") == "high"
        assert normalise_severity("CRITICAL") == "critical"
        assert normalise_severity("MODERATE") == "moderate"
        assert normalise_severity("Important") == "important"


# ---------------------------------------------------------------------------
# to_html
# ---------------------------------------------------------------------------


class TestToHtml:
    def test_plain_text_is_returned_unchanged(self):
        assert to_html("Hello world") == "Hello world"

    def test_html_angle_brackets_are_escaped(self):
        assert to_html("<script>alert(1)</script>") == "&lt;script&gt;alert(1)&lt;/script&gt;"

    def test_ampersand_is_escaped(self):
        assert to_html("A & B") == "A &amp; B"

    def test_double_newlines_become_br_br(self):
        assert to_html("Para one.\n\nPara two.") == "Para one.<br><br>Para two."

    def test_single_newlines_become_br(self):
        assert to_html("Line one.\nLine two.") == "Line one.<br>Line two."

    def test_windows_line_endings_normalised_before_conversion(self):
        assert to_html("Line one.\r\nLine two.") == "Line one.<br>Line two."

    def test_mixed_newlines_in_multiline_text(self):
        result = to_html("Intro.\n\nBullet one.\nBullet two.")
        assert result == "Intro.<br><br>Bullet one.<br>Bullet two."


# -------------------------------------------------------