{% extends "base.html" %}
{% block title %}Cases — psyc{% endblock %}
{% block content %}
<section class="panel">
  <div class="panel-head">
    <h1>Case Queue</h1>
    <span class="count">{{ total }} case{{ '' if total == 1 else 's' }}</span>
  </div>
  <p class="page-intro">Every threat case psyc is tracking — ingested from URLhaus, CISA KEV, Feodo Tracker, ThreatFox, MalwareBazaar, and AlienVault OTX, then classified by severity and TLP. The live queue of what the platform currently knows about; click any case to follow it through the pipeline.</p>
  <details class="page-help">
    <summary>how to use this view</summary>
    <div class="help-body">
      <p><b>How to use.</b> Scan the severity and TLP badges to triage; click any case ID to open its full record and Worker Mesh journey. Run <code>psyc fetch-all</code> to pull fresh cases from the feeds.</p>
      <p><b>What you're seeing.</b> Each row is one normalized Case object — ingested by Scoutline from any of six feeds (URLhaus, CISA KEV, Feodo Tracker, ThreatFox, MalwareBazaar, OTX), then rated by Classifyline.</p>
      <p><b>Why it matters.</b> A defender needs one place that answers "what is happening right now" before deciding what to act on — this queue is that place.</p>
    </div>
  </details>
  {% if not cases %}
    <p class="empty">No cases yet. Run <code>psyc fetch urlhaus</code> to ingest.</p>
  {% else %}
  <table class="cases">
    <thead>
      <tr>
        <th>Case ID</th>
        <th>Ingested</th>
        <th>Severity</th>
        <th>TLP</th>
        <th>Type</th>
        <th>Summary</th>
      </tr>
    </thead>
    <tbody>
    {% for c in cases %}
      <tr class="sev-{{ c.classification.severity.value if c.classification.severity else 'none' }}">
        <td><a href="/cases/{{ c.case_id }}">{{ c.case_id }}</a></td>
        <td class="muted">{{ c.ingested_at.strftime('%Y-%m-%d %H:%M') }}</td>
        <td><span class="sev-badge">{{ c.classification.severity.value if c.classification.severity else '—' }}</span></td>
        <td><span class="tlp-badge tlp-{{ c.classification.tlp.value }}">{{ c.classification.tlp.value }}</span></td>
        <td>{{ c.classification.incident_type.value if c.classification.incident_type else '—' }}</td>
        <td class="summary">{{ c.summary }}</td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% endif %}
</section>
{% endblock %}