app.py

import requests
import sqlite3
import json
from datetime import datetime, timedelta, timezone
from flask import Flask, render_template, jsonify, request, send_from_directory
import threading
import time
from dataclasses import dataclass
from typing import List, Optional
import os
import re
from packaging import version
import difflib
from dotenv import load_dotenv
from concurrent.futures import ThreadPoolExecutor
import bcrypt
from flask_jwt_extended import create_access_token, get_jwt_identity, jwt_required, JWTManager

# Load environment variables from .env file
load_dotenv()

# Configuration
app = Flask(__name__, static_folder='static/dist')
app.config["JWT_SECRET_KEY"] = os.environ.get('JWT_SECRET_KEY', 'super-secret-key-for-dev')
app.config['JWT_ACCESS_TOKEN_EXPIRES'] = timedelta(days=1)
jwt = JWTManager(app)
NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"

# Environment variables are loaded from .env or the system environment
DATA_DIR = os.path.join(os.path.dirname(__file__), 'data')
os.makedirs(DATA_DIR, exist_ok=True)
DB_NAME = os.path.join(DATA_DIR, 'cve_database.db')
UPDATE_INTERVAL = int(os.environ.get('UPDATE_INTERVAL', 3600))  # Default to 1 hour

# NVD API key should be set in your .env file for better request rates.
# It can be used without a key, but with very low rate limits.
NVD_API_KEY = os.environ.get('NVD_API_KEY')  

@dataclass
class CVE:
    id: str
    description: str
    published_date: str
    last_modified: str
    severity: str
    cvss_score: Optional[float]
    references: List[str]

class CVEMonitor:
    def __init__(self):
        self.init_db()
        self.create_default_user()
        self.create_indexes()
        self.api_key = NVD_API_KEY
        
    def init_db(self):
        """Initializes the SQLite database"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS cves (
                id TEXT PRIMARY KEY,
                description TEXT,
                published_date TEXT,
                last_modified TEXT,
                severity TEXT,
                cvss_score REAL,
                reference_urls TEXT,
                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
            )
        ''')
        
        # Table to track fetching progress
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS sync_status (
                id INTEGER PRIMARY KEY,
                last_full_sync TEXT,
                last_update TEXT,
                total_cves INTEGER,
                status TEXT
            )
        ''')
        
        # Table for users
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS users (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                username TEXT UNIQUE NOT NULL,
                password_hash TEXT NOT NULL,
                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
            )
        ''')

        conn.commit()
        conn.close()
    
    def create_indexes(self):
        """Create indexes to optimize queries"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        
        # Index for searching and sorting
        cursor.execute('CREATE INDEX IF NOT EXISTS idx_published_date ON cves(published_date DESC)')
        cursor.execute('CREATE INDEX IF NOT EXISTS idx_severity ON cves(severity)')
        cursor.execute('CREATE INDEX IF NOT EXISTS idx_cvss_score ON cves(cvss_score DESC)')
        cursor.execute('CREATE INDEX IF NOT EXISTS idx_cve_id ON cves(id)')
        cursor.execute('CREATE INDEX IF NOT EXISTS idx_search ON cves(id, description)')
        
        conn.commit()
        conn.close()

    def create_default_user(self):
        """Creates a default admin user if no users exist."""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        cursor.execute("SELECT COUNT(*) FROM users")
        user_count = cursor.fetchone()[0]

        if user_count == 0:
            username = os.environ.get('ADMIN_USER', 'admin')
            password = os.environ.get('ADMIN_PASSWORD', 'password')
            
            if not username or not password or password == 'password':
                print("WARNING: ADMIN_USER and ADMIN_PASSWORD environment variables are not set or are default. Cannot create default user.")
                conn.close()
                return

            hashed_password = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
            
            cursor.execute("INSERT INTO users (username, password_hash) VALUES (?, ?)", (username, hashed_password.decode('utf-8')))
            conn.commit()
            print(f"✅ Created default admin user: {username}")
        
        conn.close()
    
    def fetch_cves_with_api_key(self, params):
        """Performs a request with the API key"""
        headers = {}
        if self.api_key and self.api_key != 'YOUR_API_KEY_HERE':
            headers['apiKey'] = self.api_key
            
        try:
            response = requests.get(NVD_API_URL, params=params, headers=headers, timeout=60)
            
            if response.status_code == 403:
                print("⚠️ Rate limit reached. Pausing for 30 seconds...")
                time.sleep(30)
                return None
                
            response.raise_for_status()
            return response.json()
            
        except requests.exceptions.RequestException as e:
            print(f"Error during fetch: {e}")
            return None
    
    def fetch_all_cves_historical(self):
        """Fetches ALL historical CVEs progressively"""
        print("="*60)
        print("🚀 Starting complete CVE fetch")
        print("="*60)
        
        # Mettre à jour le statut
        self.update_sync_status('running', 'Fetching in progress...')
        
        current_year = datetime.now().year
        total_processed = 0
        
        # If we have an API key, we can make larger requests
        if self.api_key and self.api_key != 'YOUR_API_KEY_HERE':
            print("✅ API key detected - Optimized fetching")
            results_per_page = 2000
            sleep_time = 0.7  # With API key: up to 50 requests/30s
        else:
            print("⚠️ No API key - Slow fetching")
            results_per_page = 1000
            sleep_time = 6  # Without API key: 5 requests/30s
        
        # Fetch year by year, month by month
        for year in range(current_year, 1998, -1):  # CVEs since 1999
            print(f"\n📅 Processing year {year}...")
            year_count = 0
            
            for month in range(12, 0, -1):
                # For the current year, do not go past the current month
                if year == current_year and month > datetime.now().month:
                    continue
                
                start_date = datetime(year, month, 1)
                
                # Calculate the last day of the month
                if month == 12:
                    end_date = datetime(year, 12, 31, 23, 59, 59)
                else:
                    end_date = datetime(year, month + 1, 1) - timedelta(seconds=1)
                
                # Handle pagination
                start_index = 0
                month_total = 0
                
                while True:
                    params = {
                        'pubStartDate': start_date.strftime('%Y-%m-%dT00:00:00.000'),
                        'pubEndDate': end_date.strftime('%Y-%m-%dT23:59:59.999'),
                        'startIndex': start_index,
                        'resultsPerPage': results_per_page
                    }
                    
                    data = self.fetch_cves_with_api_key(params)
                    
                    if not data:
                        print(f"  ❌ Error for {year}/{month:02d}")
                        break
                    
                    vulnerabilities = data.get('vulnerabilities', [])
                    total_results = data.get('totalResults', 0)
                    
                    # Save CVEs
                    for vuln in vulnerabilities:
                        try:
                            cve = self.parse_cve_data(vuln)
                            self.save_cve(cve)
                            month_total += 1
                        except Exception as e:
                            print(f"    Error parsing CVE: {e}")
                    
                    print(f"  📊 {year}/{month:02d}: {month_total}/{total_results} CVEs saved", end='\r')
                    
                    # Check if there are more results
                    start_index += results_per_page
                    if start_index >= total_results:
                        print(f"  ✅ {year}/{month:02d}: {month_total} CVEs saved in total")
                        break
                    
                    # Pause between requests
                    time.sleep(sleep_time)
                
                year_count += month_total
                total_processed += month_total
                
                # Update status periodically
                if month % 3 == 0:
                    self.update_sync_status('running', f'Year {year} - {total_processed} CVEs processed')
            
            print(f"📊 Year {year} finished: {year_count} CVEs fetched")
        
        # Final status update
        self.update_sync_status('completed', f'Fetch complete - {total_processed} CVEs')
        
        print(f"\n{'='*60}")
        print(f"\n{'='*60}\n✅ Full fetch complete!\n📊 Total: {total_processed} CVEs fetched\n{'='*60}\n")
        print(f"{'='*60}\n")
        
        return total_processed
    
    def fetch_recent_cves(self, hours_back=2):
        """Fetches CVEs from the last X hours (for updates)"""
        end_date = datetime.now()
        start_date = end_date - timedelta(hours=hours_back)
        
        params = {
            'lastModStartDate': start_date.strftime('%Y-%m-%dT%H:%M:%S.000'),
            'lastModEndDate': end_date.strftime('%Y-%m-%dT%H:%M:%S.999'),
            'resultsPerPage': 2000
        }
        
        return self.fetch_cves_with_api_key(params)
    
    def update_recent_cves(self):
        """Updates with recent CVEs (called hourly)"""
        print(f"\n🔄 Hourly update - {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
        
        # Fetch CVEs modified in the last 2 hours
        data = self.fetch_recent_cves(hours_back=2)
        
        if data and 'vulnerabilities' in data:
            count = 0
            for item in data['vulnerabilities']:
                try:
                    cve = self.parse_cve_data(item)
                    self.save_cve(cve)
                    count += 1
                except Exception as e:
                    print(f"Error processing CVE: {e}")
            
            print(f"✅ {count} CVEs updated")
            self.update_sync_status('active', f'Last update: {datetime.now().isoformat()}')
        else:
            print("ℹ️ No updates available")
    
    def parse_cve_data(self, cve_item):
        """Parses CVE data from the API response"""
        cve_id = cve_item['cve']['id']
        
        # Description
        descriptions = cve_item['cve'].get('descriptions', [])
        description = descriptions[0]['value'] if descriptions else 'No description'
        
        # Dates
        published = cve_item['cve']['published']
        modified = cve_item['cve']['lastModified']
        
        # CVSS Score and severity
        cvss_score = None
        severity = 'UNKNOWN'
        
        metrics = cve_item['cve'].get('metrics', {})
        if 'cvssMetricV31' in metrics and metrics['cvssMetricV31']:
            cvss_data = metrics['cvssMetricV31'][0]['cvssData']
            cvss_score = cvss_data['baseScore']
            severity = cvss_data['baseSeverity']
        elif 'cvssMetricV2' in metrics and metrics['cvssMetricV2']:
            cvss_data = metrics['cvssMetricV2'][0]['cvssData']
            cvss_score = cvss_data['baseScore']
            severity = self.score_to_severity(cvss_score)
        
        # References
        references = []
        for ref in cve_item['cve'].get('references', []):
            references.append(ref['url'])
        
        return CVE(
            id=cve_id,
            description=description,
            published_date=published,
            last_modified=modified,
            severity=severity,
            cvss_score=cvss_score,
            references=references
        )
    
    def score_to_severity(self, score):
        """Converts a CVSS score to a severity level"""
        if score >= 9.0:
            return 'CRITICAL'
        elif score >= 7.0:
            return 'HIGH'
        elif score >= 4.0:
            return 'MEDIUM'
        elif score >= 0.1:
            return 'LOW'
        return 'NONE'
    
    def save_cve(self, cve: CVE):
        """Saves a CVE to the database"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        
        cursor.execute('''
            INSERT OR REPLACE INTO cves 
            (id, description, published_date, last_modified, severity, cvss_score, reference_urls)
            VALUES (?, ?, ?, ?, ?, ?, ?)
        ''', (
            cve.id,
            cve.description,
            cve.published_date,
            cve.last_modified,
            cve.severity,
            cve.cvss_score,
            json.dumps(cve.references)
        ))
        
        conn.commit()
        conn.close()
    
    def update_sync_status(self, status, message):
        """Updates the synchronization status"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        
        cursor.execute('SELECT COUNT(*) FROM cves')
        total_cves = cursor.fetchone()[0]
        
        cursor.execute('''
            INSERT OR REPLACE INTO sync_status (id, last_full_sync, last_update, total_cves, status)
            VALUES (1, ?, ?, ?, ?)
        ''', (
            datetime.now().isoformat() if status == 'completed' else None,
            datetime.now().isoformat(),
            total_cves,
            message
        ))
        
        conn.commit()
        conn.close()
    
    def get_sync_status(self):
        """Gets the synchronization status"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        
        cursor.execute('SELECT * FROM sync_status WHERE id = 1')
        row = cursor.fetchone()
        
        if row:
            return {
                'last_full_sync': row[1],
                'last_update': row[2],
                'total_cves': row[3],
                'status': row[4]
            }
        
        return None
    
    def get_recent_cves(self, limit=50, offset=0, search_term=None, sort_by='published_date', sort_order='DESC'):
        """Gets CVEs with pagination and sorting"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        
        # Allowed columns for sorting (security)
        allowed_sort_columns = {
            'id': 'id',
            'description': 'description',
            'severity': 'severity',
            'cvss_score': 'cvss_score',
            'published_date': 'published_date'
        }
        
        # Validate sort column
        if sort_by not in allowed_sort_columns:
            sort_by = 'published_date'
        
        # Validate sort order
        if sort_order.upper() not in ['ASC', 'DESC']:
            sort_order = 'DESC'
        
        # Build query with search
        base_query = "FROM cves"
        where_clause = ""
        params = []
        
        if search_term:
            where_clause = " WHERE id LIKE ? OR description LIKE ? OR severity LIKE ?"
            params = [f'%{search_term}%', f'%{search_term}%', f'%{search_term}%']
        
        # Count total for pagination
        count_query = f"SELECT COUNT(*) {base_query}{where_clause}"
        cursor.execute(count_query, params)
        total_count = cursor.fetchone()[0]
        
        # Main query with sorting and pagination
        if sort_by == 'severity':
            order_clause = f"""
            ORDER BY 
                CASE severity 
                    WHEN 'CRITICAL' THEN 1 
                    WHEN 'HIGH' THEN 2 
                    WHEN 'MEDIUM' THEN 3 
                    WHEN 'LOW' THEN 4 
                    ELSE 5 
                END {sort_order},
                published_date DESC
            """
        else:
            order_clause = f" ORDER BY {allowed_sort_columns[sort_by]} {sort_order}"
        
        select_query = f"""
            SELECT * {base_query}{where_clause}
            {order_clause}
            LIMIT ? OFFSET ?
        """
        
        params.extend([limit, offset])
        cursor.execute(select_query, params)
        
        cves = []
        for row in cursor.fetchall():
            cves.append({
                'id': row[0],
                'description': row[1],
                'published_date': row[2],
                'last_modified': row[3],
                'severity': row[4],
                'cvss_score': row[5],
                'references': json.loads(row[6]) if row[6] else []
            })
        
        conn.close()
        
        return {
            'cves': cves,
            'total': total_count,
            'page': offset // limit + 1,
            'pages': (total_count + limit - 1) // limit,
            'limit': limit
        }
    
    def get_cve_details(self, cve_id):
        """Fetches full details for a single CVE, including PoCs and Nuclei status."""
        print(f"DEBUG: get_cve_details called with cve_id: '{cve_id}'")
        conn = sqlite3.connect(DB_NAME)
        conn.row_factory = sqlite3.Row
        cursor = conn.cursor()
        
        cursor.execute("SELECT * FROM cves WHERE id = ?", (cve_id,))
        cve_row = cursor.fetchone()
        
        if not cve_row:
            print(f"DEBUG: CVE with id '{cve_id}' not found in database.")
            conn.close()
            return None

        print(f"DEBUG: Found CVE '{cve_id}' in database.")
        cve_data = dict(cve_row)
        cve_data['references'] = json.loads(cve_data.get('reference_urls', '[]'))
        
        # Asynchronously fetch PoCs and Nuclei status
        with ThreadPoolExecutor(max_workers=2) as executor:
            future_pocs = executor.submit(self.search_github_poc, cve_id)
            future_nuclei = executor.submit(self.has_nuclei_template_online, cve_id)
            
            pocs_result = future_pocs.result()
            nuclei_result = future_nuclei.result()

        cve_data['pocs'] = pocs_result.get('items', [])
        cve_data['nuclei_template'] = nuclei_result
        
        # Ensure cvss_vector is present, even if null
        if 'cvss_vector' not in cve_data:
            cve_data['cvss_vector'] = None

        conn.close()
        return cve_data
    
    def search_specific_cve(self, cve_id):
        """Searches for a specific CVE in the NVD API"""
        params = {'cveId': cve_id}
        data = self.fetch_cves_with_api_key(params)
        
        if data and 'vulnerabilities' in data and len(data['vulnerabilities']) > 0:
            cve = self.parse_cve_data(data['vulnerabilities'][0])
            self.save_cve(cve)
            return cve
        return None
    
    def search_github_poc(self, cve_id):
        """Searches for PoCs on GitHub via the API"""
        try:
            headers = {
                'Accept': 'application/vnd.github.v3+json',
                'User-Agent': 'CVE-Monitor'
            }
            
            # Optional GitHub token to increase rate limit
            github_token = os.environ.get('GITHUB_TOKEN', '')
            if github_token:
                headers['Authorization'] = f'token {github_token}'
            
            # Search for the CVE in repos
            search_query = f"{cve_id} in:name,description,readme"
            url = f"https://api.github.com/search/repositories?q={search_query}&sort=stars&order=desc&per_page=10"
            
            response = requests.get(url, headers=headers, timeout=10)
            
            if response.status_code == 200:
                data = response.json()
                repos = []
                
                for repo in data.get('items', []):
                    repos.append({
                        'name': repo['full_name'],
                        'url': repo['html_url'],
                        'description': repo.get('description', ''),
                        'stars': repo['stargazers_count'],
                        'language': repo.get('language', 'Unknown'),
                        'updated': repo['updated_at']
                    })
                
                # Also search in code
                code_url = f"https://api.github.com/search/code?q={cve_id}+extension:py+extension:sh+extension:c+extension:cpp&per_page=5"
                code_response = requests.get(code_url, headers=headers, timeout=10)
                
                code_results = []
                if code_response.status_code == 200:
                    code_data = code_response.json()
                    for item in code_data.get('items', []):
                        code_results.append({
                            'filename': item['name'],
                            'path': item['path'],
                            'repo': item['repository']['full_name'],
                            'url': item['html_url']
                        })
                
                return {
                    'repos': repos,
                    'code': code_results,
                    'total_repos': data.get('total_count', 0)
                }
            else:
                return {'repos': [], 'code': [], 'error': f'GitHub API: {response.status_code}'}
                
        except Exception as e:
            print(f"Erreur recherche GitHub: {e}")
            return {'repos': [], 'code': [], 'error': str(e)}

    def has_nuclei_template_online(self, cve_id: str) -> bool:
        """Vérifie si un template Nuclei existe pour un CVE sur GitHub"""
        url = f"https://api.github.com/search/code?q={cve_id}+repo:projectdiscovery/nuclei-templates"
        headers = {
            'Accept': 'application/vnd.github.v3+json',
            'User-Agent': 'CVE-Monitor'
        }

        token = os.environ.get('GITHUB_TOKEN')
        if token:
            headers['Authorization'] = f'token {token}'

        try:
            response = requests.get(url, headers=headers, timeout=10)
            if response.status_code == 200:
                data = response.json()
                return data.get('total_count', 0) > 0
            else:
                print(f"[GitHub] Erreur {response.status_code} pour {cve_id}")
        except Exception as e:
            print(f"[GitHub] Exception lors de la recherche Nuclei : {e}")

        return False

    def get_statistics(self):
        """Calcule les statistiques sur les CVE"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()

        # Total des CVE
        cursor.execute('SELECT COUNT(*) FROM cves')
        total = cursor.fetchone()[0]

        # CVE par sévérité
        cursor.execute('''
            SELECT severity, COUNT(*) 
            FROM cves 
            GROUP BY severity
        ''')
        severity_stats = dict(cursor.fetchall())

        # CVE des 30 derniers jours
        thirty_days_ago = (datetime.now() - timedelta(days=30)).isoformat()
        cursor.execute('''
            SELECT COUNT(*) 
            FROM cves 
            WHERE published_date >= ?
        ''', (thirty_days_ago,))
        recent_30 = cursor.fetchone()[0]

        # CVE des 7 derniers jours
        seven_days_ago = (datetime.now() - timedelta(days=7)).isoformat()
        cursor.execute('''
            SELECT COUNT(*) 
            FROM cves 
            WHERE published_date >= ?
        ''', (seven_days_ago,))
        recent_7 = cursor.fetchone()[0]

        conn.close()

        return {
            'total': total,
            'severity': severity_stats,
            'recent_30days': recent_30,
            'recent_7days': recent_7,
            'critical': severity_stats.get('CRITICAL', 0),
            'high': severity_stats.get('HIGH', 0)
        }

    # === MÉTHODES POUR LA RECHERCHE INVERSÉE ===
    
    def search_by_product_version(self, product_name, product_version=None):
        """Recherche inversée : trouve tous les CVE pour un produit/version spécifique"""
        conn = sqlite3.connect(DB_NAME)
        cursor = conn.cursor()
        
        # Normaliser le nom du produit
        normalized_product = self._normalize_product_name(product_name)
        
        # Recherche de base par nom de produit
        query = """
            SELECT * FROM cves 
            WHERE LOWER(description) LIKE ?
            ORDER BY published_date DESC
        """
        
        cursor.execute(query, (f'%{normalized_product}%',))
        all_results = cursor.fetchall()
        
        # Convertir en dictionnaires
        cves = []
        for row in all_results:
            cve_dict = {
                'id': row[0],
                'description': row[1],
                'published_date': row[2],
                'last_modified': row[3],
                'severity': row[4],
                'cvss_score': row[5],
                'references': json.loads(row[6]) if row[6] else [],
                'affected_versions': []
            }
            
            # Extraire les versions affectées de la description
            if product_version:
                versions = self._extract_versions_from_description(cve_dict['description'], normalized_product)
                cve_dict['affected_versions'] = versions
                
                # Vérifier si la version spécifiée est affectée
                if self._is_version_affected(product_version, versions, cve_dict['description']):
                    cve_dict['version_match'] = True
                    cves.append(cve_dict)
            else:
                # Si pas de version spécifiée, retourner tous les CVE du produit
                versions = self._extract_versions_from_description(cve_dict['description'], normalized_product)
                cve_dict['affected_versions'] = versions
                cves.append(cve_dict)
        
        conn.close()
        
        # Analyser et enrichir les résultats
        return self._enrich_search_results(cves, product_name, product_version)
    
    def _normalize_product_name(self, product_name):
        """Normalise le nom du produit pour la recherche"""
        # Dictionnaire de correspondances communes
        aliases = {
            'httpd': 'apache',
            'apache httpd': 'apache',
            'apache http server': 'apache',
            'nginx server': 'nginx',
            'mariadb': 'mysql',
            'postgresql': 'postgres',
            'ms windows': 'windows',
            'microsoft windows': 'windows',
            'rhel': 'red hat',
            'centos': 'red hat',
            'ubuntu linux': 'ubuntu',
            'k8s': 'kubernetes'
        }
        
        normalized = product_name.lower().strip()
        
        # Vérifier les alias
        for alias, canonical in aliases.items():
            if alias in normalized:
                normalized = normalized.replace(alias, canonical)
        
        return normalized
    
    def _extract_versions_from_description(self, description, product_name):
        """Extrait les versions mentionnées dans la description"""
        versions = []
        desc_lower = description.lower()
        
        # Patterns pour détecter les versions
        version_patterns = [
            # Pattern "product version X.Y.Z"
            rf'{product_name}\s+(?:version\s+)?(\d+(?:\.\d+)*(?:\.\w+)?)',
            # Pattern "product < X.Y.Z" ou "> X.Y.Z"
            rf'{product_name}\s*[<>]=?\s*(\d+(?:\.\d+)*)',
            # Pattern "versions X.Y through X.Y"
            rf'versions?\s+(\d+(?:\.\d+)*)\s+through\s+(\d+(?:\.\d+)*)',
            # Pattern "before version X.Y.Z"
            rf'before\s+(?:version\s+)?(\d+(?:\.\d+)*)',
            # Pattern "prior to X.Y.Z"
            rf'prior\s+to\s+(\d+(?:\.\d+)*)',
            # Pattern générique pour version avec préfixe 'v'
            rf'{product_name}.*?v(\d+(?:\.\d+)*)'
        ]
        
        for pattern in version_patterns:
            matches = re.finditer(pattern, desc_lower)
            for match in matches:
                if match.groups():
                    for group in match.groups():
                        if group:
                            versions.append(group)
        
        # Recherche de plages de versions
        range_match = re.search(r'(\d+(?:\.\d+)*)\s*(?:to|-|through)\s*(\d+(?:\.\d+)*)', desc_lower)
        if range_match:
            versions.append(f"{range_match.group(1)}-{range_match.group(2)}")
        
        return list(set(versions))  # Supprimer les doublons
    
    def _is_version_affected(self, user_version, affected_versions, description):
        """Vérifie si la version de l'utilisateur est affectée"""
        desc_lower = description.lower()
        
        # Gestion des cas spéciaux
        if 'all versions' in desc_lower:
            return True
        
        try:
            user_ver = version.parse(user_version)
        except:
            # Si la version n'est pas parsable, faire une comparaison de chaînes
            return any(user_version in v for v in affected_versions)
        
        for affected in affected_versions:
            # Gestion des plages de versions
            if '-' in affected:
                start, end = affected.split('-')
                try:
                    if version.parse(start) <= user_ver <= version.parse(end):
                        return True
                except:
                    pass
            
            # Vérifier les mentions "before", "prior to", etc.
            if re.search(rf'before\s+(?:version\s+)?{re.escape(affected)}', desc_lower):
                try:
                    if user_ver < version.parse(affected):
                        return True
                except:
                    pass
            
            # Vérifier les mentions "through"
            if re.search(rf'through\s+{re.escape(affected)}', desc_lower):
                try:
                    if user_ver <= version.parse(affected):
                        return True
                except:
                    pass
            
            # Comparaison exacte
            try:
                if user_ver == version.parse(affected):
                    return True
            except:
                if user_version == affected:
                    return True
        
        return False
    
    def _enrich_search_results(self, cves, product_name, product_version):
        """Enrichit les résultats avec des métadonnées supplémentaires"""
        results = {
            'product': product_name,
            'version': product_version,
            'total_cves': len(cves),
            'cves': cves,
            'statistics': {
                'critical': sum(1 for c in cves if c['severity'] == 'CRITICAL'),
                'high': sum(1 for c in cves if c['severity'] == 'HIGH'),
                'medium': sum(1 for c in cves if c['severity'] == 'MEDIUM'),
                'low': sum(1 for c in cves if c['severity'] == 'LOW')
            }
        }
        
        # Si une version est spécifiée, ajouter des recommandations
        if product_version:
            results['recommendations'] = self._generate_recommendations(cves, product_name, product_version)
        
        return results
    
    def _generate_recommendations(self, cves, product_name, product_version):
        """Génère des recommandations basées sur les CVE trouvés"""
        recommendations = []
        
        if not cves:
            recommendations.append({
                'type': 'info',
                'message': f"Aucune vulnérabilité connue pour {product_name} {product_version}"
            })
            return recommendations
        
        # Analyser la sévérité
        critical_count = sum(1 for c in cves if c['severity'] == 'CRITICAL')
        high_count = sum(1 for c in cves if c['severity'] == 'HIGH')
        
        if critical_count > 0:
            recommendations.append({
                'type': 'critical',
                'message': f"{critical_count} vulnérabilité(s) CRITIQUE(S) détectée(s) ! Mise à jour urgente recommandée."
            })
        
        if high_count > 0:
            recommendations.append({
                'type': 'warning',
                'message': f"{high_count} vulnérabilité(s) de sévérité HAUTE. Planifier une mise à jour rapidement."
            })
        
        # Vérifier l'âge des CVE
        recent_cves = [c for c in cves if self._is_recent_cve(c['published_date'], days=30)]
        if recent_cves:
            recommendations.append({
                'type': 'info',
                'message': f"{len(recent_cves)} vulnérabilité(s) découverte(s) dans les 30 derniers jours."
            })
        
        # Suggérer la dernière version sûre connue
        safe_version = self._find_safe_version(cves, product_name, product_version)
        if safe_version:
            recommendations.append({
                'type': 'success',
                'message': f"Version recommandée : {safe_version} ou supérieure"
            })
        
        return recommendations
    
    def _is_recent_cve(self, published_date, days=30):
        """Vérifie si un CVE est récent"""
        try:
            pub_date = datetime.fromisoformat(published_date.replace('Z', '+00:00'))
            return (datetime.now(timezone.utc) - pub_date).days <= days
        except:
            return False
    
    def _find_safe_version(self, cves, product_name, current_version):
        """Essaie de déterminer une version sûre basée sur les CVE"""
        # Cette fonction pourrait être améliorée avec une base de données
        # de versions ou une API externe
        all_affected_versions = []
        for cve in cves:
            all_affected_versions.extend(cve.get('affected_versions', []))
        
        # Logique simplifiée : suggérer la dernière version majeure + 1
        try:
            curr_ver = version.parse(current_version)
            if hasattr(curr_ver, 'major'):
                return f"{curr_ver.major + 1}.0.0"
        except:
            pass
        
        return None

monitor = CVEMonitor()

# =================================================================
# API Routes
# =================================================================

# Auth routes
@app.route('/api/register', methods=['POST'])
def register():
    """Registers a new user."""
    username = request.json.get('username', None)
    password = request.json.get('password', None)

    if not username or not password:
        return jsonify({"msg": "Missing username or password"}), 400
    
    if len(password) < 8:
        return jsonify({"msg": "Password must be at least 8 characters"}), 400

    conn = sqlite3.connect(DB_NAME)
    cursor = conn.cursor()
    
    cursor.execute("SELECT id FROM users WHERE username = ?", (username,))
    if cursor.fetchone():
        conn.close()
        return jsonify({"msg": "Username already exists"}), 409

    hashed_password = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
    
    cursor.execute("INSERT INTO users (username, password_hash) VALUES (?, ?)", 
                   (username, hashed_password.decode('utf-8')))
    conn.commit()
    conn.close()

    return jsonify({"msg": "User created successfully"}), 201

@app.route('/api/login', methods=['POST'])
def login():
    """Authenticates a user and returns a JWT."""
    username = request.json.get('username', None)
    password = request.json.get('password', None)
    
    if not username or not password:
        return jsonify({"msg": "Missing username or password"}), 400

    conn = sqlite3.connect(DB_NAME)
    conn.row_factory = sqlite3.Row
    cursor = conn.cursor()
    cursor.execute("SELECT password_hash FROM users WHERE username = ?", (username,))
    user_row = cursor.fetchone()
    conn.close()
    
    if user_row and bcrypt.checkpw(password.encode('utf-8'), user_row['password_hash'].encode('utf-8')):
        access_token = create_access_token(identity=username)
        return jsonify(access_token=access_token)
        
    return jsonify({"msg": "Bad username or password"}), 401

@app.route("/api/profile")
@jwt_required()
def profile():
    """Returns the current user's identity and details."""
    current_user_username = get_jwt_identity()
    
    conn = sqlite3.connect(DB_NAME)
    conn.row_factory = sqlite3.Row
    cursor = conn.cursor()
    
    cursor.execute("SELECT id, username, created_at FROM users WHERE username = ?", (current_user_username,))
    user_row = cursor.fetchone()
    conn.close()
    
    if not user_row:
        return jsonify({"msg": "User not found"}), 404
        
    return jsonify({
        "id": user_row["id"],
        "username": user_row["username"],
        "created_at": user_row["created_at"]
    }), 200





# Route to serve the Svelte frontend and other static files
@app.route('/', defaults={'path': ''})
@app.route('/<path:path>')
def catch_all(path):
    """
    Catches all routes. If the path is a file in the static folder, it serves it.
    Otherwise, it serves the index.html for client-side routing.
    """
    # The static folder is now 'static/dist'
    dist_dir = app.static_folder
    
    # If the requested path is a file, serve it
    if path != "" and os.path.exists(os.path.join(dist_dir, path)):
        return send_from_directory(dist_dir, path)
    
    # Otherwise, serve the Svelte app's index.html for client-side routing
    return send_from_directory(dist_dir, 'index.html')


@app.route('/api/docs')
def api_docs():
    """API documentation endpoint"""
    docs = {
        'endpoints': {
            '/api/cves': {
                'method': 'GET',
                'description': 'Get CVEs with pagination', 
                'params': {
                    'page': 'Page number (default: 1)',
                    'limit': 'Results per page (default: 50, max: 200)',
                    'search': 'Search term',
                    'sort_by': 'Sort field (id, description, severity, cvss_score, published_date)',
                    'sort_order': 'Sort direction (ASC/DESC)'
                }
            },
            '/api/stats': {
                'method': 'GET',
                'description': 'Get CVE statistics'
            },
            '/api/sync-status': {
                'method': 'GET', 
                'description': 'Get synchronization status'
            },
            '/api/search_nvd/<cve_id>': {
                'method': 'GET',
                'description': 'Search specific CVE in NVD',
                'params': {
                    'cve_id': 'CVE ID (e.g. CVE-2021-44228)'
                }
            },
            '/api/github/<cve_id>': {
                'method': 'GET',
                'description': 'Search for PoCs on GitHub',
                'params': {
                    'cve_id': 'CVE ID to search for'
                }
            },
            '/api/update': {
                'method': 'POST',
                'description': 'Force update of recent CVEs'
            },
            '/api/full-sync': {
                'method': 'POST',
                'description': 'Start full CVE synchronization'
            },
            '/api/nuclei/<cve_id>': {
                'method': 'GET',
                'description': 'Check if Nuclei template exists',
                'params': {
                    'cve_id': 'CVE ID to check'
                }
            },
            '/api/reverse-search': {
                'method': 'POST',
                'description': 'Search CVEs by product/version',
                'body': {
                    'product': 'Product name (required)',
                    'version': 'Product version (optional)'
                }
            },
            '/api/products/autocomplete': {
                'method': 'GET',
                'description': 'Get product name suggestions',
                'params': {
                    'q': 'Search query (min 2 chars)'
                }
            }
        }
    }
    return jsonify(docs)

@app.route('/api/cves')
@jwt_required()
def api_cves():
    """API endpoint pour récupérer les CVE avec pagination"""
    page = int(request.args.get('page', 1))
    limit = min(int(request.args.get('limit', 50)), 200)
    offset = (page - 1) * limit
    search = request.args.get('search', '')
    sort_by = request.args.get('sort_by', 'published_date')
    sort_order = request.args.get('sort_order', 'DESC')
    
    result = monitor.get_recent_cves(
        limit=limit,
        offset=offset,
        search_term=search if search else None,
        sort_by=sort_by,
        sort_order=sort_order
    )
    return jsonify(result)

@app.route('/api/cve/<cve_id>')
@jwt_required()
def get_cve_details_route(cve_id):
    """
    Returns full details for a single CVE.
    """
    # This function will fetch CVE details from the database
    # and also get PoCs and check for Nuclei templates.
    cve_details = monitor.get_cve_details(cve_id)
    if cve_details:
        return jsonify(cve_details)
    return jsonify({'error': 'CVE not found'}), 404

@app.route('/api/<path:path>')
def proxy_request(path):
    """
    A proxy to bypass CORS issues during development.
    """
    url = f'https://{path}'
    try:
        response = requests.get(url)
        return response.content, response.status_code, response.headers.items()
    except requests.exceptions.RequestException as e:
        return str(e), 500

@app.route('/api/stats')
@jwt_required()
def api_stats():
    """API endpoint for statistics"""
    stats = monitor.get_statistics()
    return jsonify(stats)

@app.route('/api/sync-status')
@jwt_required()
def api_sync_status():
    """API endpoint for synchronization status"""
    status = monitor.get_sync_status()
    return jsonify(status if status else {'status': 'no sync data'})

@app.route('/api/search_nvd/<cve_id>')
def api_search_nvd(cve_id):
    """Searches for a specific CVE in NVD"""
    cve = monitor.search_specific_cve(cve_id)
    if cve:
        return jsonify({
            'success': True,
            'cve': {
                'id': cve.id,
                'description': cve.description,
                'published_date': cve.published_date,
                'last_modified': cve.last_modified,
                'severity': cve.severity,
                'cvss_score': cve.cvss_score,
                'references': cve.references
            }
        })
    return jsonify({'success': False, 'message': 'CVE not found in NVD'})

@app.route('/api/github/<cve_id>') 
def api_github(cve_id):
    """Searches for PoCs on GitHub"""
    results = monitor.search_github_poc(cve_id)
    return jsonify(results)

@app.route('/api/update', methods=['POST'])
@jwt_required()
def api_update():
    """Forces an update of recent CVEs"""
    monitor.update_recent_cves()
    return jsonify({'status': 'success', 'message': 'Update started'})

@app.route('/api/full-sync', methods=['POST'])
@jwt_required()
def api_full_sync():
    """Starts a full synchronization (fetches ALL CVEs)"""
    def run_full_sync():
        monitor.fetch_all_cves_historical()
    
    sync_thread = threading.Thread(target=run_full_sync, daemon=True)
    sync_thread.start()
    
    return jsonify({
        'status': 'started',
        'message': 'Full synchronization started. Check /api/sync-status to monitor progress.'
    })

@app.route('/api/nuclei/<cve_id>')
@jwt_required()
def api_nuclei(cve_id):
    exists = monitor.has_nuclei_template_online(cve_id)
    return jsonify({'cve_id': cve_id, 'nuclei': exists})

@app.route('/api/reverse-search', methods=['POST'])
@jwt_required()
def reverse_search():
    """API endpoint for reverse search by product/version"""
    data = request.json
    product = data.get('product', '').strip()
    version = data.get('version', '').strip() or None
    
    if not product:
        return jsonify({'error': 'Product name is required'}), 400
    
    results = monitor.search_by_product_version(product, version)
    return jsonify(results)

@app.route('/api/products/autocomplete')
@jwt_required()
def autocomplete_products():
    """Suggests product names based on the database"""
    query = request.args.get('q', '').lower()
    if len(query) < 2:
        return jsonify([])
    
    conn = sqlite3.connect(DB_NAME)
    cursor = conn.cursor()
    
    cursor.execute("""
        SELECT DISTINCT description FROM cves 
        WHERE description LIKE ? 
        LIMIT 100
    """, (f'%{query}%',))
    
    known_products = [
        'Apache', 'Nginx', 'MySQL', 'PostgreSQL', 'MongoDB', 'Redis',
        'Docker', 'Kubernetes', 'Jenkins', 'GitLab', 'WordPress',
        'Drupal', 'Joomla', 'PHP', 'Python', 'Node.js', 'Ruby',
        'Tomcat', 'JBoss', 'WebLogic', 'Windows', 'Linux', 'Ubuntu',
        'Debian', 'CentOS', 'Red Hat', 'OpenSSL', 'OpenSSH',
        'Elasticsearch', 'Kibana', 'Grafana', 'Prometheus'
    ]
    
    suggestions = []
    for product in known_products:
        if query in product.lower():
            suggestions.append(product)
    
    conn.close()
    return jsonify(sorted(set(suggestions))[:10])

def periodic_update():
    """Thread for periodic CVE updates"""
    while True:
        time.sleep(UPDATE_INTERVAL)
        monitor.update_recent_cves()

@app.errorhandler(404)
def not_found_error(error):
    """Handles 404 errors to support client-side routing for the SPA."""
    # For API routes, return a standard JSON 404 response.
    if request.path.startswith('/api/'):
        return jsonify(message="Resource not found"), 404

    # For requests that look like client-side routes (no file extension),
    # serve the Svelte app's index.html. This allows the client-side
    # router to handle the URL.
    path_parts = request.path.split('/')
    last_part = path_parts[-1] if path_parts else ''
    if '.' not in last_part:
        return send_from_directory(app.static_folder, 'index.html')

    # For any other 404 (e.g., a missing static asset), return a standard 404.
    return "Not Found", 404

if __name__ == '__main__':
    print("="*60)
    print("SECURITY: CVE Monitor - Starting")
    print("="*60)
    
    if not NVD_API_KEY or NVD_API_KEY == 'YOUR_API_KEY_HERE':
        print("⚠️ WARNING: No NVD API key configured!")
        print("   Set the NVD_API_KEY environment variable")
        print("   or modify the NVD_API_KEY variable in the code")
        print("   Without an API key, requests will be limited.")
        print()
    else:
        print("NVD API key configured")
    
    print("Initializing the database...")
    sync_status = monitor.get_sync_status()
    
    conn = sqlite3.connect(DB_NAME)
    cursor = conn.cursor()
    cursor.execute("SELECT COUNT(*) FROM cves")
    cve_count = cursor.fetchone()[0]
    conn.close()
    
    print(f"Current database: {cve_count} CVEs")
    
    if cve_count == 0:
        print("\nWARNING: Database is empty!")
        print("Options:")
        print("1. Start /api/full-sync via the web interface to fetch ALL CVEs")
        print("2. Wait for the first automatic update")
    else:
        print("\n🔄 Checking for new CVEs...")
        monitor.update_recent_cves()
    
    update_thread = threading.Thread(target=periodic_update, daemon=True)
    update_thread.start()
    print("Automatic updates enabled (every hour)")
    
    print("\n" + "="*60)
    print("Server started on http://localhost:5000")
    print("="*60 + "\n")
    
    app.run(debug=False, host='0.0.0.0', port=5000)