"""Audit exact installed API packages, not a host-dependent re-resolution.

Install pip-audit in an isolated environment; pass its executable as argv[1].
Only package names/versions are sent to the public vulnerability database.
"""
import json
from pathlib import Path
import subprocess
import sys

if __name__=='__main__':
    packages=json.loads(subprocess.check_output(['docker','compose','exec','-T','api','pip','list','--format=json'],text=True))
    requirements='\n'.join(p['name']+'=='+p['version'] for p in packages)+'\n'
    destination=Path('output/security');destination.mkdir(parents=True,exist_ok=True)
    (destination/'runtime-requirements.txt').write_text(requirements)
    result=subprocess.run([sys.argv[1] if len(sys.argv)>1 else 'pip-audit','--no-deps','--disable-pip',
        '--progress-spinner','off','-r',str(destination/'runtime-requirements.txt'),
        '-f','json','-o',str(destination/'python-audit.json')])
    if (destination/'python-audit.json').exists():
        data=json.loads((destination/'python-audit.json').read_text())
        for package in data['dependencies']:
            for vulnerability in package.get('vulns',[]):
                print(package['name'],package['version'],vulnerability['id'],'fix:',','.join(vulnerability['fix_versions']))
    sys.exit(result.returncode)