/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.netbeans.modules.cloud.oracle.adm;

import com.oracle.bmc.adm.ApplicationDependencyManagementClient;
import com.oracle.bmc.adm.model.ApplicationDependency;
import com.oracle.bmc.adm.model.ApplicationDependencyVulnerabilitySummary;
import com.oracle.bmc.adm.model.CreateVulnerabilityAuditDetails;
import com.oracle.bmc.adm.model.SortOrder;
import com.oracle.bmc.adm.model.Vulnerability;
import com.oracle.bmc.adm.model.VulnerabilityAudit;
import com.oracle.bmc.adm.model.VulnerabilityAudit.LifecycleState;
import com.oracle.bmc.adm.model.VulnerabilityAuditConfiguration;
import com.oracle.bmc.adm.model.VulnerabilityAuditSummary;
import com.oracle.bmc.adm.requests.CreateVulnerabilityAuditRequest;
import com.oracle.bmc.adm.requests.ListApplicationDependencyVulnerabilitiesRequest;
import com.oracle.bmc.adm.requests.ListVulnerabilityAuditsRequest;
import com.oracle.bmc.adm.responses.CreateVulnerabilityAuditResponse;
import com.oracle.bmc.adm.responses.ListApplicationDependencyVulnerabilitiesResponse;
import com.oracle.bmc.adm.responses.ListVulnerabilityAuditsResponse;
import com.oracle.bmc.model.BmcException;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.swing.event.ChangeEvent;
import javax.swing.event.ChangeListener;
import org.netbeans.api.editor.mimelookup.MimeRegistration;
import org.netbeans.api.editor.mimelookup.MimeRegistrations;
import org.netbeans.api.lsp.Diagnostic;
import org.netbeans.api.progress.ProgressHandle;
import org.netbeans.api.project.Project;
import org.netbeans.api.project.ProjectUtils;
import org.netbeans.modules.cloud.oracle.OCIManager;
import org.netbeans.modules.project.dependency.ArtifactSpec;
import org.netbeans.modules.project.dependency.Dependency;
import org.netbeans.modules.project.dependency.DependencyResult;
import org.netbeans.modules.project.dependency.ProjectDependencies;
import org.netbeans.modules.project.dependency.Scopes;
import org.netbeans.modules.project.dependency.SourceLocation;
import org.netbeans.spi.lsp.ErrorProvider;
import org.openide.DialogDisplayer;
import org.openide.NotifyDescriptor;
import org.openide.filesystems.FileObject;
import org.openide.util.Exceptions;
import org.openide.util.Lookup;
import org.openide.util.NbBundle;
import org.openide.util.RequestProcessor;

/**
 *
 * @author Petr Pisl
 */
@NbBundle.Messages({
    "# {0} - project name",
    "MSG_Audit_Pass=Vulnerability audit for project {0} is done.\nNo vulnerability was found.",
    "# {0} - project name",
    "MSG_Audit_Failed_One=Vulnerability audit for project {0} is done.\nOne vulnerability was found.\nThe vulnerability is listed in Problems window.",
    "# {0} - project name",
    "# {1} - number of vulnerabilities",
    "MSG_Audit_Failed_More=Vulnerability audit for project {0} is done.\n{1} vulnerabilities were found.\nThe vulnerabilities are listed in Problems window.",
    "# {0} - project name",
    "MSG_CreatingAuditFailed=Creating Vulnerablity audit for project {0} failed.",
    "# {0} - project name",
    "MSG_ListingAuditFailed=Obtaining newly created vulnerablity audit for project {0} failed.",
    "MSG_ListingVulnerabilitiesFailed=Obtaining vulnerabilities for newly created audit failed.",
    "# {0} - project name",
    "MSG_AuditIsRunning=Audit of {0} project is running ...",
    "MSG_NotAvailable=Not available",
    "MSG_Diagnostic=Vulnerability\n"
            + "  Cvss V2 Score: %s\n"
            + "  Cvss V3 Score: %s\n"
            + "  Caused by dependence: %s"
})
 
@MimeRegistrations({
    @MimeRegistration(mimeType = "text/x-maven-pom+xml", service = ErrorProvider.class),
    @MimeRegistration(mimeType = "text/x-gradle+x-groovy", service = ErrorProvider.class)  
})

public class VulnerabilityWorker implements ErrorProvider{
    private static final RequestProcessor SOURCE_REFRESH_PROCESSOR = new RequestProcessor(VulnerabilityWorker.class.getName());
    
    private static final Logger LOG = Logger.getLogger(VulnerabilityWorker.class.getName());
    
    // PENDING: should be customizable from project configuration somehow.
    private static final String GOV_DETAIL_URL = "https://nvd.nist.gov/vuln/detail/";
    
    // @GuardedBy(self)
    private static final HashMap<Project, CacheItem> cache = new HashMap();
    
    // @GuardedBy(class)
    private static VulnerabilityWorker instance;

    /**
     * Cached information + watcher over the project file data. Will watch for dependency change event,
     * that is fired e.g. after project reload, and will REPLACE ITSELF in the cache + fire
     * event that causes LSP to re-evaluate errors for the affected project file(s).
     */
    static class CacheItem {
        private final Project project;
        private final DependencyResult dependencyResult;
        private final VulnerabilityReport report;

        /**
         * Maps GAV -> dependency.
         */
        private Map<String, Dependency> dependencyMap;
        
        // @GuardedBy(this)
        private ChangeListener depChange;
        
        // @GuardedBy(this)
        private RequestProcessor.Task pendingRefresh;

        public CacheItem(Project project, DependencyResult dependency, VulnerabilityReport report) {
            this.project = project;
            this.dependencyResult = dependency;
            this.report = report;
        }

        public DependencyResult getDependency() {
            return dependencyResult;
        }

        public VulnerabilityAuditSummary getAudit() {
            return report.summary;
        }

        public List<ApplicationDependencyVulnerabilitySummary> getVulnerabilities() {
            return report.items;
        }

        public Map<String, Dependency> getDependencyMap() {
            if (dependencyMap == null) {
                dependencyMap = new HashMap();
                buildDependecyMap(dependencyResult.getRoot(), dependencyMap);
            }
            return dependencyMap;
        }
        
        private void buildDependecyMap(Dependency dependency, Map<String, Dependency> result) {
            String gav = createGAV(dependency.getArtifact());
            if (result.putIfAbsent(gav, dependency) == null) {
                dependency.getChildren().forEach((childDependency) -> {
                    buildDependecyMap(childDependency, result);
                });
            }
        }
        
        public Set<FileObject> getProblematicFiles() {
            if (getAudit().getIsSuccess()) {
                return Collections.EMPTY_SET;
            }
            Set<FileObject> result = new HashSet();
            for (ApplicationDependencyVulnerabilitySummary v: getVulnerabilities()){
                List<Vulnerability> vulnerabilities = v.getVulnerabilities();
                if (!vulnerabilities.isEmpty()) {
                    Dependency dep = getDependencyMap().get(v.getGav());
                    if (dep != null) {
                        try {
                            SourceLocation declarationRange = this.dependencyResult.getDeclarationRange(dep, null);
                            if (declarationRange == null) {
                                declarationRange = this.dependencyResult.getDeclarationRange(dep, DependencyResult.PART_CONTAINER);
                            }
                            if(declarationRange != null  && declarationRange.getFile() != null) {
                                result.add(declarationRange.getFile());
                            }
                        } catch (IOException ex) {
                            // expected, ignore.
                        }
                    }
                }
            }
            return result;
        }
        
        void refreshDependencies(RequestProcessor.Task t) {
            DependencyResult dr = ProjectDependencies.findDependencies(project, ProjectDependencies.newQuery(Scopes.RUNTIME));
            LOG.log(Level.FINER, "{0} - dependencies refreshed", this);
            synchronized (this) {
                if (pendingRefresh != t) {
                    return;
                }
            }
            synchronized (this) {
                if (depChange != null) {
                    dependencyResult.removeChangeListener(depChange);
                }
            }
            CacheItem novy = new CacheItem( project, dr, report);
            if (LOG.isLoggable(Level.FINER)) {
                LOG.log(Level.FINER, "{0} - trying to replace for {1}", new Object[] { this, novy });
            }
            if (replaceCacheItem(this, novy)) {
                novy.startListening();
                Diagnostic.ReporterControl reporter = Diagnostic.findReporterControl(Lookup.getDefault(), project.getProjectDirectory());
                Set<FileObject> allFiles = new HashSet<>();
                allFiles.addAll(getProblematicFiles());
                allFiles.addAll(novy.getProblematicFiles());
                if (LOG.isLoggable(Level.FINER)) {
                    LOG.log(Level.FINER, "{0} - refreshing files: {1}", new Object[] { this, allFiles });
                }
                reporter.diagnosticChanged(novy.getProblematicFiles(), null);
            }
        }
        
        void scheduleDependencyRefresh(ChangeEvent e) {
            synchronized (this) {
                if (pendingRefresh != null) {
                    pendingRefresh.cancel();
                }
                
                RequestProcessor.Task[] task = new RequestProcessor.Task[1];
                if (LOG.isLoggable(Level.FINER)) {
                    LOG.log(Level.FINER, "{0} - scheduling refresh for {1}", new Object[] { this, project });
                }
                pendingRefresh = task[0] = SOURCE_REFRESH_PROCESSOR.post(() -> {
                    synchronized (this) {
                        refreshDependencies(task[0]);
                    }
                });
            }
        }
        
        SourceLocation getDependencyRange(Dependency d) throws IOException {
            return getDependencyRange(d, null);
        }
        
        void startListening() {
            synchronized (this) {
                if (depChange == null) {
                    dependencyResult.addChangeListener(depChange = this::scheduleDependencyRefresh);
                    LOG.log(Level.FINER, "{0} - start listen for dependencies", this);
                }
            }
        }
        
        SourceLocation getDependencyRange(Dependency d, String part) throws IOException {
            startListening();
            return dependencyResult.getDeclarationRange(d, part);
        }
        
        public List<Diagnostic> getDiagnosticsForFile(FileObject file) {
            if (LOG.isLoggable(Level.FINER)) {
                LOG.log(Level.FINER, "{0} getDiagnostics called for {1}", new Object[] { this, file });
            }
            if (getVulnerabilities() == null || getVulnerabilities().isEmpty()) {
                return null;
            }
            
            List<Diagnostic> result = new ArrayList();
            for (ApplicationDependencyVulnerabilitySummary v: getVulnerabilities()){
                List<Vulnerability> vulnerabilities = v.getVulnerabilities();
                if (!vulnerabilities.isEmpty()) {
                    startListening();
                    Dependency dependency = getDependencyMap().get(v.getGav());
                    SourceLocation declarationRange = null;
                    
                    if (dependency != null) {
                        try {
                            declarationRange = getDependencyRange(dependency);
                        } catch (IOException ex) {
                            Exceptions.printStackTrace(ex);
                        }
                    }
                    // display the vulnerabilities that were never mapped on the dependency container's line.
                    // also display the vulnerabilities that we KNOW about, but do can not map them back to the project file, i.e.
                    // plugin-introduced dependencies (gradle).
                    if (declarationRange == null && (dependency != null || !report.mappedVulnerabilities.contains(v.getGav()))) {
                        try {
                            if (LOG.isLoggable(Level.FINER)) {
                                LOG.log(Level.FINER, "{0} getDiagnostics called for {1}", new Object[] { this, file });
                            }

                            declarationRange = getDependencyRange(dependency, DependencyResult.PART_CONTAINER);
                            if (declarationRange != null) {
                                // discard end location, since it could span a whole section
                                declarationRange = new SourceLocation(declarationRange.getFile(), 
                                        declarationRange.getStartOffset(), declarationRange.getStartOffset(), null);
                            }
                        } catch (IOException ex) {
                            // ignore
                        }                            
                    }

                    if (declarationRange != null && declarationRange.hasPosition() && declarationRange.getFile().equals(file)) {
                        final SourceLocation fDeclarationRange = declarationRange;
                        for(Vulnerability vulnerability: vulnerabilities) {
                            String message = String.format(Bundle.MSG_Diagnostic(), 
                                    formatCvssScore(vulnerability.getCvssV2Score()), 
                                    formatCvssScore(vulnerability.getCvssV3Score()), 
                                    createGAV(dependency.getArtifact()));
                            Diagnostic.Builder builder = Diagnostic.Builder.create(() -> fDeclarationRange.getStartOffset(), () -> fDeclarationRange.getEndOffset(), message);
                            builder.setSeverity(Diagnostic.Severity.Warning).setCode(vulnerability.getId());
                            try {
                                builder.setCodeDescription(new URL(GOV_DETAIL_URL + vulnerability.getId()));
                            } catch (MalformedURLException ex) {
                                // perhaps should not happen at all
                                LOG.log(Level.INFO, "Could not link to vulnerability: {0}", vulnerability.getId());
                            }
                            result.add(builder.build());
                        }
                    }
                }
            }
            return result;
        }
        
        private String formatCvssScore(Float value) {
            if (value != null) {
                return String.format("%.2f", value);
            }
            return Bundle.MSG_NotAvailable();
        }
    }
    
    private static boolean replaceCacheItem(CacheItem old, CacheItem novy) {
        synchronized (cache) {
            CacheItem registered = cache.get(old.project);
            if (registered != old) {
                return false;
            }
            cache.put(novy.project, novy);
        }
        return true;
    }
    
    private VulnerabilityWorker() {
    }

    public static VulnerabilityWorker getInstance() {
        synchronized (VulnerabilityWorker.class) {
            if (instance == null) {
                instance = new VulnerabilityWorker();

            }
        }
        return instance;
    }

    public void findVulnerability(Project project, boolean forceAudit) {
        LOG.log(Level.FINER, "Trying to obtain audit for project {0}, force:{1}", new Object[] { project, forceAudit });
        final String projectDisplayName = ProjectUtils.getInformation(project).getDisplayName();
        KnowledgeBaseItem kbItem = getKnowledgeBaseForProject(project);
        if (kbItem == null) {
            return;
        }
        
        // remove from the cache old values
        ProgressHandle progressHandle = ProgressHandle.createHandle(Bundle.MSG_AuditIsRunning(projectDisplayName));
        progressHandle.start();
        try {
            doFindVulnerability(project, kbItem.compartmentId, kbItem.getKey().getValue(), 
                    projectDisplayName, progressHandle, forceAudit);
        } finally {
            progressHandle.finish();
            kbItem.refresh();
        }
    }

    public void doFindVulnerability(Project project, String compartmentId, String knowledgeBaseId, String projectDisplayName,
            ProgressHandle progressHandle, boolean forceAudit) {
        DependencyResult dr = ProjectDependencies.findDependencies(project, ProjectDependencies.newQuery(Scopes.RUNTIME));
        List<ApplicationDependency> result = new ArrayList();
        convert(dr.getRoot(), new HashMap<>(), result);
        
        CacheItem cacheItem = null;
        VulnerabilityReport savedAudit = null;
        
        if (!forceAudit) {
            try {
                savedAudit = AuditCache.getInstance().loadAudit(knowledgeBaseId);
            } catch (IOException ex) {
                LOG.log(Level.WARNING, "Could not load cached audit data", ex);
            }
        }
        
        boolean auditDone = false;
        
        if (!forceAudit && savedAudit == null) {
            // attempt to find an active most recent audit:
            try (ApplicationDependencyManagementClient admClient
                    = new ApplicationDependencyManagementClient(OCIManager.getDefault().getConfigProvider())) {
                ListVulnerabilityAuditsRequest request = ListVulnerabilityAuditsRequest
                        .builder()
                        .compartmentId(compartmentId)
                        .knowledgeBaseId(knowledgeBaseId)
                        .lifecycleState(LifecycleState.Active)
                        .sortBy(ListVulnerabilityAuditsRequest.SortBy.TimeCreated)
                        .sortOrder(SortOrder.Desc).build();
                ListVulnerabilityAuditsResponse response = admClient.listVulnerabilityAudits(request);
                if (!response.getVulnerabilityAuditCollection().getItems().isEmpty()) {
                    VulnerabilityAuditSummary summary = response.getVulnerabilityAuditCollection().getItems().get(0);
                    cacheItem = fetchVulnerabilityItems(project, admClient, dr, summary, projectDisplayName);
                    savedAudit = new VulnerabilityReport(cacheItem.getAudit(), cacheItem.getVulnerabilities());
                }
            } catch (BmcException ex) {
                LOG.log(Level.FINE, "Unable to list newest audit for knowledgebase {0}, compartment {1}", new Object[] {
                    knowledgeBaseId, compartmentId
                });
            }
        }
        
        if (savedAudit == null && forceAudit) {
            try (ApplicationDependencyManagementClient admClient
                    = new ApplicationDependencyManagementClient(OCIManager.getDefault().getConfigProvider())) {
                final VulnerabilityAuditConfiguration auditConfiguration = VulnerabilityAuditConfiguration
                        .builder()
                        .maxPermissibleCvssV2Score(1f)
                        .maxPermissibleCvssV3Score(1f)
                        .exclusions(Collections.unmodifiableList(Collections.EMPTY_LIST))
                        .build();
                final CreateVulnerabilityAuditDetails auditDetails = CreateVulnerabilityAuditDetails
                        .builder()
                        .compartmentId(compartmentId)
                        .knowledgeBaseId(knowledgeBaseId)
                        .displayName(projectDisplayName.replaceAll("[^A-Za-z0-9-_]", "_")) // remove offending characters
                        .buildType(VulnerabilityAudit.BuildType.Maven)
                        .configuration(auditConfiguration)
                        .applicationDependencies(result)
                        .build();
                CreateVulnerabilityAuditResponse response = admClient.createVulnerabilityAudit(CreateVulnerabilityAuditRequest
                        .builder()
                        .createVulnerabilityAuditDetails(auditDetails)
                        .build());
                if (response.get__httpStatusCode__() != 201 && response.get__httpStatusCode__() != 200) {
                    ErrorUtils.processError(response, Bundle.MSG_CreatingAuditFailed(projectDisplayName));
                    return;
                }
                // audit is ok
                cacheItem = waitToAuditFinish(project, admClient, dr, response.getVulnerabilityAudit(), projectDisplayName);
                auditDone = true;
            } catch (BmcException exc) {
                ErrorUtils.processError(exc, compartmentId);
                return;
            } finally {
                progressHandle.finish();
            }
        } else if (savedAudit != null) {
            cacheItem = new CacheItem(project, dr, savedAudit);
        }

        if (cacheItem != null) {
            synchronized (cache) {
                cache.put(project, cacheItem);
            }

            Set<FileObject> problematicFiles = new HashSet();
            problematicFiles.addAll(cacheItem.getProblematicFiles());

            String message;
            if (cacheItem.getAudit().getIsSuccess()) {
                message = Bundle.MSG_Audit_Pass(projectDisplayName);
                problematicFiles.addAll(dr.getDependencyFiles());
            } else if(cacheItem.getAudit().getVulnerableArtifactsCount() == 1) {
                message = Bundle.MSG_Audit_Failed_One(projectDisplayName);
            } else {
                message = Bundle.MSG_Audit_Failed_More(projectDisplayName, cacheItem.getAudit().getVulnerableArtifactsCount());
            }
            if (auditDone) {
                DialogDisplayer.getDefault().notifyLater(
                                new NotifyDescriptor.Message(message));
            }
            Diagnostic.ReporterControl reporter = Diagnostic.findReporterControl(Lookup.getDefault(), project.getProjectDirectory());
            reporter.diagnosticChanged(problematicFiles, null);
        }
    }
    
    public static KnowledgeBaseItem getKnowledgeBaseForProject(Project project) {
        ProjectVulnerability vs = project.getLookup().lookup(ProjectVulnerability.class);
        return vs != null ? vs.getProjectKnowledgeBase() : null;
    }
    
    private int convert(Dependency dependency, Map<String, Integer> gavIndex, List<ApplicationDependency> result) {
        String gav = createGAV(dependency.getArtifact());
        Integer n = gavIndex.get(gav);
        if (n != null) {
            return n;
        }
        gavIndex.put(gav, n = gavIndex.size() + 1);
        ApplicationDependency.Builder builder = ApplicationDependency.builder();
        builder.gav(gav);
        builder.nodeId(Integer.toString(n));
        
        List<String> childrenNodeIds = new ArrayList(dependency.getChildren().size());
        for (Dependency childDependency : dependency.getChildren()) {
            int cid = convert(childDependency, gavIndex, result);
            childrenNodeIds.add(Integer.toString(cid));
        }
        builder.applicationDependencyNodeIds(childrenNodeIds);
        result.add(builder.build());
        return n;
    }

    private static String createGAV(ArtifactSpec artifact) {
        StringBuffer sb = new StringBuffer();
        sb.append(artifact.getGroupId()).append(':');
        sb.append(artifact.getArtifactId()).append(':');
        sb.append(artifact.getVersionSpec());
        return sb.toString();
    }

    private CacheItem waitToAuditFinish(Project project, ApplicationDependencyManagementClient client, 
            DependencyResult dr, VulnerabilityAudit audit, String projectName) {                
        ListVulnerabilityAuditsRequest request = ListVulnerabilityAuditsRequest.builder()
                .knowledgeBaseId(audit.getKnowledgeBaseId()).id(audit.getId()).build();
        VulnerabilityAuditSummary auditSummary;
        boolean first = true;
        do {
            if (first) {
                first = false;
            } else {
                try {
                    Thread.sleep(1000);
                } catch (InterruptedException ex) {
                    Exceptions.printStackTrace(ex);
                }
            }
            ListVulnerabilityAuditsResponse response = client.listVulnerabilityAudits(request);
            if (response.get__httpStatusCode__() != 200) {
                ErrorUtils.processError(response, Bundle.MSG_ListingAuditFailed(projectName));
                return null;
            }
            List<VulnerabilityAuditSummary> items = response.getVulnerabilityAuditCollection().getItems();
            auditSummary = items.get(0);
        } while (auditSummary.getLifecycleState() == VulnerabilityAudit.LifecycleState.Creating);
        return fetchVulnerabilityItems(project, client, dr, auditSummary, projectName);
    }
    
    private CacheItem fetchVulnerabilityItems(Project project, ApplicationDependencyManagementClient client, 
            DependencyResult dr, VulnerabilityAuditSummary auditSummary, String projectName) {
        List<ApplicationDependencyVulnerabilitySummary> items = new ArrayList<>();
        if (auditSummary.getVulnerableArtifactsCount() > 0) {
            String nextPage = null;
            do {
                ListApplicationDependencyVulnerabilitiesRequest.Builder b = ListApplicationDependencyVulnerabilitiesRequest.builder().vulnerabilityAuditId(auditSummary.getId());
                if (nextPage != null) {
                    b.page(nextPage);
                }
                ListApplicationDependencyVulnerabilitiesRequest advRequest = b.build();
                ListApplicationDependencyVulnerabilitiesResponse vulners = client.listApplicationDependencyVulnerabilities(advRequest);
                if (vulners.get__httpStatusCode__() == 200) {
                    vulners.getApplicationDependencyVulnerabilityCollection().getItems().stream().filter(v -> !v.getVulnerabilities().isEmpty())
                            .forEach(v -> items.add(v));
                } else {
                    ErrorUtils.processError(vulners, Bundle.MSG_ListingVulnerabilitiesFailed());
                    return null;
                }
                nextPage = vulners.getOpcNextPage();
            } while (nextPage != null);
        }
        // Make an initial scan for the dependency locations in the Dependency report. 
        Set<String> mapped = new HashSet<>();
        VulnerabilityReport report = new VulnerabilityReport(auditSummary, items);
        CacheItem cache = new CacheItem(project, dr, report);
        for (ApplicationDependencyVulnerabilitySummary v : items) {
            List<Vulnerability> vulnerabilities = v.getVulnerabilities();
            if (!vulnerabilities.isEmpty()) {
                Dependency dependency = cache.getDependencyMap().get(v.getGav());
                if (dependency != null) {
                    mapped.add(v.getGav());
                }
            }
        }
        report.setMappedVulnerabilities(mapped);
        
        try {
            AuditCache.getInstance().cacheAuditResults(report);
        } catch (IOException ex) {
            LOG.log(Level.WARNING, "Could not cache audit results for knowledgebase {0}, compartment {1}, project {2}", new Object[] {
                auditSummary.getKnowledgeBaseId(), auditSummary.getCompartmentId(),
                projectName
            });
            LOG.log(Level.WARNING, "The exception was: ", ex);
        }
        return cache;
    }
    
    @Override
    public List<? extends Diagnostic> computeErrors(Context context) {
        List<Diagnostic> result = new ArrayList();
        Collection<CacheItem> items;
        
        synchronized (cache) {
            items = new ArrayList<>(cache.values());
        }
        for (CacheItem cacheItem : items) {
            List<Diagnostic> diagnostics = cacheItem.getDiagnosticsForFile(context.file());
            if (diagnostics != null) {
                result.addAll(cacheItem.getDiagnosticsForFile(context.file()));
            }
        }
        return result;
    }
}