% Vulnerability impact analysis over a transitive dependency graph.
% Services inherit exposure through direct and bounded transitive dependencies.
% High-CVSS vulnerable packages derive risk and mitigation facts; critical
% services additionally receive urgent patch recommendations.

%% goal: uses(X0, X1)

%% goal: impacted_by(X0, X1)

%% goal: risk(X0, X1)

%% goal: mitigate(X0, X1)

%% goal: urgent_patch(X0, X1)


service(webapp).
service(worker).
service(frontend).

critical(webapp).
critical(worker).

depends_on(webapp, api).
depends_on(worker, queue).
depends_on(frontend, ui).
depends_on(api, auth).
depends_on(auth, openssl).
depends_on(queue, openssl).
depends_on(ui, css).

vulnerability(openssl, cve_2026_0001).
cvss(cve_2026_0001, 9.8).
fixed_by(cve_2026_0001, openssl_3_0_14).

vulnerability(css, cve_2026_0002).
cvss(cve_2026_0002, 5.4).
fixed_by(cve_2026_0002, css_2_1_1).

uses(Service, Dependency) :-
  service(Service),
  depends_on(Service, Dependency).

uses(Service, Dependency) :-
  service(Service),
  depends_on(Service, Intermediate),
  depends_on(Intermediate, Dependency).

uses(Service, Dependency) :-
  service(Service),
  depends_on(Service, Intermediate),
  depends_on(Intermediate, Next),
  depends_on(Next, Dependency).

impacted_by(Service, Dependency) :-
  uses(Service, Dependency).

% exposed_to/2 connects dependency reachability to high-severity CVEs.
exposed_to(Service, Vulnerability) :-
  uses(Service, Package),
  vulnerability(Package, Vulnerability),
  cvss(Vulnerability, Score),
  (Score > 7.0).

risk(Service, high) :-
  exposed_to(Service, _vulnerability).

mitigate(Service, Vulnerability) :-
  exposed_to(Service, Vulnerability).

urgent_patch(Service, Patch) :-
  critical(Service),
  exposed_to(Service, Vulnerability),
  fixed_by(Vulnerability, Patch).