import { parseSecurityScanDetails } from './db-aggregate.js';
const SEVERITY_ORDER = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
/** CVE runtime blocking is opt-in — avoids false-positive storms from transitive dep scans. */
export function isCveGateEnabled() {
    return process.env.GUARDIAN_BLOCK_ON_CVE === 'true';
}
export async function evaluateCveGate(db, serverName) {
    if (!isCveGateEnabled()) {
        return { block: false };
    }
    const scan = await db.getLatestSecurityScan(serverName);
    if (!scan)
        return { block: false };
    const report = parseSecurityScanDetails(scan);
    if (!report?.cves?.length)
        return { block: false };
    // Default CRITICAL-only when gate is enabled (not HIGH — transitive HIGH CVEs are too noisy)
    const minSev = (process.env.GUARDIAN_CVE_BLOCK_SEVERITY || 'CRITICAL').toUpperCase();
    const minIdx = SEVERITY_ORDER.indexOf(minSev);
    const thresholdIdx = minIdx >= 0 ? minIdx : SEVERITY_ORDER.indexOf('CRITICAL');
    const blocking = report.cves.filter((c) => {
        const sev = String(c.severity || 'MEDIUM').toUpperCase();
        const idx = SEVERITY_ORDER.indexOf(sev);
        return idx >= thresholdIdx;
    });
    if (blocking.length === 0)
        return { block: false };
    const ids = blocking
        .slice(0, 5)
        .map((c) => c.id)
        .join(', ');
    const suffix = blocking.length > 5 ? ` (+${blocking.length - 5} more)` : '';
    return {
        block: true,
        cves: blocking,
        reason: `${blocking.length} CVE(s) at or above ${SEVERITY_ORDER[thresholdIdx]}: ${ids}${suffix}`,
    };
}
//# sourceMappingURL=cve-gate.js.map