admin / Synapse-NetscanXi

#!/usr/bin/env python3
"""
NetScan Xi — Flask web server.

Features:
  - SQLite persistence + scan history
  - Scan profiles (quick / standard / deep)
  - Live progress bar + cancellation + job queue
  - Vulnerability scanning with CISA KEV + optional NVD enrichment
  - Risk scoring + device-type guessing
  - Change detection vs. previous scan + alerting (webhook/email)
  - Scheduled recurring scans
  - Dashboard with Top-10 vulnerabilities
  - CSV / JSON export
  - Per-host re-scan, search/filter, expandable detail, basic auth

Run:  sudo python3 -m app.server   (root needed for -O/-sS)
Env:  see README.md for the full list.
"""

import argparse
import functools
import hashlib
import ipaddress
import os
import secrets
import socket
import time

from flask import (Flask, Response, jsonify, render_template, request,
                   session, redirect, url_for)
from werkzeug.exceptions import HTTPException

from . import (db, exporter, auth, compliance, integrations, docker_scan,
               patcher, sonar, cortex)
from .manager import ScanManager
from .scanner import PROFILES, DEFAULT_PROFILE, DEFAULT_OPTIONS
from .scheduler import Scheduler

app = Flask(__name__)
app.secret_key = os.environ.get("NETSCAN_SECRET", os.urandom(24).hex())


@app.errorhandler(Exception)
def _api_errors_as_json(e):
    """Ensure /api/ endpoints ALWAYS return JSON, even on an unhandled error, so
    the browser never tries to JSON.parse an HTML error page ("unexpected
    character at line 1 column 1"). Page routes keep Flask's default behaviour."""
    code = e.code if isinstance(e, HTTPException) else 500
    if request.path.startswith("/api/"):
        msg = e.description if isinstance(e, HTTPException) else "internal server error"
        return jsonify({"ok": False, "error": msg}), code
    if isinstance(e, HTTPException):
        return e
    raise e


USE_NVD = os.environ.get("NETSCAN_USE_NVD", "").lower() in ("1", "true", "yes")

db.init_db()
# Create the first admin from env vars on a fresh install, if provided.
auth.bootstrap_admin()
manager = ScanManager(use_nvd=USE_NVD)


def guess_local_cidr():
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.connect(("8.8.8.8", 80))
        local_ip = s.getsockname()[0]
        s.close()
        return str(ipaddress.ip_network(local_ip + "/24", strict=False))
    except Exception:
        return "192.168.1.0/24"


def _parse_options(raw):
    """Validate/normalise the selectable scan options from a request body.
    Returns None if nothing supplied (manager falls back to profile defaults)."""
    if not isinstance(raw, dict):
        return None
    out = {}
    for k in DEFAULT_OPTIONS:
        if k in raw:
            out[k] = bool(raw[k])
    return out or None


def _parse_passive_seconds(raw):
    """Normalise a user-supplied passive listen duration in MINUTES (0-10) to
    seconds. Returns None when nothing usable was supplied so the manager falls
    back to the passive module default."""
    if raw is None or raw == "":
        return None
    try:
        minutes = float(raw)
    except (TypeError, ValueError):
        return None
    minutes = max(0.0, min(10.0, minutes))
    return int(round(minutes * 60))


def _parse_days(raw):
    """Normalise a list of weekday ints (0=Mon..6=Sun). Returns None if empty."""
    if not raw:
        return None
    out = []
    for d in raw:
        try:
            di = int(d)
        except (TypeError, ValueError):
            continue
        if 0 <= di <= 6 and di not in out:
            out.append(di)
    return sorted(out) or None


def _parse_hm(hour, minute):
    """Clamp hour/minute to valid ranges; default 0 when absent."""
    def _c(v, hi):
        try:
            iv = int(v)
        except (TypeError, ValueError):
            return 0
        return max(0, min(hi, iv))
    return _c(hour, 23), _c(minute, 59)


def _next_weekly(days, hour, minute):
    from .scheduler import next_weekly_run
    return next_weekly_run(days, hour, minute)


scheduler = Scheduler(manager, guess_local_cidr)
scheduler.start()


# ---------------------------------------------------------------------------
# Auth & roles
# ---------------------------------------------------------------------------
def current_user():
    """Return the logged-in user dict from the session, or None."""
    return session.get("user")


# ---------------------------------------------------------------------------
# Soft multi-tenancy (v8)
# ---------------------------------------------------------------------------
DEFAULT_TENANT = "default"


def current_tenant():
    """Tenant tag for the logged-in user (or default when auth is off)."""
    u = current_user() or {}
    return u.get("tenant") or DEFAULT_TENANT


def is_admin_user():
    """Global admin: sees and manages across ALL tenants."""
    if not auth.auth_required():
        return True
    u = current_user() or {}
    return auth.role_at_least(u.get("role", ""), "admin")


def is_tenant_admin_user():
    """v9.1: tenant_admin OR global admin — may administer within a tenant."""
    if not auth.auth_required():
        return True
    u = current_user() or {}
    return auth.role_at_least(u.get("role", ""), "tenant_admin")


def scope_tenant():
    """Tenant filter to apply to data queries.

    Admins see across all tenants (return None => no filter). Everyone else is
    scoped to their own tenant. With auth disabled there is a single tenant."""
    if not auth.auth_required():
        return None
    if is_admin_user():
        return None
    return current_tenant()


def _client_ip():
    return (request.headers.get("X-Forwarded-For", "").split(",")[0].strip()
            or request.remote_addr or "")


def _audit(action, detail=None):
    """Record an activity-log event for the current user/request."""
    u = current_user() or {}
    db.log_activity(action, user_id=u.get("id"), username=u.get("username"),
                    tenant=current_tenant(), detail=detail, ip=_client_ip())


def _unauth_response():
    if request.path.startswith("/api/"):
        return jsonify({"ok": False, "error": "unauthorized"}), 401
    return redirect(url_for("login"))


def require_auth(fn):
    @functools.wraps(fn)
    def wrapper(*args, **kwargs):
        if auth.auth_required() and not current_user():
            return _unauth_response()
        return fn(*args, **kwargs)
    return wrapper


def require_role(required):
    """Decorator: require the logged-in user to have at least `required` role.
    If auth is disabled entirely (no accounts, no legacy pw), access is allowed."""
    def deco(fn):
        @functools.wraps(fn)
        def wrapper(*args, **kwargs):
            if not auth.auth_required():
                return fn(*args, **kwargs)
            user = current_user()
            if not user:
                return _unauth_response()
            if not auth.role_at_least(user.get("role", ""), required):
                return jsonify({"ok": False,
                                "error": "forbidden: requires '%s' role" % required}), 403
            return fn(*args, **kwargs)
        return wrapper
    return deco


def _finish_login(user):
    """Establish an authenticated session for a fully-verified user."""
    must_enroll = bool(user.get("mfa_required")) and not user.get("mfa_enrolled")
    sess_user = {"id": user["id"], "username": user["username"],
                 "role": user["role"], "tenant": user.get("tenant") or DEFAULT_TENANT,
                 "must_enroll": must_enroll}
    session.pop("pending_mfa", None)
    session["user"] = sess_user
    if user.get("id"):
        db.touch_login(user["id"])
    # v8: record the login time + user in the activity log.
    db.log_activity("login", user_id=user["id"], username=user["username"],
                    tenant=sess_user["tenant"], detail="login successful",
                    ip=_client_ip())
    return redirect(url_for("index"))


@app.route("/login", methods=["GET", "POST"])
def login():
    if not auth.auth_required():
        return redirect(url_for("index"))
    error = None
    if request.method == "POST":
        username = request.form.get("username", "")
        password = request.form.get("password", "")
        user = auth.authenticate(username, password)
        if not user:
            error = "Incorrect username or password."
            db.log_activity("login_failed", username=username,
                            detail="bad credentials", ip=_client_ip())
            return render_template("login.html", error=error)
        # MFA enforced AND already enrolled -> require second factor.
        if user.get("mfa_required") and user.get("mfa_enrolled"):
            session["pending_mfa"] = {"id": user["id"], "username": user["username"],
                                      "role": user["role"],
                                      "mfa_required": True, "mfa_enrolled": True}
            return render_template("login.html", mfa_stage=True,
                                   mfa_username=user["username"])
        # Otherwise log in (prompt-to-enroll handled post-login via must_enroll).
        return _finish_login(user)
    return render_template("login.html", error=error)


@app.route("/login/mfa", methods=["POST"])
def login_mfa():
    """Second step of login: verify TOTP or a backup code."""
    pending = session.get("pending_mfa")
    if not pending:
        return redirect(url_for("login"))
    code = request.form.get("code", "")
    use_backup = request.form.get("backup") == "1"
    uid = pending["id"]
    record = db.get_user_by_id(uid)
    ok = False
    if record:
        if use_backup:
            ok = auth.verify_backup_code(uid, code)
        else:
            ok = auth.verify_totp(record.get("mfa_secret"), code)
    if ok:
        return _finish_login(pending)
    return render_template("login.html", mfa_stage=True,
                           mfa_username=pending.get("username"),
                           error="Invalid code. Try again or use a backup code.")


@app.route("/logout")
def logout():
    # v8: record the logout time + user before clearing the session.
    u = current_user() or {}
    if u.get("id"):
        db.log_activity("logout", user_id=u.get("id"), username=u.get("username"),
                        tenant=u.get("tenant") or DEFAULT_TENANT,
                        detail="logout", ip=_client_ip())
    session.clear()
    return redirect(url_for("login"))


# ---------------------------------------------------------------------------
# Pages
# ---------------------------------------------------------------------------
_STATIC_DIR = os.path.join(os.path.dirname(__file__), "static")


def _static_ver():
    """Cache-busting token from the newest static asset's mtime, so browsers
    always fetch fresh app.js/style.css after a redeploy instead of serving a
    stale cached copy (a frequent source of "old build" confusion)."""
    newest = 0
    for name in ("app.js", "style.css"):
        try:
            newest = max(newest, int(os.path.getmtime(os.path.join(_STATIC_DIR, name))))
        except OSError:
            pass
    return str(newest or "13")


def _index_context():
    user = current_user() or {}
    return dict(
        static_ver=_static_ver(),
        default_target=guess_local_cidr(),
        profiles=PROFILES,
        default_profile=DEFAULT_PROFILE,
        default_options=DEFAULT_OPTIONS,
        auth_enabled=auth.auth_required(),
        username=user.get("username"),
        role=user.get("role"),
        can_scan=(not auth.auth_required()) or auth.role_at_least(user.get("role", ""), "operator"),
        is_admin=(not auth.auth_required()) or auth.role_at_least(user.get("role", ""), "admin"),
        is_tenant_admin=(not auth.auth_required()) or auth.role_at_least(user.get("role", ""), "tenant_admin"),
        scheduler=scheduler.info(),
        has_account=bool(user.get("id")),
        must_enroll=bool(user.get("must_enroll")),
        tenant=current_tenant(),
        tenant_scoped=(auth.auth_required() and not is_admin_user()),
    )


@app.route("/")
@require_auth
def index():
    return render_template("index.html", **_index_context())


# ---------------------------------------------------------------------------
# Scan control API
# ---------------------------------------------------------------------------
@app.route("/api/scan", methods=["POST"])
@require_role("operator")
def api_scan():
    body = request.json or {}
    target = (body.get("target") or "").strip() or guess_local_cidr()
    profile = body.get("profile", DEFAULT_PROFILE)
    options = _parse_options(body.get("options"))
    scan_type = "passive" if body.get("scan_type") == "passive" else "active"
    # v10r1: passive scans accept a user-set listen duration (0-10 minutes).
    if scan_type == "passive":
        secs = _parse_passive_seconds(body.get("passive_minutes"))
        if secs is not None:
            options = dict(options or {})
            options["passive_seconds"] = secs
    tenant = current_tenant()
    manager.enqueue(target, profile, triggered_by="manual", options=options,
                    tenant=tenant, scan_type=scan_type)
    _audit("scan", f"target={target} profile={profile} type={scan_type}")
    return jsonify({"ok": True, "target": target, "profile": profile,
                    "options": options, "scan_type": scan_type})


@app.route("/api/rescan/<ip>", methods=["POST"])
@require_role("operator")
def api_rescan(ip):
    body = request.json or {}
    profile = body.get("profile", DEFAULT_PROFILE)
    options = _parse_options(body.get("options"))
    try:
        ipaddress.ip_address(ip)
    except ValueError:
        return jsonify({"ok": False, "error": "invalid IP"}), 400
    manager.enqueue(ip, profile, triggered_by="manual", options=options,
                    tenant=current_tenant())
    _audit("rescan", f"host={ip} profile={profile}")
    return jsonify({"ok": True, "target": ip})


@app.route("/api/cancel", methods=["POST"])
@require_role("operator")
def api_cancel():
    ok = manager.cancel_current()
    return jsonify({"ok": ok})


@app.route("/api/status")
@require_auth
def api_status():
    s = manager.status()
    # v8: don't leak another tenant's running-scan target to a scoped user.
    scope = scope_tenant()
    if scope is not None and s.get("active") and s.get("tenant") != scope:
        s = {"active": False, "status": "idle", "phase": "", "progress": 0.0,
             "queued": 0, "current_ip": None}
    return jsonify(s)


# ---------------------------------------------------------------------------
# Data API
# ---------------------------------------------------------------------------
@app.route("/api/docker/capabilities")
@require_auth
def api_docker_capabilities():
    """v10r1: report Docker scanning capabilities (API + image scanner)."""
    return jsonify({"ok": True, "capabilities": docker_scan.capabilities()})


@app.route("/api/dashboard")
@require_auth
def api_dashboard():
    scan_id = request.args.get("scan_id", type=int)
    scope = scope_tenant()
    if scan_id:
        scan = db.get_scan(scan_id)
        # Enforce tenant ownership for scoped (non-admin) users.
        if scan and scope is not None and scan.get("tenant") != scope:
            scan = None
    else:
        scan = db.latest_scan("done", tenant=scope)
    if not scan:
        return jsonify({
            "scan": None, "hosts": [], "changes": [],
            "top_vulnerabilities": [], "summary": _empty_summary(),
            "compliance": compliance.summarize([]),
        })
    hosts = db.get_hosts(scan["id"])
    changes = db.get_changes(scan["id"])
    # v9.1: overlay CVE lifecycle dispositions onto host vulns + top list.
    states = db.get_cve_states(tenant=current_tenant())
    _apply_lifecycle(hosts, states)
    top = db.top_vulnerabilities(scan["id"], limit=10)
    _apply_lifecycle_top(top, states)
    # v12: overlay asset-group memberships (tenant-separated) onto each host.
    gmap = db.get_asset_group_map(tenant=current_tenant())
    for h in hosts:
        h["groups"] = gmap.get(h.get("asset_id"), [])
    return jsonify({
        "scan": scan,
        "hosts": hosts,
        "changes": changes,
        "top_vulnerabilities": top,
        "summary": _summary(hosts, changes),
        "compliance": compliance.summarize(hosts),
        "os_distribution": _os_distribution(hosts),
        "severity_distribution": _severity_distribution(hosts),
        "lifecycle_counts": _lifecycle_counts(hosts),
        "asset_groups": db.list_asset_groups(tenant=current_tenant()),
    })


def _state_for(states, asset_id, cve):
    """Resolve the disposition for (asset_id, cve): asset-specific wins over the
    tenant-wide '*' entry."""
    cve = (cve or "").upper()
    if not cve:
        return None
    rec = states.get((asset_id, cve)) or states.get(("*", cve))
    return rec


def _apply_lifecycle(hosts, states):
    """Annotate each vuln with its lifecycle state (default 'open')."""
    for h in hosts:
        aid = h.get("asset_id") or ""
        for v in h.get("vulns", []):
            cve = (v.get("cve") or v.get("id") or "").upper()
            rec = _state_for(states, aid, cve)
            v["lifecycle"] = (rec or {}).get("state", "open")
            v["lifecycle_note"] = (rec or {}).get("note")


def _apply_lifecycle_top(top, states):
    for v in top:
        cve = (v.get("cve") or v.get("id") or "").upper()
        # Top list is cross-host; only a tenant-wide ('*') disposition applies.
        rec = states.get(("*", cve))
        v["lifecycle"] = (rec or {}).get("state", "open")


def _os_distribution(hosts):
    """Bucket hosts by OS family for the OS pie chart (feature 1)."""
    dist = {}
    for h in hosts:
        os_str = (h.get("os") or "").lower()
        if not os_str or os_str in ("unknown", "-"):
            fam = "Unknown"
        elif "windows" in os_str:
            fam = "Windows"
        elif "linux" in os_str:
            fam = "Linux"
        elif any(x in os_str for x in ("mac", "apple", "darwin", "ios")):
            fam = "Apple"
        elif any(x in os_str for x in ("android",)):
            fam = "Android"
        elif any(x in os_str for x in ("bsd",)):
            fam = "BSD"
        elif any(x in os_str for x in ("router", "cisco", "juniper", "mikrotik",
                                       "embedded", "iot", "printer", "camera")):
            fam = "Network/IoT"
        else:
            fam = "Other"
        dist[fam] = dist.get(fam, 0) + 1
    return dist


def _severity_distribution(hosts):
    """Bucket vulns by CVSS severity band for the severity bar chart."""
    bands = {"Critical": 0, "High": 0, "Medium": 0, "Low": 0, "Unknown": 0}
    for h in hosts:
        for v in h.get("vulns", []):
            if v.get("lifecycle") in ("remediated", "false_positive"):
                continue  # excluded from the active risk picture
            try:
                c = float(v.get("cvss") or 0)
            except (TypeError, ValueError):
                c = 0.0
            if c >= 9.0:
                bands["Critical"] += 1
            elif c >= 7.0:
                bands["High"] += 1
            elif c >= 4.0:
                bands["Medium"] += 1
            elif c > 0:
                bands["Low"] += 1
            else:
                bands["Unknown"] += 1
    return bands


def _lifecycle_counts(hosts):
    counts = {"open": 0, "remediated": 0, "accepted_risk": 0,
              "false_positive": 0}
    for h in hosts:
        for v in h.get("vulns", []):
            st = v.get("lifecycle", "open")
            counts[st] = counts.get(st, 0) + 1
    return counts


@app.route("/api/history")
@require_auth
def api_history():
    return jsonify({"scans": db.list_scans(limit=50, tenant=scope_tenant())})


# ---------------------------------------------------------------------------
# Asset registry (v9) - edit a mis-identified device type (sticky override)
# ---------------------------------------------------------------------------
@app.route("/api/assets/<asset_id>/type", methods=["POST"])
@require_role("operator")
def api_asset_type(asset_id):
    """v9: correct the device Type for an asset. The override is bound to the
    asset's MAC-based ID and re-applied on future scans."""
    body = request.json or {}
    device_type = (body.get("device_type") or "").strip()
    rec = db.get_asset(asset_id)
    if not rec:
        return jsonify({"ok": False, "error": "no such asset"}), 404
    scope = scope_tenant()
    if scope is not None and rec.get("tenant") != scope:
        return jsonify({"ok": False, "error": "forbidden"}), 403
    db.set_asset_type_override(asset_id, device_type)
    _audit("asset_type_edit", f"asset={asset_id} type={device_type or '(cleared)'}")
    return jsonify({"ok": True, "asset_id": asset_id,
                    "device_type": device_type or None})


# ---------------------------------------------------------------------------
# CVE finding lifecycle (v9.1) - mark Remediated / Accepted Risk / False Positive
# ---------------------------------------------------------------------------
@app.route("/api/cve/lifecycle", methods=["POST"])
@require_role("operator")
def api_cve_lifecycle():
    body = request.json or {}
    cve = (body.get("cve") or "").strip()
    asset_id = (body.get("asset_id") or "*").strip() or "*"
    state = (body.get("state") or "").strip()
    note = (body.get("note") or "").strip() or None
    if not cve:
        return jsonify({"ok": False, "error": "cve required"}), 400
    if state not in db.LIFECYCLE_STATES:
        return jsonify({"ok": False, "error": "invalid state"}), 400
    # Scoped users may only touch assets in their own tenant.
    if asset_id != "*":
        rec = db.get_asset(asset_id)
        scope = scope_tenant()
        if rec and scope is not None and rec.get("tenant") != scope:
            return jsonify({"ok": False, "error": "forbidden"}), 403
    u = current_user() or {}
    db.set_cve_state(current_tenant(), asset_id, cve, state, note=note,
                     updated_by=u.get("username"))
    _audit("cve_lifecycle", f"cve={cve} asset={asset_id} state={state}")
    return jsonify({"ok": True, "cve": cve.upper(), "asset_id": asset_id,
                    "state": state})


@app.route("/api/cve/lifecycle")
@require_auth
def api_cve_lifecycle_list():
    return jsonify({"ok": True,
                    "states": db.list_cve_states(tenant=current_tenant()),
                    "valid_states": list(db.LIFECYCLE_STATES)})


# ---------------------------------------------------------------------------
# Risk / compliance trends (v9.1) - 30/90/365-day history graphs
# ---------------------------------------------------------------------------
@app.route("/api/trends")
@require_auth
def api_trends():
    try:
        days = int(request.args.get("days", 90))
    except (TypeError, ValueError):
        days = 90
    days = max(1, min(3650, days))
    since = time.time() - days * 86400
    scope = scope_tenant()
    tenant = scope if scope is not None else current_tenant()
    snaps = db.get_risk_snapshots(tenant=tenant, since_ts=since)
    return jsonify({"ok": True, "days": days, "snapshots": snaps})


# ---------------------------------------------------------------------------
# Global search (v9.1) - search assets/vulns/software across the latest scan
# ---------------------------------------------------------------------------
@app.route("/api/search")
@require_auth
def api_search():
    q = (request.args.get("q") or "").strip().lower()
    if len(q) < 1:
        return jsonify({"ok": True, "query": q, "results": []})
    scope = scope_tenant()
    scan = db.latest_scan("done", tenant=scope)
    results = []
    if scan:
        hosts = db.get_hosts(scan["id"])
        for h in hosts:
            hay_host = " ".join(str(x) for x in [
                h.get("asset_id", ""), h.get("ip", ""), h.get("hostname", ""),
                h.get("os", ""), h.get("device_type", ""), h.get("vendor", ""),
                h.get("mac", "")]).lower()
            if q in hay_host:
                results.append({
                    "type": "asset", "asset_id": h.get("asset_id"),
                    "ip": h.get("ip"), "label": h.get("hostname") or h.get("ip"),
                    "detail": f"{h.get('device_type','')} · {h.get('os','')}".strip(" ·"),
                })
            for v in h.get("vulns", []):
                vid = (v.get("cve") or v.get("id") or "")
                if q in vid.lower() or q in (v.get("description", "") or "").lower():
                    results.append({
                        "type": "vuln", "asset_id": h.get("asset_id"),
                        "ip": h.get("ip"), "label": vid,
                        "detail": f"on {h.get('ip')} · CVSS {v.get('cvss','N/A')}",
                    })
            for sw in h.get("software", []):
                name = (sw.get("name") or "")
                if q in name.lower():
                    results.append({
                        "type": "software", "asset_id": h.get("asset_id"),
                        "ip": h.get("ip"),
                        "label": name,
                        "detail": f"on {h.get('ip')} · {sw.get('version','')}".strip(),
                    })
    # De-dupe + cap.
    seen, out = set(), []
    for r in results:
        key = (r["type"], r["label"], r["ip"])
        if key in seen:
            continue
        seen.add(key)
        out.append(r)
        if len(out) >= 50:
            break
    return jsonify({"ok": True, "query": q, "results": out,
                    "scan_id": scan["id"] if scan else None})


# ---------------------------------------------------------------------------
# Data-retention policy (v9.1) - configured in the Admin UI
# ---------------------------------------------------------------------------
RETENTION_KEY = "retention_policy"
DEFAULT_RETENTION = {"max_age_days": 0, "max_scans": 0, "auto_apply": False}


@app.route("/api/settings/retention", methods=["GET"])
@require_role("tenant_admin")
def api_retention_get():
    pol = db.get_setting(RETENTION_KEY, DEFAULT_RETENTION)
    # Report current scan count so admins see the impact.
    scope = scope_tenant()
    tenant = scope if scope is not None else None
    scans = db.list_scans(limit=100000, tenant=tenant)
    return jsonify({"ok": True, "policy": pol, "scan_count": len(scans)})


@app.route("/api/settings/retention", methods=["POST"])
@require_role("tenant_admin")
def api_retention_set():
    body = request.json or {}
    def _int(v):
        try:
            return max(0, int(v))
        except (TypeError, ValueError):
            return 0
    pol = {
        "max_age_days": _int(body.get("max_age_days")),
        "max_scans": _int(body.get("max_scans")),
        "auto_apply": bool(body.get("auto_apply")),
    }
    db.set_setting(RETENTION_KEY, pol)
    _audit("retention_set", f"age={pol['max_age_days']}d scans={pol['max_scans']} auto={pol['auto_apply']}")
    removed = 0
    if body.get("apply_now"):
        # Tenant admins only purge their own tenant; global admins purge all.
        tenant = None if is_admin_user() else current_tenant()
        removed = db.purge_old_scans(max_age_days=pol["max_age_days"] or None,
                                     max_scans=pol["max_scans"] or None,
                                     tenant=tenant)
        _audit("retention_apply", f"removed={removed} tenant={tenant or 'ALL'}")
    return jsonify({"ok": True, "policy": pol, "removed": removed})


# ---------------------------------------------------------------------------
# Synapse Sonar PUSH feed (v13) - NetscanXi sends findings TO Sonar.
# Tenant-scoped: each tenant points at its own Sonar ingest key. The API key is
# stored but never echoed back; GET reports only whether one is set.
# ---------------------------------------------------------------------------
SONAR_KEY_PREFIX = "sonar_config"
DEFAULT_SONAR = {"url": "", "api_key": "", "enabled": False, "verify_tls": True}


def _sonar_setting_key():
    return f"{SONAR_KEY_PREFIX}:{current_tenant()}"


def _sonar_config():
    cfg = dict(DEFAULT_SONAR)
    cfg.update(db.get_setting(_sonar_setting_key(), {}) or {})
    return cfg


def _sonar_public(cfg):
    """Strip the secret for client responses; expose only that one is set."""
    return {"url": cfg.get("url", ""),
            "enabled": bool(cfg.get("enabled")),
            "verify_tls": bool(cfg.get("verify_tls", True)),
            "key_set": bool(cfg.get("api_key"))}


@app.route("/api/settings/sonar", methods=["GET"])
@require_role("tenant_admin")
def api_sonar_get():
    return jsonify({"ok": True, "config": _sonar_public(_sonar_config())})


@app.route("/api/settings/sonar", methods=["POST"])
@require_role("tenant_admin")
def api_sonar_set():
    body = request.json or {}
    cfg = _sonar_config()
    cfg["url"] = (body.get("url") or "").strip()
    cfg["enabled"] = bool(body.get("enabled"))
    cfg["verify_tls"] = bool(body.get("verify_tls", True))
    # Only overwrite the key when a new value is supplied, so saving other fields
    # doesn't wipe a previously stored key (the form never echoes it back).
    if "api_key" in body and (body.get("api_key") or "").strip():
        cfg["api_key"] = body["api_key"].strip()
    elif body.get("clear_key"):
        cfg["api_key"] = ""
    db.set_setting(_sonar_setting_key(), cfg)
    _audit("sonar_config",
           f"url={cfg['url'] or '(none)'} enabled={cfg['enabled']} "
           f"key={'set' if cfg.get('api_key') else 'unset'}")
    return jsonify({"ok": True, "config": _sonar_public(cfg)})


@app.route("/api/settings/sonar/test", methods=["POST"])
@require_role("tenant_admin")
def api_sonar_test():
    """Test connectivity to Synapse Sonar. Uses the URL/key in the request body
    when supplied (so admins can verify before saving), otherwise the stored
    config. Falls back to the stored key when the form key is blank."""
    body = request.json or {}
    cfg = _sonar_config()
    url = (body.get("url") or "").strip() or cfg.get("url", "")
    api_key = (body.get("api_key") or "").strip() or cfg.get("api_key", "")
    verify_tls = bool(body.get("verify_tls", cfg.get("verify_tls", True)))
    res = sonar.test_connection(url, api_key, verify_tls=verify_tls)
    _audit("sonar_test", f"url={url or '(none)'} ok={res.get('ok')}")
    return jsonify(res)


@app.route("/api/sonar/push", methods=["POST"])
@require_role("tenant_admin")
def api_sonar_push():
    """On-demand PUSH: send this tenant's latest-scan findings to Sonar now."""
    cfg = _sonar_config()
    if not cfg.get("enabled"):
        return jsonify({"ok": False, "error": "Sonar push is not enabled"}), 400
    if not cfg.get("url") or not cfg.get("api_key"):
        return jsonify({"ok": False, "error": "Sonar URL and API key required"}), 400
    scope = scope_tenant()
    scan = db.latest_scan("done", tenant=scope)
    if not scan:
        return jsonify({"ok": False, "error": "no completed scan to send"}), 404
    hosts = db.get_hosts(scan["id"])
    findings = sonar.build_findings(hosts)
    res = sonar.push_findings(cfg["url"], cfg["api_key"], findings,
                              verify_tls=cfg.get("verify_tls", True))
    _audit("sonar_push", f"scan={scan['id']} findings={len(findings)} ok={res.get('ok')}")
    status = 200 if res.get("ok") else 502
    return jsonify(res), status


# ---------------------------------------------------------------------------
# Synapse Cortex asset feed (v13) - NetscanXi sends its asset inventory TO
# Cortex. PUSH only: unlike Sonar there is no pull/outbound direction here,
# since Cortex never needs to read data back out of NetscanXi. Tenant-scoped,
# same storage/redaction pattern as the Sonar push config above.
# ---------------------------------------------------------------------------
CORTEX_KEY_PREFIX = "cortex_config"
DEFAULT_CORTEX = {"url": "", "api_key": "", "enabled": False, "verify_tls": True}


def _cortex_setting_key():
    return f"{CORTEX_KEY_PREFIX}:{current_tenant()}"


def _cortex_config():
    cfg = dict(DEFAULT_CORTEX)
    cfg.update(db.get_setting(_cortex_setting_key(), {}) or {})
    return cfg


def _cortex_public(cfg):
    """Strip the secret for client responses; expose only that one is set."""
    return {"url": cfg.get("url", ""),
            "enabled": bool(cfg.get("enabled")),
            "verify_tls": bool(cfg.get("verify_tls", True)),
            "key_set": bool(cfg.get("api_key"))}


@app.route("/api/settings/cortex", methods=["GET"])
@require_role("tenant_admin")
def api_cortex_get():
    return jsonify({"ok": True, "config": _cortex_public(_cortex_config())})


@app.route("/api/settings/cortex", methods=["POST"])
@require_role("tenant_admin")
def api_cortex_set():
    body = request.json or {}
    cfg = _cortex_config()
    cfg["url"] = (body.get("url") or "").strip()
    cfg["enabled"] = bool(body.get("enabled"))
    cfg["verify_tls"] = bool(body.get("verify_tls", True))
    # Only overwrite the key when a new value is supplied, so saving other fields
    # doesn't wipe a previously stored key (the form never echoes it back).
    if "api_key" in body and (body.get("api_key") or "").strip():
        cfg["api_key"] = body["api_key"].strip()
    elif body.get("clear_key"):
        cfg["api_key"] = ""
    db.set_setting(_cortex_setting_key(), cfg)
    _audit("cortex_config",
           f"url={cfg['url'] or '(none)'} enabled={cfg['enabled']} "
           f"key={'set' if cfg.get('api_key') else 'unset'}")
    return jsonify({"ok": True, "config": _cortex_public(cfg)})


@app.route("/api/settings/cortex/test", methods=["POST"])
@require_role("tenant_admin")
def api_cortex_test():
    """Test connectivity to Synapse Cortex. Uses the URL/key in the request body
    when supplied (so admins can verify before saving), otherwise the stored
    config. Falls back to the stored key when the form key is blank."""
    body = request.json or {}
    cfg = _cortex_config()
    url = (body.get("url") or "").strip() or cfg.get("url", "")
    api_key = (body.get("api_key") or "").strip() or cfg.get("api_key", "")
    verify_tls = bool(body.get("verify_tls", cfg.get("verify_tls", True)))
    res = cortex.test_connection(url, api_key, verify_tls=verify_tls)
    _audit("cortex_test", f"url={url or '(none)'} ok={res.get('ok')}")
    return jsonify(res)


@app.route("/api/cortex/push", methods=["POST"])
@require_role("tenant_admin")
def api_cortex_push():
    """On-demand PUSH: send this tenant's latest-scan asset inventory to Cortex now."""
    cfg = _cortex_config()
    if not cfg.get("enabled"):
        return jsonify({"ok": False, "error": "Cortex push is not enabled"}), 400
    if not cfg.get("url") or not cfg.get("api_key"):
        return jsonify({"ok": False, "error": "Cortex URL and API key required"}), 400
    scope = scope_tenant()
    scan = db.latest_scan("done", tenant=scope)
    if not scan:
        return jsonify({"ok": False, "error": "no completed scan to send"}), 404
    hosts = db.get_hosts(scan["id"])
    assets = cortex.build_assets(hosts)
    res = cortex.push_assets(cfg["url"], cfg["api_key"], assets,
                             verify_tls=cfg.get("verify_tls", True))
    _audit("cortex_push", f"scan={scan['id']} assets={len(assets)} ok={res.get('ok')}")
    status = 200 if res.get("ok") else 502
    return jsonify(res), status


@app.route("/api/cortex/ticket", methods=["POST"])
@require_role("operator")
def api_cortex_ticket():
    """Send a SINGLE user-selected Remediation Tracking item to Cortex as a
    ticket (from the Remediation Tracking tab). Uses the same source +
    /api/ingest/tickets endpoint the old bulk auto-send used, but scoped to the
    one incident the user picks. Keyed by a stable per-remediation reference, so
    re-sending is reported as 'already exists' and never clobbers Cortex."""
    cfg = _cortex_config()
    if not cfg.get("enabled"):
        return jsonify({"ok": False, "error": "Cortex integration is not enabled"}), 400
    if not cfg.get("url") or not cfg.get("api_key"):
        return jsonify({"ok": False, "error": "Cortex URL and API key required"}), 400
    body = request.json or {}
    rid = body.get("remediation_id")
    if rid is None:
        return jsonify({"ok": False, "error": "remediation_id required"}), 400
    rec = db.get_remediation(rid)
    if not rec or (scope_tenant() is not None and rec.get("tenant") != current_tenant()):
        return jsonify({"ok": False, "error": "no such remediation item"}), 404
    tickets = cortex.build_tickets([rec])
    if not tickets:
        return jsonify({"ok": False, "error": "item cannot be ticketed (missing title)"}), 400
    res = cortex.push_tickets(cfg["url"], cfg["api_key"], tickets,
                              verify_tls=cfg.get("verify_tls", True))
    _audit("cortex_ticket", f"remediation={rid} ok={res.get('ok')}")
    status = 200 if res.get("ok") else 502
    return jsonify(res), status


@app.route("/api/cortex/vuln-ticket", methods=["POST"])
@require_role("operator")
def api_cortex_vuln_ticket():
    """Raise a Cortex ticket from an asset's VULNERABILITY findings (manual, from
    the Assets tab). Body: {asset_id, cves?} - `cves` is the user-selected subset
    of CVE ids to include; omitted means all of the asset's vulns. Sends via the
    configured Synapse Cortex integration so its AI can suggest fixes. Keyed by a
    stable per-asset external_ref (re-send is reported as already-existing)."""
    cfg = _cortex_config()
    if not cfg.get("enabled"):
        return jsonify({"ok": False, "error": "Cortex integration is not enabled"}), 400
    if not cfg.get("url") or not cfg.get("api_key"):
        return jsonify({"ok": False, "error": "Cortex URL and API key required"}), 400
    body = request.json or {}
    asset_id = (body.get("asset_id") or "").strip()
    if not asset_id:
        return jsonify({"ok": False, "error": "asset_id required"}), 400
    selected = body.get("cves")
    if selected is not None:
        if not isinstance(selected, list):
            return jsonify({"ok": False, "error": "cves must be a list"}), 400
        if not selected:  # explicitly empty selection means "nothing to send"
            return jsonify({"ok": False, "error": "select at least one vulnerability"}), 400
    scope = scope_tenant()
    scan = db.latest_scan("done", tenant=scope)
    if not scan:
        return jsonify({"ok": False, "error": "no completed scan"}), 404
    host = next((h for h in db.get_hosts(scan["id"])
                 if (h.get("asset_id") or "") == asset_id), None)
    if not host:
        return jsonify({"ok": False, "error": "asset not found in latest scan"}), 404
    ticket = cortex.build_vuln_ticket(host, tenant=current_tenant(),
                                      selected=selected)
    if not ticket:
        return jsonify({"ok": False,
                        "error": "no matching vulnerabilities to send"}), 400
    res = cortex.push_tickets(cfg["url"], cfg["api_key"], [ticket],
                              verify_tls=cfg.get("verify_tls", True))
    _audit("cortex_vuln_ticket",
           f"asset={asset_id} cves={len(selected) if isinstance(selected, list) else 'all'} ok={res.get('ok')}")
    status = 200 if res.get("ok") else 502
    return jsonify(res), status


# ---------------------------------------------------------------------------
# Synapse Sonar PULL API (v13) - the reverse direction.
#
# NetscanXi issues its OWN API key and exposes a read-only endpoint so Synapse
# Sonar can pull this instance's latest findings and stay actively in sync. The
# key ORIGINATES here and is pasted INTO Sonar's NetscanXi integration card.
#
# The key is stored only as a SHA-256 hash (like Sonar's sensor key); the
# plaintext is shown exactly once at generation. Per-tenant: each tenant issues
# its own key, and an incoming key resolves back to its tenant.
# ---------------------------------------------------------------------------
OUTBOUND_KEY_PREFIX = "outbound_api"
OUTBOUND_KEY_TOKEN_PREFIX = "nsx_out_"


def _outbound_setting_key(tenant=None):
    return f"{OUTBOUND_KEY_PREFIX}:{tenant or current_tenant()}"


def _outbound_config(tenant=None):
    cfg = {"key_hash": None, "enabled": False, "created_at": None,
           "last_used": None}
    cfg.update(db.get_setting(_outbound_setting_key(tenant), {}) or {})
    return cfg


def _outbound_endpoint_url():
    """The absolute URL Sonar should be pointed at (honours reverse proxies)."""
    root = request.url_root.rstrip("/")
    return f"{root}/api/v1/sonar/vulnerabilities"


def _outbound_public(cfg):
    return {"enabled": bool(cfg.get("enabled")),
            "key_set": bool(cfg.get("key_hash")),
            "created_at": cfg.get("created_at"),
            "last_used": cfg.get("last_used"),
            "endpoint_url": _outbound_endpoint_url()}


def _hash_key(raw):
    return hashlib.sha256((raw or "").encode("utf-8")).hexdigest()


def _resolve_outbound_key(raw):
    """Map a presented API key back to its tenant. Returns (tenant, setting_key)
    or (None, None). Only ENABLED keys authenticate."""
    if not raw:
        return None, None
    wanted = _hash_key(raw)
    for skey, cfg in db.find_settings_by_prefix(OUTBOUND_KEY_PREFIX + ":").items():
        if not isinstance(cfg, dict) or not cfg.get("enabled"):
            continue
        if cfg.get("key_hash") and secrets.compare_digest(cfg["key_hash"], wanted):
            return skey.split(":", 1)[1], skey
    return None, None


@app.route("/api/settings/outbound", methods=["GET"])
@require_role("tenant_admin")
def api_outbound_get():
    return jsonify({"ok": True, "config": _outbound_public(_outbound_config())})


@app.route("/api/settings/outbound", methods=["POST"])
@require_role("tenant_admin")
def api_outbound_set():
    """Enable/disable this tenant's outbound pull API (does not touch the key)."""
    body = request.json or {}
    cfg = _outbound_config()
    cfg["enabled"] = bool(body.get("enabled"))
    db.set_setting(_outbound_setting_key(), cfg)
    _audit("outbound_api_toggle", f"enabled={cfg['enabled']}")
    return jsonify({"ok": True, "config": _outbound_public(cfg)})


@app.route("/api/settings/outbound/key", methods=["POST"])
@require_role("tenant_admin")
def api_outbound_key_generate():
    """(Re)generate the outbound API key. Returns the plaintext exactly once and
    enables the feed. Rotating immediately invalidates the previous key."""
    raw = OUTBOUND_KEY_TOKEN_PREFIX + secrets.token_hex(24)
    cfg = _outbound_config()
    cfg["key_hash"] = _hash_key(raw)
    cfg["created_at"] = time.time()
    cfg["last_used"] = None
    cfg["enabled"] = True  # issuing a key turns the feed on
    db.set_setting(_outbound_setting_key(), cfg)
    _audit("outbound_api_key", "generated/rotated outbound API key")
    return jsonify({"ok": True, "api_key": raw,
                    "config": _outbound_public(cfg)})


@app.route("/api/settings/outbound/key", methods=["DELETE"])
@require_role("tenant_admin")
def api_outbound_key_revoke():
    """Revoke the key and disable the feed."""
    cfg = _outbound_config()
    cfg["key_hash"] = None
    cfg["enabled"] = False
    cfg["created_at"] = None
    cfg["last_used"] = None
    db.set_setting(_outbound_setting_key(), cfg)
    _audit("outbound_api_key_revoke", "revoked outbound API key")
    return jsonify({"ok": True, "config": _outbound_public(cfg)})


@app.route("/api/v1/sonar/vulnerabilities", methods=["GET"])
def api_outbound_vulnerabilities():
    """Bearer-authenticated read feed of the latest scan's vulnerability findings
    for the tenant that owns the presented key. This is the endpoint pasted into
    Synapse Sonar. Deliberately session-less: auth is the NetscanXi-issued key."""
    header = request.headers.get("Authorization", "")
    parts = header.split(None, 1)
    token = parts[1].strip() if len(parts) == 2 and parts[0].lower() == "bearer" else ""
    tenant, skey = _resolve_outbound_key(token)
    if not tenant:
        return jsonify({"ok": False, "error": "invalid or disabled API key"}), 401

    # Record last-used for the admin UI (best-effort).
    try:
        cfg = db.get_setting(skey, {}) or {}
        cfg["last_used"] = time.time()
        db.set_setting(skey, cfg)
    except Exception:
        pass

    scan = db.latest_scan("done", tenant=tenant)
    if not scan:
        return jsonify({"ok": True, "tenant": tenant, "scan": None,
                        "generated_at": time.time(), "count": 0, "findings": []})
    hosts = db.get_hosts(scan["id"])
    # Suppress findings an operator has dispositioned as remediated / false
    # positive so Sonar mirrors the ACTIVE risk picture.
    states = db.get_cve_states(tenant=tenant)
    _apply_lifecycle(hosts, states)
    for h in hosts:
        h["vulns"] = [v for v in h.get("vulns", [])
                      if v.get("lifecycle") not in ("remediated", "false_positive")]
    findings = sonar.build_findings(hosts)
    return jsonify({"ok": True, "tenant": tenant,
                    "scan": {"id": scan["id"], "target": scan.get("target"),
                             "finished": scan.get("finished")},
                    "generated_at": time.time(),
                    "count": len(findings), "findings": findings})


# ---------------------------------------------------------------------------
# Service-desk integrations (v9.1) - Jira / ServiceNow / Zendesk
# ---------------------------------------------------------------------------
@app.route("/api/integrations", methods=["GET"])
@require_role("tenant_admin")
def api_integrations_list():
    scope = scope_tenant()
    tenant = scope if scope is not None else None
    return jsonify({"ok": True,
                    "integrations": db.list_integrations(tenant=tenant),
                    "platforms": list(db.INTEGRATION_PLATFORMS)})


@app.route("/api/integrations", methods=["POST"])
@require_role("tenant_admin")
def api_integrations_create():
    body = request.json or {}
    platform = (body.get("platform") or "").strip().lower()
    if platform not in db.INTEGRATION_PLATFORMS:
        return jsonify({"ok": False, "error": "invalid platform"}), 400
    name = (body.get("name") or platform.title()).strip()
    base_url = (body.get("base_url") or "").strip()
    # Cortex ships with a sensible default endpoint so the admin doesn't have to
    # know where the ticket ingest lives; other desks require an explicit URL.
    if not base_url and platform == "cortex":
        base_url = integrations.CORTEX_DEFAULT_URL
    if not base_url:
        return jsonify({"ok": False, "error": "base_url required"}), 400
    iid = db.create_integration(
        tenant=current_tenant(), platform=platform, name=name, base_url=base_url,
        auth_user=(body.get("auth_user") or "").strip() or None,
        auth_secret=(body.get("auth_secret") or "").strip() or None,
        project_key=(body.get("project_key") or "").strip() or None,
        enabled=bool(body.get("enabled", True)))
    _audit("integration_create", f"platform={platform} name={name}")
    return jsonify({"ok": True, "id": iid})


@app.route("/api/integrations/<int:iid>", methods=["PATCH"])
@require_role("tenant_admin")
def api_integrations_update(iid):
    rec = db.get_integration(iid, redact=True)
    if not rec:
        return jsonify({"ok": False, "error": "no such integration"}), 404
    scope = scope_tenant()
    if scope is not None and rec.get("tenant") != scope:
        return jsonify({"ok": False, "error": "forbidden"}), 403
    body = request.json or {}
    fields = {}
    for k in ("name", "base_url", "auth_user", "project_key"):
        if k in body:
            fields[k] = (body.get(k) or "").strip()
    if body.get("auth_secret"):          # only overwrite when a value is supplied
        fields["auth_secret"] = body["auth_secret"].strip()
    if "enabled" in body:
        fields["enabled"] = bool(body["enabled"])
    db.update_integration(iid, **fields)
    return jsonify({"ok": True})


@app.route("/api/integrations/<int:iid>", methods=["DELETE"])
@require_role("tenant_admin")
def api_integrations_delete(iid):
    rec = db.get_integration(iid, redact=True)
    if not rec:
        return jsonify({"ok": False, "error": "no such integration"}), 404
    scope = scope_tenant()
    if scope is not None and rec.get("tenant") != scope:
        return jsonify({"ok": False, "error": "forbidden"}), 403
    db.delete_integration(iid)
    _audit("integration_delete", f"id={iid}")
    return jsonify({"ok": True})


@app.route("/api/integrations/<int:iid>/test", methods=["POST"])
@require_role("tenant_admin")
def api_integrations_test(iid):
    rec = db.get_integration(iid, redact=False)
    if not rec:
        return jsonify({"ok": False, "error": "no such integration"}), 404
    res = integrations.test_connection(rec)
    return jsonify(res)


@app.route("/api/tickets", methods=["POST"])
@require_role("operator")
def api_tickets_create():
    """Open a service-desk ticket for a CVE finding on an asset."""
    body = request.json or {}
    iid = body.get("integration_id")
    rec = db.get_integration(iid, redact=False) if iid else None
    if not rec:
        return jsonify({"ok": False, "error": "unknown integration"}), 400
    scope = scope_tenant()
    if scope is not None and rec.get("tenant") != scope:
        return jsonify({"ok": False, "error": "forbidden"}), 403
    if not rec.get("enabled"):
        return jsonify({"ok": False, "error": "integration disabled"}), 400
    cve = (body.get("cve") or "").strip()
    asset_id = (body.get("asset_id") or "").strip()
    summary = (body.get("summary") or f"NetscanXi finding {cve}").strip()
    description = (body.get("description") or "").strip()
    u = current_user() or {}
    res = integrations.create_ticket(rec, summary=summary, description=description,
                                     cve=cve, asset_id=asset_id)
    if not res.get("ok"):
        return jsonify(res), 502
    tid = db.record_ticket(current_tenant(), iid, rec["platform"], asset_id, cve,
                           res.get("key"), res.get("url"),
                           created_by=u.get("username"))
    _audit("ticket_create", f"platform={rec['platform']} key={res.get('key')} cve={cve}")
    return jsonify({"ok": True, "ticket_id": tid, "key": res.get("key"),
                    "url": res.get("url")})


@app.route("/api/tickets")
@require_auth
def api_tickets_list():
    scope = scope_tenant()
    tenant = scope if scope is not None else None
    return jsonify({"ok": True, "tickets": db.list_tickets(tenant=tenant)})


# ---------------------------------------------------------------------------
# Asset groups (v12). Group CRUD is tenant_admin; membership assignment is
# operator+. Everything is scoped to the caller's tenant for separation.
# ---------------------------------------------------------------------------
@app.route("/api/asset-groups", methods=["GET"])
@require_auth
def api_asset_groups_list():
    return jsonify({"ok": True,
                    "groups": db.list_asset_groups(tenant=current_tenant())})


@app.route("/api/asset-groups", methods=["POST"])
@require_role("tenant_admin")
def api_asset_groups_create():
    body = request.json or {}
    name = (body.get("name") or "").strip()
    if not name:
        return jsonify({"ok": False, "error": "name required"}), 400
    u = current_user() or {}
    gid = db.create_asset_group(current_tenant(), name,
                                description=body.get("description"),
                                created_by=u.get("username"))
    if gid is None:
        return jsonify({"ok": False, "error": "a group with that name already exists"}), 409
    _audit("asset_group_create", f"name={name}")
    return jsonify({"ok": True, "id": gid})


@app.route("/api/asset-groups/<int:gid>", methods=["PATCH"])
@require_role("tenant_admin")
def api_asset_groups_update(gid):
    rec = db.get_asset_group(gid)
    if not rec or rec.get("tenant") != current_tenant():
        return jsonify({"ok": False, "error": "no such group"}), 404
    body = request.json or {}
    fields = {k: body[k] for k in ("name", "description") if k in body}
    if not db.update_asset_group(gid, **fields):
        return jsonify({"ok": False, "error": "name already in use"}), 409
    _audit("asset_group_update", f"id={gid}")
    return jsonify({"ok": True})


@app.route("/api/asset-groups/<int:gid>", methods=["DELETE"])
@require_role("tenant_admin")
def api_asset_groups_delete(gid):
    rec = db.get_asset_group(gid)
    if not rec or rec.get("tenant") != current_tenant():
        return jsonify({"ok": False, "error": "no such group"}), 404
    db.delete_asset_group(gid)
    _audit("asset_group_delete", f"id={gid} name={rec.get('name')}")
    return jsonify({"ok": True})


@app.route("/api/assets/<asset_id>/groups", methods=["POST"])
@require_role("operator")
def api_asset_set_groups(asset_id):
    """Replace the full set of group memberships for one asset. Only groups in
    the caller's tenant are honoured, so membership stays tenant-separated."""
    body = request.json or {}
    group_ids = body.get("group_ids")
    if not isinstance(group_ids, list):
        return jsonify({"ok": False, "error": "group_ids must be a list"}), 400
    db.set_asset_groups_for_asset(current_tenant(), asset_id, group_ids)
    _audit("asset_groups_set", f"asset={asset_id} groups={group_ids}")
    return jsonify({"ok": True,
                    "groups": db.get_asset_group_map(tenant=current_tenant()).get(asset_id, [])})


# ---------------------------------------------------------------------------
# Remediation tracking (v12). Tenant-separated: a user only ever sees and
# edits remediation items belonging to their own tenant.
# ---------------------------------------------------------------------------
@app.route("/api/remediation", methods=["GET"])
@require_auth
def api_remediation_list():
    scope = scope_tenant()
    tenant = scope if scope is not None else None
    asset_id = request.args.get("asset_id") or None
    items = db.list_remediation(tenant=tenant, asset_id=asset_id)
    # Annotate each item with its asset's last-known IP (from the asset
    # registry) so the Remediation Tracking table can show an IP column.
    ip_by_asset = {a["asset_id"]: a.get("last_ip")
                   for a in db.list_assets(tenant=tenant)}
    for it in items:
        it["ip"] = ip_by_asset.get(it.get("asset_id"))
    return jsonify({
        "ok": True,
        "items": items,
        "states": list(db.REMEDIATION_STATES),
        "priorities": list(db.REMEDIATION_PRIORITIES),
    })


@app.route("/api/remediation", methods=["POST"])
@require_role("operator")
def api_remediation_create():
    body = request.json or {}
    asset_id = (body.get("asset_id") or "").strip()
    title = (body.get("title") or "").strip()
    if not asset_id or not title:
        return jsonify({"ok": False, "error": "asset_id and title are required"}), 400
    u = current_user() or {}
    rid = db.create_remediation(
        current_tenant(), asset_id, title,
        detail=body.get("detail"), status=body.get("status", "open"),
        priority=body.get("priority", "medium"), assignee=body.get("assignee"),
        due_date=body.get("due_date"), cve=body.get("cve"),
        created_by=u.get("username"))
    if rid is None:
        return jsonify({"ok": False, "error": "could not create item"}), 400
    _audit("remediation_create", f"asset={asset_id} title={title}")
    return jsonify({"ok": True, "id": rid})


@app.route("/api/remediation/<int:rid>", methods=["PATCH"])
@require_role("operator")
def api_remediation_update(rid):
    rec = db.get_remediation(rid)
    if not rec or rec.get("tenant") != current_tenant():
        return jsonify({"ok": False, "error": "no such item"}), 404
    body = request.json or {}
    fields = {k: body[k] for k in ("title", "detail", "status", "priority",
                                   "assignee", "due_date", "cve") if k in body}
    db.update_remediation(rid, **fields)
    _audit("remediation_update", f"id={rid} {fields}")
    return jsonify({"ok": True})


@app.route("/api/remediation/<int:rid>", methods=["DELETE"])
@require_role("operator")
def api_remediation_delete(rid):
    rec = db.get_remediation(rid)
    if not rec or rec.get("tenant") != current_tenant():
        return jsonify({"ok": False, "error": "no such item"}), 404
    db.delete_remediation(rid)
    _audit("remediation_delete", f"id={rid}")
    return jsonify({"ok": True})


@app.route("/api/remediation/bulk-delete", methods=["POST"])
@require_role("operator")
def api_remediation_bulk_delete():
    """v13: delete several remediation items at once (multi-select). Scoped to
    the caller's tenant so other tenants' items are never touched."""
    body = request.json or {}
    ids = body.get("ids") or []
    if not isinstance(ids, list) or not ids:
        return jsonify({"ok": False, "error": "ids (non-empty list) required"}), 400
    # Global admins (scope None) may delete across tenants; everyone else is
    # confined to their own tenant.
    tenant = None if is_admin_user() else current_tenant()
    removed = db.delete_remediations(ids, tenant=tenant)
    _audit("remediation_bulk_delete", f"requested={len(ids)} removed={removed}")
    return jsonify({"ok": True, "removed": removed})


# ---- Remediation comments (v13) -------------------------------------------
@app.route("/api/remediation/<int:rid>/comments", methods=["GET"])
@require_auth
def api_remediation_comments_list(rid):
    rec = db.get_remediation(rid)
    if not rec or (scope_tenant() is not None and rec.get("tenant") != current_tenant()):
        return jsonify({"ok": False, "error": "no such item"}), 404
    return jsonify({"ok": True,
                    "comments": db.list_remediation_comments(rid)})


@app.route("/api/remediation/<int:rid>/comments", methods=["POST"])
@require_role("operator")
def api_remediation_comments_add(rid):
    rec = db.get_remediation(rid)
    if not rec or rec.get("tenant") != current_tenant():
        return jsonify({"ok": False, "error": "no such item"}), 404
    body = request.json or {}
    text = (body.get("body") or "").strip()
    if not text:
        return jsonify({"ok": False, "error": "comment body required"}), 400
    u = current_user() or {}
    cid = db.add_remediation_comment(rid, current_tenant(), text,
                                     author=u.get("username"))
    if cid is None:
        return jsonify({"ok": False, "error": "could not add comment"}), 400
    _audit("remediation_comment_add", f"rid={rid} id={cid}")
    return jsonify({"ok": True, "id": cid})


@app.route("/api/remediation/comments/<int:cid>", methods=["DELETE"])
@require_role("operator")
def api_remediation_comment_delete(cid):
    com = db.get_remediation_comment(cid)
    if not com or com.get("tenant") != current_tenant():
        return jsonify({"ok": False, "error": "no such comment"}), 404
    db.delete_remediation_comment(cid)
    _audit("remediation_comment_delete", f"id={cid}")
    return jsonify({"ok": True})


# ---------------------------------------------------------------------------
# Patch and Remedy (More tab): OS-level updates/upgrades over SSH, plus optional
# Docker image updates.
#
# Credentials (SSH/sudo or registry) are supplied per run in the request body,
# used only for that call, and are NEVER stored or logged. Each targeted asset
# gets a remediation item auto-created (in_progress) and then updated to
# resolved/blocked, so the Remediation Tracking tab reflects every patch run.
# ---------------------------------------------------------------------------
def _resolve_patch_targets(body, docker_only=False):
    """Return the list of in-scope host dicts for a patch request.

    Honours tenant separation (a scoped user only ever patches their own
    tenant's assets). OS patching targets ANY scanned asset; Docker patching
    restricts to Docker hosts."""
    scope = scope_tenant()
    scan = db.latest_scan("done", tenant=scope)
    if not scan:
        return [], None
    hosts = db.get_hosts(scan["id"])
    # Map asset_id -> groups for group targeting (tenant-scoped).
    gmap = db.get_asset_group_map(tenant=current_tenant())
    pool = [h for h in hosts if h.get("asset_id")]
    if docker_only:
        pool = [h for h in pool if (h.get("docker") or {}).get("is_docker")]

    mode = (body.get("mode") or "asset").strip()
    if mode == "all":
        targets = pool
    elif mode == "group":
        gid = body.get("group_id")
        targets = [h for h in pool
                   if gid in (gmap.get(h.get("asset_id")) or [])]
    else:  # single asset
        aid = (body.get("asset_id") or "").strip()
        targets = [h for h in pool if h.get("asset_id") == aid]
    return targets, scan


# ---- OS-level patching (SSH) ----------------------------------------------
@app.route("/api/patch/os/plan", methods=["POST"])
@require_role("operator")
def api_patch_os_plan():
    """Dry-run: list the targeted assets and their detected OS. No SSH, no side
    effects, no remediation items created."""
    body = request.get_json(silent=True) or {}
    targets, scan = _resolve_patch_targets(body)
    plan = [patcher.os_plan_host(h) for h in targets]
    return jsonify({"ok": True, "plan": plan, "target_count": len(targets),
                    "ssh_available": patcher.ssh_available()})


@app.route("/api/patch/os", methods=["POST"])
@require_role("operator")
def api_patch_os():
    body = request.get_json(silent=True) or {}
    targets, scan = _resolve_patch_targets(body)
    if not targets:
        return jsonify({"ok": False,
                        "error": "no matching assets in the latest scan"}), 400

    # Ephemeral SSH/sudo credentials - used for this call only, never stored.
    ssh = body.get("ssh") or {}
    username = (ssh.get("username") or "").strip()
    if not username:
        return jsonify({"ok": False, "error": "ssh username required"}), 400
    password = ssh.get("password") or ""
    sudo_password = ssh.get("sudo_password") or ""
    try:
        port = int(ssh.get("port") or 22)
    except (TypeError, ValueError):
        port = 22
    dist_upgrade = bool(body.get("dist_upgrade"))
    simulate = bool(body.get("simulate"))
    tenant = current_tenant()
    u = current_user() or {}
    actor = u.get("username") or "system"

    results = []
    for host in targets:
        aid = host.get("asset_id") or ""
        kind = "distribution upgrade" if dist_upgrade else "updates & upgrades"
        title = ("OS update simulation" if simulate else f"OS {kind}")
        detail = f"OS patch run started by {actor} (simulate={simulate}, dist_upgrade={dist_upgrade})."
        rid = db.create_remediation(tenant, aid, title, detail=detail,
                                    status="in_progress", priority="high",
                                    assignee=actor, created_by=actor)
        res = patcher.os_patch_host(host, username=username, password=password,
                                    port=port, sudo_password=sudo_password,
                                    dist_upgrade=dist_upgrade, simulate=simulate)
        res["remediation_id"] = rid
        mgr = res.get("manager") or "?"
        cnt = res.get("updated_count")
        if res.get("ok"):
            if simulate:
                summary = f"Simulated OK via {mgr}" + (f" - {cnt} pkg(s) would change" if cnt is not None else "")
            else:
                summary = f"Patched OK via {mgr}" + (f" - {cnt} pkg(s) updated" if cnt is not None else "")
            new_status = "resolved"
        else:
            summary = res.get("error") or "patch failed"
            new_status = "blocked"
        if rid:
            db.update_remediation(rid, status=new_status, detail=summary)
        results.append(res)

    ok_hosts = sum(1 for r in results if r.get("ok"))
    # Audit WITHOUT any credential material - counts and targets only.
    _audit("os_patch",
           f"mode={body.get('mode','asset')} targets={len(targets)} ok={ok_hosts} "
           f"simulate={simulate} dist_upgrade={dist_upgrade}")
    # Scrub local credential references.
    password = sudo_password = ""
    return jsonify({"ok": True, "results": results,
                    "target_count": len(targets), "ok_hosts": ok_hosts,
                    "simulated": simulate})


# ---- Docker image patching ------------------------------------------------
@app.route("/api/patch/docker/plan", methods=["POST"])
@require_role("operator")
def api_patch_docker_plan():
    """Dry-run: report what would be pulled, with no side effects and no
    remediation items created."""
    body = request.get_json(silent=True) or {}
    targets, scan = _resolve_patch_targets(body, docker_only=True)
    plan = [patcher.plan_host(h) for h in targets]
    return jsonify({"ok": True, "plan": plan,
                    "target_count": len(targets)})


@app.route("/api/patch/docker", methods=["POST"])
@require_role("operator")
def api_patch_docker():
    body = request.get_json(silent=True) or {}
    targets, scan = _resolve_patch_targets(body, docker_only=True)
    if not targets:
        return jsonify({"ok": False,
                        "error": "no matching Docker assets in the latest scan"}), 400

    # Ephemeral credentials - read here, used for this call only, never stored.
    reg = body.get("registry") or {}
    username = (reg.get("username") or "").strip()
    password = reg.get("password") or ""
    server = (reg.get("server") or "").strip()
    recreate = bool(body.get("recreate"))
    tenant = current_tenant()
    u = current_user() or {}
    actor = u.get("username") or "system"

    results = []
    for host in targets:
        aid = host.get("asset_id") or ""
        # 1) Auto-create a remediation activity (in_progress) for this asset.
        title = "Docker image patch"
        detail = f"Patch run started by {actor} (recreate={recreate})."
        rid = db.create_remediation(tenant, aid, title, detail=detail,
                                    status="in_progress", priority="high",
                                    assignee=actor, created_by=actor)
        # 2) Run the patch (ephemeral creds passed straight through).
        res = patcher.patch_host(host, username=username, password=password,
                                 server=server, recreate=recreate)
        res["remediation_id"] = rid
        # 3) Update the remediation item with the outcome.
        pulled_ok = sum(1 for p in res.get("pulled", []) if p.get("ok"))
        pulled_tot = len(res.get("pulled", []))
        if res.get("ok"):
            summary = f"Patched OK - {pulled_ok}/{pulled_tot} image(s) updated"
            if recreate:
                summary += f", {len(res.get('recreated', []))} container(s) recreated"
            new_status = "resolved"
        else:
            summary = (res.get("error") or "patch failed") + \
                f" ({pulled_ok}/{pulled_tot} image(s) updated)"
            new_status = "blocked"
        if rid:
            db.update_remediation(rid, status=new_status, detail=summary)
        results.append(res)

    ok_hosts = sum(1 for r in results if r.get("ok"))
    # Audit WITHOUT any credential material - counts and targets only.
    _audit("docker_patch",
           f"mode={body.get('mode','asset')} targets={len(targets)} "
           f"ok={ok_hosts} recreate={recreate} auth={'yes' if username else 'no'}")
    return jsonify({"ok": True, "results": results,
                    "target_count": len(targets), "ok_hosts": ok_hosts})


# ---------------------------------------------------------------------------
# Dashboard layout (v9.1) - drag / pin / hide components, persisted per user
# ---------------------------------------------------------------------------
@app.route("/api/dashboard/layout", methods=["GET"])
@require_auth
def api_layout_get():
    u = current_user() or {}
    key = f"dash_layout:{u.get('id') or 'anon'}"
    return jsonify({"ok": True, "layout": db.get_setting(key, None)})


@app.route("/api/dashboard/layout", methods=["POST"])
@require_auth
def api_layout_set():
    u = current_user() or {}
    key = f"dash_layout:{u.get('id') or 'anon'}"
    body = request.json or {}
    layout = body.get("layout")
    if not isinstance(layout, list):
        return jsonify({"ok": False, "error": "layout must be a list"}), 400
    db.set_setting(key, layout)
    return jsonify({"ok": True})


# ---------------------------------------------------------------------------
# Activity / audit log (v8)
# ---------------------------------------------------------------------------
@app.route("/api/activity")
@require_role("tenant_admin")
def api_activity():
    """Recent login/logout + user activity. Admins see their tenant; with auth
    off, everything. Optional ?all=1 lets a (single-tenant) admin see all."""
    scope = scope_tenant()
    # Admins are scope=None (all tenants); honour an explicit tenant filter.
    tfilter = request.args.get("tenant")
    tenant = tfilter if tfilter else scope
    rows = db.list_activity(limit=300, tenant=tenant)
    return jsonify({"ok": True, "activity": rows,
                    "tenants": db.list_tenants()})


@app.route("/api/scheduler")
@require_auth
def api_scheduler():
    return jsonify(scheduler.info())


# ---------------------------------------------------------------------------
# Scheduled scans - UI management (v6). Operator+ may manage schedules.
# ---------------------------------------------------------------------------
@app.route("/api/schedules", methods=["GET"])
@require_auth
def api_schedules_list():
    return jsonify({"ok": True, "schedules": db.list_schedules(),
                    "profiles": list(PROFILES.keys())})


@app.route("/api/schedules", methods=["POST"])
@require_role("operator")
def api_schedules_create():
    body = request.json or {}
    name = (body.get("name") or "").strip() or "Schedule"
    try:
        interval = int(body.get("interval_minutes") or 0)
    except (TypeError, ValueError):
        interval = 0
    if interval < 1:
        return jsonify({"ok": False, "error": "interval_minutes must be >= 1"}), 400
    profile = body.get("profile") or DEFAULT_PROFILE
    if profile not in PROFILES:
        return jsonify({"ok": False, "error": "invalid profile"}), 400
    options = _parse_options(body.get("options"))
    target = (body.get("target") or "").strip()
    enabled = bool(body.get("enabled", True))
    days = _parse_days(body.get("days"))
    hour, minute = _parse_hm(body.get("hour"), body.get("minute"))
    scan_type = "passive" if body.get("scan_type") == "passive" else "active"
    sid = db.create_schedule(name=name, interval_minutes=interval, target=target,
                             profile=profile, options=options, enabled=enabled,
                             days=days, hour=hour, minute=minute,
                             scan_type=scan_type)
    # Prime next_run: weekly day/time if given, else after one interval.
    if days:
        nr = _next_weekly(days, hour, minute)
        db.update_schedule(sid, next_run=nr or (time.time() + interval * 60))
    else:
        db.update_schedule(sid, next_run=time.time() + interval * 60)
    return jsonify({"ok": True, "id": sid})


@app.route("/api/schedules/<int:sid>", methods=["PATCH"])
@require_role("operator")
def api_schedules_update(sid):
    if not db.get_schedule(sid):
        return jsonify({"ok": False, "error": "no such schedule"}), 404
    body = request.json or {}
    fields = {}
    if "name" in body:
        fields["name"] = (body.get("name") or "").strip() or "Schedule"
    if "target" in body:
        fields["target"] = (body.get("target") or "").strip()
    if "profile" in body:
        if body["profile"] not in PROFILES:
            return jsonify({"ok": False, "error": "invalid profile"}), 400
        fields["profile"] = body["profile"]
    if "options" in body:
        fields["options"] = _parse_options(body.get("options"))
    if "interval_minutes" in body:
        try:
            iv = int(body["interval_minutes"])
        except (TypeError, ValueError):
            return jsonify({"ok": False, "error": "bad interval"}), 400
        if iv < 1:
            return jsonify({"ok": False, "error": "interval_minutes must be >= 1"}), 400
        fields["interval_minutes"] = iv
        fields["next_run"] = time.time() + iv * 60
    if "days" in body:
        fields["days"] = _parse_days(body.get("days"))
    if "hour" in body or "minute" in body:
        cur = db.get_schedule(sid)
        h, m = _parse_hm(body.get("hour", cur.get("hour")),
                         body.get("minute", cur.get("minute")))
        fields["hour"], fields["minute"] = h, m
    if "scan_type" in body:
        fields["scan_type"] = "passive" if body.get("scan_type") == "passive" else "active"
    if "enabled" in body:
        fields["enabled"] = bool(body["enabled"])
        if fields["enabled"]:
            cur = db.get_schedule(sid)
            days = fields.get("days", cur.get("days"))
            if days:
                h = fields.get("hour", cur.get("hour"))
                m = fields.get("minute", cur.get("minute"))
                fields.setdefault("next_run", _next_weekly(days, h, m)
                                  or (time.time() + cur["interval_minutes"] * 60))
            else:
                iv = fields.get("interval_minutes", cur["interval_minutes"])
                fields.setdefault("next_run", time.time() + iv * 60)
    db.update_schedule(sid, **fields)
    return jsonify({"ok": True})


@app.route("/api/schedules/<int:sid>", methods=["DELETE"])
@require_role("operator")
def api_schedules_delete(sid):
    if not db.delete_schedule(sid):
        return jsonify({"ok": False, "error": "no such schedule"}), 404
    return jsonify({"ok": True})


@app.route("/api/schedules/<int:sid>/run", methods=["POST"])
@require_role("operator")
def api_schedules_run_now(sid):
    s = db.get_schedule(sid)
    if not s:
        return jsonify({"ok": False, "error": "no such schedule"}), 404
    target = s["target"].strip() or guess_local_cidr()
    manager.enqueue(target, s["profile"], triggered_by="schedule",
                    options=s.get("options"), tenant=current_tenant(),
                    scan_type=s.get("scan_type") or "active")
    _audit("schedule_run", f"schedule={s['name']} target={target}")
    return jsonify({"ok": True, "target": target})


@app.route("/api/export/<fmt>")
@require_auth
def api_export(fmt):
    scan_id = request.args.get("scan_id", type=int)
    scope = scope_tenant()
    if scan_id:
        scan = db.get_scan(scan_id)
        if scan and scope is not None and scan.get("tenant") != scope:
            scan = None
    else:
        scan = db.latest_scan("done", tenant=scope)
    if not scan:
        return jsonify({"ok": False, "error": "no scan available"}), 404
    hosts = db.get_hosts(scan["id"])
    _audit("export", f"scan={scan['id']} fmt={fmt}")
    if fmt == "csv":
        data = exporter.to_csv(hosts, scan=scan)
        return Response(
            data, mimetype="text/csv",
            headers={"Content-Disposition":
                     f"attachment; filename=netscan_{scan['id']}.csv"})
    if fmt == "json":
        changes = db.get_changes(scan["id"])
        top = db.top_vulnerabilities(scan["id"], limit=10)
        data = exporter.to_json(scan, hosts, changes, top)
        return Response(
            data, mimetype="application/json",
            headers={"Content-Disposition":
                     f"attachment; filename=netscan_{scan['id']}.json"})
    if fmt == "pdf":
        if not exporter.pdf_available():
            return jsonify({"ok": False,
                            "error": "PDF export needs reportlab (pip install reportlab)"}), 501
        changes = db.get_changes(scan["id"])
        top = db.top_vulnerabilities(scan["id"], limit=10)
        comp = compliance.summarize(hosts)
        data = exporter.to_pdf(scan, hosts, changes, top, compliance_summary=comp)
        return Response(
            data, mimetype="application/pdf",
            headers={"Content-Disposition":
                     f"attachment; filename=netscan_{scan['id']}.pdf"})
    return jsonify({"ok": False, "error": "format must be csv, json or pdf"}), 400


# ---------------------------------------------------------------------------
# Single-host report export (v8)
# ---------------------------------------------------------------------------
@app.route("/api/export/host/<ip>/<fmt>")
@require_auth
def api_export_host(ip, fmt):
    """Export a focused report for ONE host from a scan (csv/json/pdf)."""
    try:
        ipaddress.ip_address(ip)
    except ValueError:
        return jsonify({"ok": False, "error": "invalid IP"}), 400
    scan_id = request.args.get("scan_id", type=int)
    scope = scope_tenant()
    if scan_id:
        scan = db.get_scan(scan_id)
        if scan and scope is not None and scan.get("tenant") != scope:
            scan = None
    else:
        scan = db.latest_scan("done", tenant=scope)
    if not scan:
        return jsonify({"ok": False, "error": "no scan available"}), 404
    hosts = db.get_hosts(scan["id"])
    host = next((h for h in hosts if h.get("ip") == ip), None)
    if not host:
        return jsonify({"ok": False, "error": "host not found in scan"}), 404
    _audit("export_host", f"scan={scan['id']} host={ip} fmt={fmt}")
    safe_ip = ip.replace(".", "_")
    if fmt == "csv":
        data = exporter.to_csv([host], scan=scan)
        return Response(
            data, mimetype="text/csv",
            headers={"Content-Disposition":
                     f"attachment; filename=netscan_{scan['id']}_host_{safe_ip}.csv"})
    if fmt == "json":
        data = exporter.host_to_json(scan, host)
        return Response(
            data, mimetype="application/json",
            headers={"Content-Disposition":
                     f"attachment; filename=netscan_{scan['id']}_host_{safe_ip}.json"})
    if fmt == "pdf":
        if not exporter.pdf_available():
            return jsonify({"ok": False,
                            "error": "PDF export needs reportlab (pip install reportlab)"}), 501
        data = exporter.host_to_pdf(scan, host)
        return Response(
            data, mimetype="application/pdf",
            headers={"Content-Disposition":
                     f"attachment; filename=netscan_{scan['id']}_host_{safe_ip}.pdf"})
    return jsonify({"ok": False, "error": "format must be csv, json or pdf"}), 400


# ---------------------------------------------------------------------------
# Identity & user management (admin only)
# ---------------------------------------------------------------------------
@app.route("/api/me")
@require_auth
def api_me():
    u = current_user()
    if not u:
        return jsonify({"authenticated": False, "role": None})
    return jsonify({"authenticated": True, "username": u.get("username"),
                    "role": u.get("role")})


@app.route("/api/account/password", methods=["POST"])
@require_auth
def api_account_password():
    """v8-r2: self-service password change for any logged-in account holder.
    Requires the current password; admins update everyone else from User Admin."""
    u = current_user() or {}
    uid = u.get("id")
    if not uid:
        return jsonify({"ok": False, "error": "no account context"}), 400
    body = request.json or {}
    current = body.get("current_password") or ""
    new = body.get("new_password") or ""
    if len(new) < 8:
        return jsonify({"ok": False, "error": "new password must be ≥ 8 characters"}), 400
    rec = db.get_user_by_id(uid)
    if not rec or not auth.verify_password(rec.get("password_hash", ""), current):
        _audit("password_change_failed", "wrong current password")
        return jsonify({"ok": False, "error": "current password is incorrect"}), 403
    db.set_password(uid, auth.hash_password(new))
    _audit("password_change", "self-service password change")
    return jsonify({"ok": True})


@app.route("/api/users", methods=["GET"])
@require_role("tenant_admin")
def api_users_list():
    # Global admins see all users; tenant admins see only their own tenant.
    if is_admin_user():
        users = db.list_users()
        roles = list(db.ROLES)
        tenants = db.list_tenants()
    else:
        my_tenant = current_tenant()
        users = [u for u in db.list_users() if (u.get("tenant") or "default") == my_tenant]
        # Tenant admins cannot mint global admins.
        roles = [r for r in db.ROLES if r != "admin"]
        tenants = [my_tenant]
    return jsonify({"ok": True, "users": users, "roles": roles,
                    "tenants": tenants})


@app.route("/api/users", methods=["POST"])
@require_role("tenant_admin")
def api_users_create():
    body = request.json or {}
    username = (body.get("username") or "").strip()
    password = body.get("password") or ""
    role = body.get("role") or auth.DEFAULT_ROLE
    if len(username) < 2:
        return jsonify({"ok": False, "error": "username too short"}), 400
    if len(password) < 8:
        return jsonify({"ok": False, "error": "password must be ≥ 8 characters"}), 400
    if role not in db.ROLES:
        return jsonify({"ok": False, "error": "invalid role"}), 400
    mfa_required = bool(body.get("mfa_required"))
    tenant = (body.get("tenant") or DEFAULT_TENANT).strip() or DEFAULT_TENANT
    # v9.1: tenant admins are confined to their own tenant and cannot create
    # global admins.
    if not is_admin_user():
        tenant = current_tenant()
        if role == "admin":
            return jsonify({"ok": False,
                            "error": "tenant admins cannot create global admins"}), 403
    uid = db.create_user(username, auth.hash_password(password), role=role,
                         mfa_required=mfa_required, tenant=tenant)
    if uid is None:
        return jsonify({"ok": False, "error": "username already exists"}), 409
    _audit("user_create", f"username={username} role={role} tenant={tenant}")
    return jsonify({"ok": True, "id": uid, "mfa_required": mfa_required})


@app.route("/api/users/<int:user_id>", methods=["PATCH"])
@require_role("tenant_admin")
def api_users_update(user_id):
    body = request.json or {}
    target = db.get_user_by_id(user_id)
    if not target:
        return jsonify({"ok": False, "error": "no such user"}), 404
    # v9.1: tenant admins may only touch users in their own tenant, and may not
    # grant the global admin role or move users between tenants.
    if not is_admin_user():
        if (target.get("tenant") or "default") != current_tenant():
            return jsonify({"ok": False, "error": "forbidden (other tenant)"}), 403
        if body.get("role") == "admin":
            return jsonify({"ok": False,
                            "error": "tenant admins cannot grant global admin"}), 403
        if "tenant" in body and (body.get("tenant") or "default") != current_tenant():
            return jsonify({"ok": False,
                            "error": "tenant admins cannot reassign tenants"}), 403
    # Change role
    if "role" in body:
        role = body["role"]
        if role not in db.ROLES:
            return jsonify({"ok": False, "error": "invalid role"}), 400
        # Don't allow demoting the last admin.
        if target["role"] == "admin" and role != "admin" and db.count_admins() <= 1:
            return jsonify({"ok": False, "error": "cannot demote the last admin"}), 409
        db.set_role(user_id, role)
    # Change username (v8-r2: admins may rename any account)
    if "username" in body:
        new_username = (body.get("username") or "").strip()
        if len(new_username) < 2:
            return jsonify({"ok": False, "error": "username too short"}), 400
        if new_username.lower() != (target["username"] or "").lower():
            if not db.set_username(user_id, new_username):
                return jsonify({"ok": False, "error": "username already exists"}), 409
            _audit("user_rename",
                   f"user_id={user_id} from={target['username']} to={new_username}")
            # If an admin renamed their own account, keep the session in sync.
            me = current_user() or {}
            if me.get("id") == user_id and isinstance(session.get("user"), dict):
                session["user"]["username"] = new_username
                session.modified = True
    # Change tenant (v8 soft multi-tenancy)
    if "tenant" in body:
        tenant = (body.get("tenant") or DEFAULT_TENANT).strip() or DEFAULT_TENANT
        db.set_tenant(user_id, tenant)
        _audit("user_tenant", f"user_id={user_id} tenant={tenant}")
    # Change / reset password (admin overwrite — e.g. a locked-out user)
    if body.get("password"):
        if len(body["password"]) < 8:
            return jsonify({"ok": False, "error": "password must be ≥ 8 characters"}), 400
        db.set_password(user_id, auth.hash_password(body["password"]))
        _audit("user_password_reset", f"user_id={user_id} username={target['username']}")
    # Toggle whether MFA is enforced for this user.
    if "mfa_required" in body:
        db.set_mfa_required(user_id, bool(body["mfa_required"]))
    # Admin reset of MFA (e.g. user lost their device): wipe secret + codes so
    # they re-enroll on next login. Honour an explicit mfa_reset flag.
    if body.get("mfa_reset"):
        db.disable_mfa(user_id)
    return jsonify({"ok": True})


# ---------------------------------------------------------------------------
# Self-service MFA enrollment (any logged-in user)
# ---------------------------------------------------------------------------
@app.route("/api/mfa/status")
@require_auth
def api_mfa_status():
    u = current_user() or {}
    uid = u.get("id")
    if not uid:
        return jsonify({"ok": True, "enrolled": False, "required": False,
                        "must_enroll": False, "backup_remaining": 0})
    rec = db.get_user_by_id(uid) or {}
    return jsonify({
        "ok": True,
        "enrolled": rec.get("mfa_secret") is not None,
        "required": bool(rec.get("mfa_required")),
        "must_enroll": u.get("must_enroll", False),
        "backup_remaining": db.count_unused_backup_codes(uid),
    })


@app.route("/api/mfa/enroll/begin", methods=["POST"])
@require_auth
def api_mfa_enroll_begin():
    """Generate a candidate secret + provisioning URI. Not yet active until the
    user confirms with a valid code at /api/mfa/enroll/confirm."""
    u = current_user() or {}
    if not u.get("id"):
        return jsonify({"ok": False, "error": "no account context"}), 400
    secret = auth.new_totp_secret()
    session["mfa_enroll_secret"] = secret
    uri = auth.totp_uri(secret, u.get("username", "user"))
    return jsonify({"ok": True, "secret": secret, "otpauth_uri": uri})


@app.route("/api/mfa/enroll/qr.png")
@require_auth
def api_mfa_enroll_qr():
    """Render the in-progress enrollment secret as a QR PNG (no secret in URL)."""
    u = current_user() or {}
    secret = session.get("mfa_enroll_secret")
    if not secret:
        return jsonify({"ok": False, "error": "no enrollment in progress"}), 400
    try:
        import io
        import qrcode
        uri = auth.totp_uri(secret, u.get("username", "user"))
        img = qrcode.make(uri)
        buf = io.BytesIO()
        img.save(buf, format="PNG")
        buf.seek(0)
        return Response(buf.getvalue(), mimetype="image/png",
                        headers={"Cache-Control": "no-store"})
    except Exception as e:
        return jsonify({"ok": False, "error": f"qr render failed: {e}"}), 500


@app.route("/api/mfa/enroll/confirm", methods=["POST"])
@require_auth
def api_mfa_enroll_confirm():
    """Verify the first code against the candidate secret, then activate MFA and
    issue one-time backup codes (returned once, in plaintext)."""
    u = current_user() or {}
    uid = u.get("id")
    if not uid:
        return jsonify({"ok": False, "error": "no account context"}), 400
    secret = session.get("mfa_enroll_secret")
    if not secret:
        return jsonify({"ok": False, "error": "no enrollment in progress"}), 400
    code = (request.json or {}).get("code", "")
    if not auth.verify_totp(secret, code):
        return jsonify({"ok": False, "error": "code did not verify"}), 400
    db.set_mfa_secret(uid, secret)
    backup = auth.enroll_backup_codes(uid)
    session.pop("mfa_enroll_secret", None)
    # Clear the nudge now that they're enrolled.
    if isinstance(session.get("user"), dict):
        session["user"]["must_enroll"] = False
        session.modified = True
    return jsonify({"ok": True, "backup_codes": backup})


@app.route("/api/mfa/backup/regenerate", methods=["POST"])
@require_auth
def api_mfa_backup_regenerate():
    """Re-issue backup codes (invalidates the old set). Requires enrollment."""
    u = current_user() or {}
    uid = u.get("id")
    if not uid:
        return jsonify({"ok": False, "error": "no account context"}), 400
    rec = db.get_user_by_id(uid) or {}
    if rec.get("mfa_secret") is None:
        return jsonify({"ok": False, "error": "MFA not enrolled"}), 400
    backup = auth.enroll_backup_codes(uid)
    return jsonify({"ok": True, "backup_codes": backup})


@app.route("/api/mfa/disable", methods=["POST"])
@require_auth
def api_mfa_disable():
    """Let a user turn off their own MFA, unless an admin has forced it on."""
    u = current_user() or {}
    uid = u.get("id")
    if not uid:
        return jsonify({"ok": False, "error": "no account context"}), 400
    rec = db.get_user_by_id(uid) or {}
    if rec.get("mfa_required"):
        return jsonify({"ok": False,
                        "error": "MFA is enforced for your account by an admin"}), 403
    db.disable_mfa(uid)
    return jsonify({"ok": True})


@app.route("/api/users/<int:user_id>", methods=["DELETE"])
@require_role("tenant_admin")
def api_users_delete(user_id):
    me = current_user() or {}
    if me.get("id") == user_id:
        return jsonify({"ok": False, "error": "you cannot delete your own account"}), 409
    if not is_admin_user():
        target = db.get_user_by_id(user_id)
        if target and (target.get("tenant") or "default") != current_tenant():
            return jsonify({"ok": False, "error": "forbidden (other tenant)"}), 403
    if not db.delete_user(user_id):
        return jsonify({"ok": False,
                        "error": "cannot delete (not found, or last admin)"}), 409
    return jsonify({"ok": True})


# ---------------------------------------------------------------------------
# Summaries
# ---------------------------------------------------------------------------
def _empty_summary():
    return {"hosts": 0, "vulns": 0, "kev": 0, "high_risk": 0,
            "critical_changes": 0, "docker": 0, "device_types": {},
            "docker_stats": docker_scan.summarize([])}


def _summary(hosts, changes):
    kev = sum(1 for h in hosts for v in h.get("vulns", []) if v.get("kev"))
    high_risk = sum(1 for h in hosts if (h.get("risk") or 0) >= 70)
    crit = sum(1 for c in changes if c.get("severity") == "critical")
    docker = sum(1 for h in hosts if (h.get("docker") or {}).get("is_docker"))
    dtypes = {}
    for h in hosts:
        dt = h.get("device_type", "unknown")
        dtypes[dt] = dtypes.get(dt, 0) + 1
    return {
        "hosts": len(hosts),
        "vulns": sum(h.get("vuln_count", 0) for h in hosts),
        "kev": kev,
        "high_risk": high_risk,
        "critical_changes": crit,
        "docker": docker,
        "device_types": dtypes,
        # v10r1: deep Docker / container rollup for the dashboard.
        "docker_stats": docker_scan.summarize(hosts),
    }


def _cmd_seed_admin(args):
    """Create or update an admin user from the CLI."""
    import getpass
    username = args.username or input("Admin username: ").strip()
    password = args.password or getpass.getpass("Admin password: ")
    if len(username) < 2 or len(password) < 8:
        print("ERROR: username ≥ 2 chars and password ≥ 8 chars required.")
        return 1
    existing = db.get_user(username)
    if existing:
        db.set_password(existing["id"], auth.hash_password(password))
        db.set_role(existing["id"], "admin")
        print(f"Updated existing user '{username}' (role=admin, password reset).")
    else:
        uid = db.create_user(username, auth.hash_password(password), role="admin")
        if uid is None:
            print("ERROR: could not create user.")
            return 1
        print(f"Created admin user '{username}'.")
    return 0


def main():
    parser = argparse.ArgumentParser(description="NetScan Xi")
    sub = parser.add_subparsers(dest="command")

    seed = sub.add_parser("seed-admin", help="Create/reset an admin account")
    seed.add_argument("--username")
    seed.add_argument("--password")

    parser.add_argument("--host", default="0.0.0.0")
    parser.add_argument("--port", type=int, default=5000)
    args = parser.parse_args()

    db.init_db()
    if args.command == "seed-admin":
        raise SystemExit(_cmd_seed_admin(args))

    app.run(host=args.host, port=args.port, debug=False, threaded=True)


if __name__ == "__main__":
    main()