package api

import (
	"net/http"
	"sync"
	"time"

	"crypto-miner-server/internal/vuln"
)

// VulnHandler serves cached CVE catalog JSON for fleet assessment UI.
type VulnHandler struct {
	mu       sync.RWMutex
	cachedAt time.Time
}

func NewVulnHandler() *VulnHandler {
	return &VulnHandler{cachedAt: time.Now()}
}

// Catalog returns embedded lightweight CVE correlator rules (cached 1h).
func (h *VulnHandler) Catalog(w http.ResponseWriter, r *http.Request) {
	h.mu.RLock()
	stale := time.Since(h.cachedAt) > time.Hour
	h.mu.RUnlock()
	if stale {
		h.mu.Lock()
		h.cachedAt = time.Now()
		h.mu.Unlock()
	}
	writeJSON(w, map[string]interface{}{
		"catalog":    vuln.EmbeddedCatalog,
		"cached_at":  h.cachedAt.UTC().Format(time.RFC3339),
		"source":     "embedded",
		"authorized": true,
	})
}