import json, os, sys, urllib.request, urllib.parse, urllib.error

MIN_SEVERITY = {"Informational": {"high", "moderate", "informational"}, "Moderate": {"high", "moderate"}, "Critical": {"high"}}
SEV_NUM = {"high": 5, "moderate": 3, "informational": 1}


def _cfg():
    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
    base = "https://api.securitytrails.com/v1/asi"
    headers = {"APIKEY": s.get("api_key", ""), "Accept": "application/json"}
    project = str(s.get("project_id", ""))
    min_sev = str(s.get("min_severity") or "Moderate")
    return base, headers, project, min_sev


def _inputs():
    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))


def request(path):
    base, headers, _, _ = _cfg()
    req = urllib.request.Request(base + "/" + path.lstrip("/"), headers=headers, method="GET")
    with urllib.request.urlopen(req, timeout=90) as r:
        raw = r.read()
        return json.loads(raw) if raw else {}


def run():
    _, _, project, min_sev = _cfg()
    snapshot = _inputs().get("snapshot") or "recent"
    out = request("/rules/" + urllib.parse.quote(project, safe="") + "/" + urllib.parse.quote(snapshot, safe="") + "/issues")
    allowed = MIN_SEVERITY.get(min_sev, MIN_SEVERITY["Moderate"])
    issues = []
    for issue in out.get("data", []):
        cls = str(issue.get("classification", "")).lower()
        if cls and cls not in allowed:
            continue
        # Inject a 1-5 severity so the mapper can map it without string comparisons.
        issue["_severity"] = SEV_NUM.get(cls, 2)
        issues.append(issue)
    print(json.dumps({"data": issues, "meta": out.get("meta", {})}))


try:
    run()
except urllib.error.HTTPError as e:
    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
    sys.exit(1)
except Exception as e:
    print(json.dumps({"error": str(e)}))
    sys.exit(1)
