#!/usr/bin/env python3
"""Fail closed on OSV findings or unavailable advisory service. No app runtime use."""
import json
from pathlib import Path
import re
import urllib.request

ROOT = Path(__file__).resolve().parents[1]
coordinates = set()
lockfile = ROOT / "android/app/gradle.lockfile"
assert lockfile.is_file(), "Generate the reviewed Gradle dependency lockfile before scanning."
for source in [ROOT / "android/app/build.gradle.kts", ROOT / "android/build.gradle.kts", lockfile,
               ROOT / "android/buildscript-gradle.lockfile"]:
    if source.exists():
        coordinates.update(re.findall(r'([\w.-]+:[\w.-]+:[\w.+-]+)(?:["=])', source.read_text()))
agp = re.search(r'id\("com.android.application"\) version "([^"]+)"', (ROOT / "android/build.gradle.kts").read_text())
assert agp, "Cannot determine Android build plugin version"
coordinates.add("com.android.tools.build:gradle:" + agp.group(1))
queries = [{"package": {"ecosystem": "Maven", "name": coordinate.rsplit(":", 1)[0]},
            "version": coordinate.rsplit(":", 1)[1]} for coordinate in sorted(coordinates)]
request = urllib.request.Request("https://api.osv.dev/v1/querybatch", method="POST",
                                 headers={"Content-Type": "application/json"},
                                 data=json.dumps({"queries": queries}).encode())
with urllib.request.urlopen(request, timeout=60) as response:
    results = json.load(response)["results"]
assert len(results) == len(queries)
findings = [(coordinate, [item["id"] for item in result.get("vulns", [])])
            for coordinate, result in zip(sorted(coordinates), results) if result.get("vulns")]
if findings:
    for coordinate, identifiers in findings:
        print(coordinate, ", ".join(identifiers))
    raise SystemExit("Dependency advisories require review and remediation before release.")
print(f"OSV: no listed advisories for {len(coordinates)} locked/direct Maven coordinates and build plugins.")