#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="${1:-artifacts}"
if [ -n "${PYTHON_BIN:-}" ]; then
  PYTHON_CMD="$PYTHON_BIN"
else
  PYTHON_CMD=""
  for candidate in python3 python.exe python; do
    if command -v "$candidate" >/dev/null 2>&1 &&
      "$candidate" -c "import pip_audit" >/dev/null 2>&1; then
      PYTHON_CMD="$candidate"
      break
    fi
  done
fi
if [ -z "$PYTHON_CMD" ]; then
  echo "No Python interpreter available for pip-audit." >&2
  exit 1
fi
cd "$ROOT"
mkdir -p "$OUTPUT_DIR"

"$PYTHON_CMD" scripts/verify_security_exceptions.py
mapfile -t ignored_ids < <(
  "$PYTHON_CMD" scripts/verify_security_exceptions.py --print-ids | tr -d '\r'
)

common_args=(
  -r backend/requirements-ci.lock
  --no-deps
  --disable-pip
  --progress-spinner off
  --format json
)

# Preserve the unfiltered evidence even when known time-boxed exceptions exist.
"$PYTHON_CMD" -m pip_audit \
  "${common_args[@]}" \
  --output "$OUTPUT_DIR/pip-audit-full.json" || true

policy_args=()
for advisory_id in "${ignored_ids[@]}"; do
  policy_args+=(--ignore-vuln "$advisory_id")
done
"$PYTHON_CMD" -m pip_audit \
  "${common_args[@]}" \
  "${policy_args[@]}" \
  --output "$OUTPUT_DIR/pip-audit-policy.json"

echo "Python dependency audit policy passed."