PART 03 — セキュリティ設計書
認証・認可・暗号化・脆弱性対策の定義

"""
pip-audit で依存パッケージの既知脆弱性をスキャンする
pip install pip-audit
"""
import subprocess, json

def run_audit(format_json=True) -> dict | str:
    cmd = ["pip-audit", "--format", "json"] if format_json else ["pip-audit"]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if format_json:
        try:
            return json.loads(result.stdout)
        except json.JSONDecodeError:
            return {"error": result.stdout + result.stderr}
    return result.stdout

def summarize(audit_result: dict) -> None:
    vulnerabilities = audit_result.get("vulnerabilities", [])
    if not vulnerabilities:
        print("✅ 既知の脆弱性は検出されませんでした")
        return

    print(f"⚠️  {len(vulnerabilities)} 件の脆弱性を検出:")
    for v in vulnerabilities:
        for fix in v.get("fix_versions", []):
            print(f"  📦 {v['name']} {v['version']} → {fix} にアップデート推奨")
            for alias in v.get("aliases", [])[:2]:
                print(f"     CVE: {alias}")

result = run_audit()
summarize(result)

# CI/CD に組み込む場合（GitHub Actions 例）
# - name: Security scan
#   run: |
#     pip install pip-audit
#     pip-audit --format json -o audit.json
#     python check_audit.py   ← このスクリプト