#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
NetScan — console réseau AV, en UN SEUL fichier, ZÉRO dépendance.

Lancer localement :   python3 netscan.py
Depuis le site :      python3 <(curl -s https://TON-SITE/tools/netscan.py)
Accès multi-appareil : python3 netscan.py --lan   (puis http://<ip>:5000)
Changer une IP :      sudo python3 netscan.py

À utiliser uniquement sur un réseau que tu possèdes ou administres.
"""
from __future__ import annotations
import concurrent.futures, ipaddress, json, platform, re, socket
import subprocess, sys, threading, time, webbrowser
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from typing import Dict, List, Optional

"""
Network discovery, device classification, and port-scanning engine.

Standard-library (+ optional psutil for nicer interface enumeration).
Cross-platform: Linux / macOS / Windows.

Discovers and inspects hosts on a network you administer, and classifies
them for AV / stage-control use (projectors, sound consoles, switches,
media servers, cameras...), surfacing each device's web remote page and
control capabilities. It does not authenticate, exploit, or exfiltrate.
"""

import concurrent.futures
import ipaddress
import platform
import re
import socket
import subprocess
import time
from typing import Dict, List, Optional

SYSTEM = platform.system()  # 'Linux', 'Darwin', 'Windows'

# ---------------------------------------------------------------------------
# Well-known ports -> service name (includes AV / stage-control protocols)
# ---------------------------------------------------------------------------
COMMON_PORTS: Dict[int, str] = {
    21: "ftp", 22: "ssh", 23: "telnet", 25: "smtp", 53: "dns",
    67: "dhcp", 80: "http", 110: "pop3", 111: "rpcbind", 123: "ntp",
    135: "msrpc", 137: "netbios", 139: "netbios-ssn", 143: "imap",
    161: "snmp", 389: "ldap", 443: "https", 445: "smb", 465: "smtps",
    500: "isakmp", 515: "printer", 548: "afp", 554: "rtsp", 587: "submission",
    631: "ipp", 993: "imaps", 995: "pop3s", 1080: "socks", 1433: "mssql",
    1521: "oracle", 1723: "pptp", 1883: "mqtt", 1900: "upnp", 2049: "nfs",
    2082: "cpanel", 2375: "docker", 3000: "http-alt", 3306: "mysql",
    3389: "rdp", 5000: "upnp/http", 5060: "sip", 5353: "mdns", 5432: "postgres",
    5555: "adb", 5900: "vnc", 5985: "winrm", 6379: "redis", 7547: "cwmp",
    8000: "http-alt", 8080: "http-proxy", 8443: "https-alt", 8888: "http-alt",
    9000: "http-alt", 9100: "printer-raw", 27017: "mongodb", 32400: "plex",
    49152: "upnp",
    # --- AV / stage / broadcast control ---
    4352: "pjlink", 6454: "art-net", 5568: "sacn", 1710: "q-sys",
    41794: "crestron-cip", 41800: "crestron", 5960: "ndi", 5961: "ndi",
    9090: "web-control", 3702: "ws-discovery", 8899: "onvif",
    16000: "atem", 5250: "vmix", 7000: "airplay", 7100: "font/av",
    5004: "rtp/dante", 4321: "dante", 8751: "dante-arc",
}

DEFAULT_SCAN_PORTS: List[int] = sorted(COMMON_PORTS.keys())

# Fast profiling probe run during discovery so the table shows a type + a
# control link without a manual per-host scan.
QUICK_PORTS: List[int] = [80, 443, 8080, 8000, 8443, 22, 23, 4352, 6454,
                          3389, 5900, 445, 9100, 554, 1710, 8899]

# ---------------------------------------------------------------------------
# OUI (MAC vendor prefix) table — general + AV brands. Convenience subset;
# load_oui_file() plugs in the full IEEE registry for complete coverage.
# ---------------------------------------------------------------------------
OUI_PREFIXES: Dict[str, str] = {
    # general
    "FCFBFB": "Apple", "F0189E": "Apple", "3C0754": "Apple", "A85C2C": "Apple",
    "DCA904": "Apple", "001451": "Apple", "0026BB": "Apple", "F0D1A9": "Apple",
    "B827EB": "Raspberry Pi", "DCA632": "Raspberry Pi", "E45F01": "Raspberry Pi",
    "2CCF67": "Raspberry Pi", "001A11": "Google", "F4F5D8": "Google",
    "A47733": "Google", "F0EF86": "Google", "000C29": "VMware",
    "005056": "VMware", "080027": "VirtualBox", "525400": "QEMU/KVM",
    "0050F2": "Microsoft", "001DD8": "Microsoft", "7C1E52": "Microsoft",
    "F01FAF": "Dell", "00188B": "Dell", "D89EF3": "Dell", "001132": "Synology",
    "0011D8": "ASUSTek", "D850E6": "ASUSTek", "AC220B": "ASUSTek",
    "F832E4": "ASUSTek", "18AF61": "Samsung", "5CF6DC": "Samsung",
    "E8508B": "Samsung", "F008F1": "Samsung", "1C232C": "Samsung",
    "B0A737": "Roku", "DC3A5E": "Roku", "CC6DA0": "Roku",
    "BCDDC2": "Espressif(ESP)", "240AC4": "Espressif(ESP)", "A020A6": "Espressif(ESP)",
    "3C71BF": "Espressif(ESP)", "7CDFA1": "Espressif(ESP)", "D8A01D": "Espressif(ESP)",
    "18FE34": "Espressif(ESP)", "5CCF7F": "Espressif(ESP)",
    # networking gear
    "C46E1F": "TP-Link", "50C7BF": "TP-Link", "9C5322": "TP-Link",
    "AC84C6": "TP-Link", "68FF7B": "TP-Link", "001A70": "Cisco-Linksys",
    "0025B4": "Cisco", "00000C": "Cisco", "F4CFE2": "Cisco",
    "001E2A": "Netgear", "A040A0": "Netgear", "204E7F": "Netgear",
    "C03F0E": "Netgear", "000FB5": "Netgear", "001560": "Belkin",
    "94103E": "Belkin", "EC1A59": "Belkin", "F09FC2": "Ubiquiti",
    "788A20": "Ubiquiti", "245A4C": "Ubiquiti", "802AA8": "Ubiquiti",
    "FCECDA": "Ubiquiti", "B4FBE4": "Ubiquiti", "0418D6": "Ubiquiti",
    "001B54": "Cisco", "3C2C30": "Aruba/HPE", "000B86": "Aruba",
    "94B40F": "Aruba", "6CF37F": "Aruba", "001871": "HP",
    "70106F": "HP", "9457A5": "HP",
    # ---- AUDIO consoles / gear ----
    "0009B6": "Yamaha", "00A0DE": "Yamaha", "AC442A": "Yamaha",
    "00074B": "DigiTech", "001CF0": "Allen & Heath", "0004B7": "Allen & Heath",
    "002196": "DiGiCo", "001CB3": "Midas/Behringer", "0013FD": "Behringer",
    "F44EFD": "Behringer/Music Tribe", "D0BD01": "Music Tribe",
    "001E2D": "Focusrite", "001B66": "Sennheiser", "000B4A": "Shure",
    "0C8CDC": "Shure", "001F79": "L-Acoustics", "0090D6": "QSC",
    "002438": "QSC", "0060EB": "Biamp", "000FD9": "Biamp",
    "0004F2": "Polycom", "000A27": "Apple", "001DBE": "Focusrite/Novation",
    # ---- Dante / audio networking ----
    "001DC1": "Audinate(Dante)", "48A6B8": "Audinate(Dante)",
    "0C8E39": "Audinate(Dante)", "60C5A8": "Audinate(Dante)",
    # ---- VIDEO / projectors ----
    "00000E": "Fujitsu", "3C0518": "Epson", "001125": "Epson",
    "6C626D": "Epson", "005056E": "Christie", "008077": "Brother",
    "0080A3": "Lantronix", "00A06F": "Barco", "00184D": "Barco",
    "0011A0": "NEC", "006097": "NEC", "008046": "Panasonic",
    "F84A73": "Panasonic", "3428C6": "Panasonic", "F0271C": "Panasonic",
    "00036F": "Sony", "FCE998": "Sony", "8CE748": "Sony", "001A80": "Sony",
    "00E091": "LG", "001E75": "LG", "40B0FA": "LG", "0022A1": "Christie",
    "001CC4": "HP/Video", "00040D": "Avaya",
    # ---- VIDEO switching / streaming ----
    "38C986": "Blackmagic", "7CC70D": "Blackmagic", "0016E6": "GigaByte",
    "001E4F": "Dell", "00907F": "WatchGuard", "902B34": "GigaByte",
    "D0577B": "AJA", "0007F8": "Extron", "002480": "Extron",
    "000E1E": "Crestron", "001C57": "Crestron", "C442023": "Crestron",
    # ---- LIGHTING / DMX ----
    "00A051": "ETC", "0080A0": "ETC", "001D42": "MA Lighting",
    "0050C2E": "ChamSys", "70B3D5": "IEEE-Registered(DMX/IoT)",
    # ---- cameras ----
    "00408C": "Axis", "ACCC8E": "Axis", "B8A44F": "Axis",
    "E0507B": "Hikvision", "4419B6": "Hikvision", "C056E3": "Hikvision",
    "BCAD28": "Dahua", "3C1B7E": "Dahua",
    # printers / NAS
    "0011328": "Synology", "245EBE": "QNAP", "00089B": "ICP/QNAP",
    "9C5C8E": "ASRock", "AABBCC": "Locally-administered",
}

# Vendor -> device category (used by classify_device as a strong hint)
VENDOR_CATEGORY: Dict[str, str] = {
    "Yamaha": "console", "Allen & Heath": "console", "DiGiCo": "console",
    "Midas/Behringer": "console", "Behringer": "console",
    "Behringer/Music Tribe": "console", "Music Tribe": "console",
    "QSC": "console", "Biamp": "console", "Focusrite": "audio",
    "Focusrite/Novation": "audio", "Sennheiser": "audio", "Shure": "audio",
    "L-Acoustics": "audio", "Audinate(Dante)": "audio", "DigiTech": "audio",
    "Epson": "projector", "Christie": "projector", "Barco": "projector",
    "NEC": "projector", "Panasonic": "projector", "Sony": "projector",
    "Blackmagic": "video", "AJA": "video", "Extron": "video",
    "Crestron": "control", "ETC": "lighting", "MA Lighting": "lighting",
    "ChamSys": "lighting", "Axis": "camera", "Hikvision": "camera",
    "Dahua": "camera", "Cisco": "network", "Cisco-Linksys": "network",
    "Netgear": "network", "TP-Link": "network", "Ubiquiti": "network",
    "Aruba": "network", "Aruba/HPE": "network", "Belkin": "network",
    "Synology": "nas", "QNAP": "nas", "ICP/QNAP": "nas",
    "Raspberry Pi": "computer", "Apple": "computer", "Dell": "computer",
    "Microsoft": "computer", "VMware": "computer", "VirtualBox": "computer",
    "QEMU/KVM": "computer", "Espressif(ESP)": "iot", "Roku": "media",
    "Google": "media", "Brother": "printer", "HP": "printer",
}

# category -> (label FR, emoji)
CATEGORY_LABELS: Dict[str, tuple] = {
    "projector": ("Projecteur vidéo", "📽️"),
    "console": ("Console son", "🎛️"),
    "audio": ("Audio / Dante", "🔊"),
    "video": ("Vidéo / streaming", "🎬"),
    "lighting": ("Éclairage / DMX", "💡"),
    "control": ("Contrôle / automation", "🕹️"),
    "camera": ("Caméra IP", "📹"),
    "network": ("Switch / réseau", "🔀"),
    "nas": ("NAS / stockage", "🗄️"),
    "printer": ("Imprimante", "🖨️"),
    "media": ("Média / TV", "📺"),
    "computer": ("Ordinateur", "💻"),
    "iot": ("IoT / capteur", "📡"),
    "unknown": ("Inconnu", "❓"),
}

# port -> capability {label, action, scheme}
#   action: 'web' | 'link' | 'info'
PORT_CAPABILITY: Dict[int, dict] = {
    80:   {"label": "Interface web", "action": "web", "scheme": "http"},
    443:  {"label": "Interface web (HTTPS)", "action": "web", "scheme": "https"},
    8080: {"label": "Interface web", "action": "web", "scheme": "http"},
    8000: {"label": "Interface web", "action": "web", "scheme": "http"},
    8443: {"label": "Interface web (HTTPS)", "action": "web", "scheme": "https"},
    8888: {"label": "Interface web", "action": "web", "scheme": "http"},
    9090: {"label": "Interface web", "action": "web", "scheme": "http"},
    631:  {"label": "Interface impression (IPP)", "action": "web", "scheme": "http"},
    4352: {"label": "PJLink (contrôle projecteur)", "action": "info"},
    6454: {"label": "Art-Net (DMX/lumière)", "action": "info"},
    5568: {"label": "sACN / E1.31 (lumière)", "action": "info"},
    1710: {"label": "Q-SYS (contrôle externe)", "action": "info"},
    41794:{"label": "Crestron CIP", "action": "info"},
    8899: {"label": "ONVIF (caméra)", "action": "info"},
    554:  {"label": "Flux RTSP (caméra)", "action": "link", "scheme": "rtsp"},
    5960: {"label": "NDI (vidéo réseau)", "action": "info"},
    22:   {"label": "SSH", "action": "link", "scheme": "ssh"},
    23:   {"label": "Telnet (contrôle série)", "action": "link", "scheme": "telnet"},
    5900: {"label": "VNC (bureau distant)", "action": "link", "scheme": "vnc"},
    3389: {"label": "RDP (bureau distant)", "action": "link", "scheme": "rdp"},
    445:  {"label": "Partage de fichiers (SMB)", "action": "link", "scheme": "smb"},
    548:  {"label": "Partage de fichiers (AFP)", "action": "link", "scheme": "afp"},
    9100: {"label": "Impression brute (RAW)", "action": "info"},
    5353: {"label": "Bonjour/mDNS (Dante, AirPlay…)", "action": "info"},
    161:  {"label": "SNMP (supervision)", "action": "info"},
    32400:{"label": "Serveur Plex", "action": "web", "scheme": "http"},
}


def load_oui_file(path: str) -> int:
    """Load a full IEEE OUI file (oui.txt or a 'PREFIX,Vendor' CSV) at runtime."""
    added = 0
    try:
        with open(path, "r", encoding="utf-8", errors="ignore") as fh:
            for line in fh:
                line = line.strip()
                m = re.match(r"([0-9A-Fa-f]{2})-([0-9A-Fa-f]{2})-([0-9A-Fa-f]{2})\s+\(hex\)\s+(.+)", line)
                if m:
                    pref = (m.group(1) + m.group(2) + m.group(3)).upper()
                    OUI_PREFIXES[pref] = m.group(4).strip()
                    added += 1
                    continue
                if "," in line:
                    pref, _, vendor = line.partition(",")
                    pref = re.sub(r"[^0-9A-Fa-f]", "", pref).upper()[:6]
                    if len(pref) == 6 and vendor.strip():
                        OUI_PREFIXES[pref] = vendor.strip()
                        added += 1
    except OSError:
        pass
    return added


def vendor_from_mac(mac: Optional[str]) -> str:
    if not mac:
        return ""
    clean = re.sub(r"[^0-9A-Fa-f]", "", mac).upper()
    if len(clean) < 6:
        return ""
    try:
        second = int(clean[1], 16)
        local_hint = "Randomized/Local" if (second & 0x2) else ""
    except ValueError:
        local_hint = ""
    return OUI_PREFIXES.get(clean[:6], local_hint)


# ---------------------------------------------------------------------------
# Classification
# ---------------------------------------------------------------------------
def _best_web_remote(ip: str, open_port_nums) -> Optional[str]:
    """Return the best URL to the device's own control page, if any."""
    for p in (443, 8443, 80, 8080, 8000, 8888, 9090, 631, 32400):
        if p in open_port_nums:
            cap = PORT_CAPABILITY.get(p, {})
            scheme = cap.get("scheme", "http")
            suffix = "" if p in (80, 443) else f":{p}"
            return f"{scheme}://{ip}{suffix}/"
    return None


def classify_device(vendor: str, ports: Optional[List[dict]],
                    hostname: str = "") -> dict:
    """Return {category, type_label, icon, web_remote, capabilities[]}.

    `ports` is the list produced by scan_ports (may be None/partial).
    """
    port_nums = {p["port"] for p in ports} if ports else set()
    host_l = (hostname or "").lower()

    # Port-driven category (strong signals first)
    category = None
    if 4352 in port_nums:
        category = "projector"
    elif 6454 in port_nums or 5568 in port_nums:
        category = "lighting"
    elif 1710 in port_nums:
        category = "console"
    elif 8899 in port_nums or 554 in port_nums:
        category = "camera"
    elif 9100 in port_nums or 631 in port_nums or 515 in port_nums:
        category = "printer"
    elif 32400 in port_nums:
        category = "media"

    # Vendor hint
    if category is None and vendor:
        category = VENDOR_CATEGORY.get(vendor)

    # Hostname hint
    if category is None:
        for kw, cat in (("proj", "projector"), ("epson", "projector"),
                        ("console", "console"), ("mix", "console"),
                        ("cam", "camera"), ("switch", "network"),
                        ("ap-", "network"), ("nas", "nas"),
                        ("print", "printer"), ("pi", "computer")):
            if kw in host_l:
                category = cat
                break

    if category is None:
        category = "unknown"

    label, icon = CATEGORY_LABELS.get(category, CATEGORY_LABELS["unknown"])

    # Capabilities from open ports
    caps: List[dict] = []
    if ports:
        for p in ports:
            cap = PORT_CAPABILITY.get(p["port"])
            if cap:
                entry = {"port": p["port"], "label": cap["label"],
                         "action": cap["action"]}
                if cap.get("scheme") and cap["action"] in ("web", "link"):
                    sfx = "" if p["port"] in (80, 443) else f":{p['port']}"
                    entry["url"] = f"{cap['scheme']}://__IP__{sfx}/"
                caps.append(entry)

    web_remote = _best_web_remote("__IP__", port_nums)
    return {"category": category, "type_label": label, "icon": icon,
            "web_remote": web_remote, "capabilities": caps}


# ---------------------------------------------------------------------------
# Interface enumeration
# ---------------------------------------------------------------------------
def _primary_ip() -> Optional[str]:
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        s.connect(("8.8.8.8", 80))
        return s.getsockname()[0]
    except Exception:
        return None
    finally:
        s.close()


def _hexmask_to_dotted(m: str) -> str:
    """macOS gives netmask as hex, e.g. '0xffffff00' -> '255.255.255.0'."""
    m = m.lower().replace("0x", "")
    if len(m) == 8:
        try:
            return ".".join(str(int(m[i:i + 2], 16)) for i in (0, 2, 4, 6))
        except ValueError:
            return "255.255.255.0"
    return m


def _parse_ifconfig(text: str) -> List[dict]:
    """Parse `ifconfig` output (macOS / Linux net-tools)."""
    ifaces: List[dict] = []
    cur = None
    for line in text.splitlines():
        if line and not line[0].isspace():
            name = line.split(":", 1)[0].split()[0].strip()
            cur = {"name": name, "ip": None, "netmask": None, "mac": ""}
            ifaces.append(cur)
        elif cur is not None:
            l = line.strip()
            if l.startswith("ether "):
                cur["mac"] = l.split()[1].lower()
            elif l.startswith("inet ") and "inet6" not in l:
                parts = l.split()
                cur["ip"] = parts[1]
                if "netmask" in parts:
                    nm = parts[parts.index("netmask") + 1]
                    cur["netmask"] = _hexmask_to_dotted(nm) if nm.lower().startswith("0x") else nm
    return ifaces


def _parse_ip_linux() -> List[dict]:
    """Parse iproute2 `ip` output when ifconfig isn't available."""
    ifaces: Dict[str, dict] = {}
    try:
        out = subprocess.run(["ip", "-o", "-4", "addr", "show"],
                             capture_output=True, text=True, timeout=6).stdout
        for line in out.splitlines():
            parts = line.split()
            if len(parts) < 4 or "inet" not in parts:
                continue
            name = parts[1]
            cidr = parts[parts.index("inet") + 1]
            ip, _, pfx = cidr.partition("/")
            try:
                nm = str(ipaddress.IPv4Network(f"0.0.0.0/{pfx}", strict=False).netmask)
            except Exception:
                nm = "255.255.255.0"
            ifaces.setdefault(name, {"name": name, "ip": None, "netmask": None, "mac": ""})
            ifaces[name]["ip"] = ip
            ifaces[name]["netmask"] = nm
        outl = subprocess.run(["ip", "-o", "link", "show"],
                              capture_output=True, text=True, timeout=6).stdout
        for line in outl.splitlines():
            parts = line.split()
            if len(parts) < 2 or "link/ether" not in parts:
                continue
            name = parts[1].rstrip(":")
            mac = parts[parts.index("link/ether") + 1]
            if name in ifaces:
                ifaces[name]["mac"] = mac.lower()
    except Exception:
        pass
    return list(ifaces.values())


def _parse_windows() -> List[dict]:
    """Best-effort parse of `ipconfig /all`."""
    ifaces: List[dict] = []
    cur = None
    try:
        out = subprocess.run(["ipconfig", "/all"], capture_output=True,
                             text=True, timeout=8).stdout
    except Exception:
        return ifaces
    for raw in out.splitlines():
        if raw and not raw[0].isspace() and raw.rstrip().endswith(":"):
            cur = {"name": raw.strip().rstrip(":"), "ip": None, "netmask": None, "mac": ""}
            ifaces.append(cur)
        elif cur is not None:
            l = raw.strip()
            if "Physical Address" in l and ":" in l:
                cur["mac"] = l.split(":", 1)[1].strip().replace("-", ":").lower()
            elif "IPv4 Address" in l:
                m = re.search(r"(\d+\.\d+\.\d+\.\d+)", l)
                if m:
                    cur["ip"] = m.group(1)
            elif "Subnet Mask" in l:
                m = re.search(r"(\d+\.\d+\.\d+\.\d+)", l)
                if m:
                    cur["netmask"] = m.group(1)
    return ifaces


def get_interfaces() -> List[dict]:
    """Return [{name, ip, netmask, cidr, mac, is_primary}] — pure stdlib."""
    primary = _primary_ip()
    raw: List[dict] = []
    try:
        if SYSTEM == "Windows":
            raw = _parse_windows()
        else:
            out = subprocess.run(["ifconfig", "-a"], capture_output=True,
                                 text=True, timeout=6).stdout
            if out.strip():
                raw = _parse_ifconfig(out)
            elif SYSTEM == "Linux":
                raw = _parse_ip_linux()
    except Exception:
        if SYSTEM == "Linux":
            raw = _parse_ip_linux()

    result: List[dict] = []
    for i in raw:
        ip = i.get("ip")
        nm = i.get("netmask") or "255.255.255.0"
        if not ip or ip.startswith("127."):
            continue
        try:
            cidr = str(ipaddress.IPv4Network(f"{ip}/{nm}", strict=False))
        except Exception:
            cidr = None
        result.append({"name": i["name"], "ip": ip, "netmask": nm,
                       "cidr": cidr, "mac": i.get("mac", ""),
                       "is_primary": ip == primary})

    if not result and primary:
        net = ipaddress.IPv4Network(f"{primary}/24", strict=False)
        result.append({"name": "primary", "ip": primary,
                       "netmask": "255.255.255.0", "cidr": str(net),
                       "mac": "", "is_primary": True})
    result.sort(key=lambda r: (not r["is_primary"], r["name"]))
    return result


def suggest_cidr() -> Optional[str]:
    ifaces = get_interfaces()
    for iface in ifaces:
        if iface["is_primary"] and iface.get("cidr"):
            return iface["cidr"]
    for iface in ifaces:
        if iface.get("cidr"):
            return iface["cidr"]
    return None


# ---------------------------------------------------------------------------
# Host discovery
# ---------------------------------------------------------------------------
def _ping(ip: str, timeout_ms: int = 700) -> bool:
    if SYSTEM == "Windows":
        cmd = ["ping", "-n", "1", "-w", str(timeout_ms), ip]
    elif SYSTEM == "Darwin":
        cmd = ["ping", "-c", "1", "-W", str(timeout_ms), ip]
    else:
        cmd = ["ping", "-c", "1", "-W", str(max(1, timeout_ms // 1000)), ip]
    try:
        r = subprocess.run(cmd, stdout=subprocess.DEVNULL,
                           stderr=subprocess.DEVNULL, timeout=timeout_ms / 1000 + 1.5)
        return r.returncode == 0
    except Exception:
        return False


def get_arp_table() -> Dict[str, str]:
    table: Dict[str, str] = {}
    try:
        out = subprocess.run(["arp", "-a"], capture_output=True, text=True, timeout=8).stdout
        if SYSTEM == "Windows":
            for line in out.splitlines():
                m = re.search(r"(\d+\.\d+\.\d+\.\d+)\s+([0-9A-Fa-f]{2}(?:[-:][0-9A-Fa-f]{2}){5})", line)
                if m:
                    table[m.group(1)] = m.group(2).replace("-", ":").lower()
        else:
            for line in out.splitlines():
                m = re.search(r"\((\d+\.\d+\.\d+\.\d+)\)\s+at\s+([0-9A-Fa-f:]{11,17})", line)
                if m:
                    table[m.group(1)] = m.group(2).lower()
    except Exception:
        pass
    if SYSTEM == "Linux":
        try:
            with open("/proc/net/arp") as fh:
                next(fh, None)
                for line in fh:
                    parts = line.split()
                    if len(parts) >= 4 and parts[3] != "00:00:00:00:00:00":
                        table[parts[0]] = parts[3].lower()
        except Exception:
            pass
    return table


def _reverse_dns(ip: str) -> str:
    try:
        return socket.gethostbyaddr(ip)[0]
    except Exception:
        return ""


def _quick_ports(ip: str) -> List[dict]:
    """Fast profile probe (QUICK_PORTS) so the table can classify at a glance."""
    found: List[dict] = []
    with concurrent.futures.ThreadPoolExecutor(max_workers=len(QUICK_PORTS)) as ex:
        futs = [ex.submit(_check_port, ip, p, 0.6) for p in QUICK_PORTS]
        for fut in concurrent.futures.as_completed(futs):
            res = fut.result()
            if res:
                found.append(res)
    found.sort(key=lambda p: p["port"])
    return found


def scan_network(cidr: str, max_workers: int = 100, progress=None) -> List[dict]:
    net = ipaddress.IPv4Network(cidr, strict=False)
    hosts = [str(h) for h in net.hosts()] if net.num_addresses > 2 else [str(net.network_address)]
    total = len(hosts)
    alive: List[str] = []
    done = 0

    with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as ex:
        futures = {ex.submit(_ping, ip): ip for ip in hosts}
        for fut in concurrent.futures.as_completed(futures):
            ip = futures[fut]
            done += 1
            try:
                if fut.result():
                    alive.append(ip)
            except Exception:
                pass
            if progress:
                progress(done, total)

    arp = get_arp_table()
    for ip in arp:
        try:
            if ipaddress.IPv4Address(ip) in net and ip not in alive:
                alive.append(ip)
        except Exception:
            pass

    # reverse DNS + quick profile in parallel
    names: Dict[str, str] = {}
    quick: Dict[str, List[dict]] = {}
    with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as ex:
        dfuts = {ex.submit(_reverse_dns, ip): ip for ip in alive}
        qfuts = {ex.submit(_quick_ports, ip): ip for ip in alive}
        for fut in concurrent.futures.as_completed(dfuts):
            names[dfuts[fut]] = fut.result()
        for fut in concurrent.futures.as_completed(qfuts):
            quick[qfuts[fut]] = fut.result()

    devices: List[dict] = []
    for ip in alive:
        mac = arp.get(ip, "")
        vendor = vendor_from_mac(mac)
        qports = quick.get(ip, [])
        cls = classify_device(vendor, qports, names.get(ip, ""))
        devices.append({
            "ip": ip, "mac": mac, "vendor": vendor,
            "hostname": names.get(ip, ""),
            "ports": None,              # full scan filled on demand
            "quick_ports": qports,      # from fast profile
            "category": cls["category"], "type_label": cls["type_label"],
            "icon": cls["icon"],
            "web_remote": _resolve_ip(cls["web_remote"], ip),
            "capabilities": _resolve_caps(cls["capabilities"], ip),
            "last_seen": time.time(),
        })

    devices.sort(key=lambda d: ipaddress.IPv4Address(d["ip"]))
    return devices


def _resolve_ip(template: Optional[str], ip: str) -> Optional[str]:
    return template.replace("__IP__", ip) if template else None


def _resolve_caps(caps: List[dict], ip: str) -> List[dict]:
    out = []
    for c in caps:
        c = dict(c)
        if "url" in c:
            c["url"] = c["url"].replace("__IP__", ip)
        out.append(c)
    return out


# ---------------------------------------------------------------------------
# Port / service scanning
# ---------------------------------------------------------------------------
def _grab_banner(ip: str, port: int, timeout: float = 1.0) -> str:
    try:
        with socket.create_connection((ip, port), timeout=timeout) as s:
            s.settimeout(timeout)
            if port in (80, 8080, 8000, 8888, 3000, 9000, 9090):
                s.sendall(b"HEAD / HTTP/1.0\r\n\r\n")
            data = s.recv(256)
            text = data.decode("latin-1", "ignore").strip()
            return (text.splitlines()[0] if text else "")[:120]
    except Exception:
        return ""


def _check_port(ip: str, port: int, timeout: float = 0.8) -> Optional[dict]:
    try:
        with socket.create_connection((ip, port), timeout=timeout):
            pass
    except Exception:
        return None
    return {"port": port, "service": COMMON_PORTS.get(port, "unknown"),
            "banner": _grab_banner(ip, port)}


def scan_ports(ip: str, ports: Optional[List[int]] = None,
               max_workers: int = 100) -> List[dict]:
    ports = ports or DEFAULT_SCAN_PORTS
    open_ports: List[dict] = []
    with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as ex:
        futs = [ex.submit(_check_port, ip, p) for p in ports]
        for fut in concurrent.futures.as_completed(futs):
            res = fut.result()
            if res:
                open_ports.append(res)
    open_ports.sort(key=lambda p: p["port"])
    return open_ports


def parse_ports(spec: str) -> List[int]:
    if not spec or not spec.strip():
        return DEFAULT_SCAN_PORTS
    ports: set = set()
    for chunk in spec.split(","):
        chunk = chunk.strip()
        if not chunk:
            continue
        if "-" in chunk:
            a, _, b = chunk.partition("-")
            try:
                lo, hi = int(a), int(b)
                for p in range(min(lo, hi), max(lo, hi) + 1):
                    if 0 < p < 65536:
                        ports.add(p)
            except ValueError:
                continue
        else:
            try:
                p = int(chunk)
                if 0 < p < 65536:
                    ports.add(p)
            except ValueError:
                continue
    return sorted(ports) or DEFAULT_SCAN_PORTS
"""
Change the IP configuration of *this* machine's own interface.

This is deliberately explicit and safe:
  - `build_commands()` returns the exact shell command(s) WITHOUT running them,
    so the UI can show a preview and require confirmation.
  - `apply()` runs them, but only when confirm=True.
  - Changing your own IP can drop your current connection; the UI warns first.

Requires administrator / root privileges to actually apply changes.
"""

import ipaddress
import platform
import subprocess
from typing import List, Optional

SYSTEM = platform.system()


def _mask_to_prefix(netmask: str) -> int:
    return ipaddress.IPv4Network(f"0.0.0.0/{netmask}", strict=False).prefixlen


def _prefix_to_mask(prefix: int) -> str:
    return str(ipaddress.IPv4Network(f"0.0.0.0/{prefix}", strict=False).netmask)


def validate(ip: str, netmask: str, gateway: Optional[str]) -> Optional[str]:
    """Return an error string if the config is invalid, else None."""
    try:
        ipaddress.IPv4Address(ip)
    except Exception:
        return f"Adresse IP invalide : {ip}"
    try:
        prefix = _mask_to_prefix(netmask)
    except Exception:
        return f"Masque invalide : {netmask}"
    if gateway:
        try:
            gw = ipaddress.IPv4Address(gateway)
        except Exception:
            return f"Passerelle invalide : {gateway}"
        net = ipaddress.IPv4Network(f"{ip}/{prefix}", strict=False)
        if gw not in net:
            return "La passerelle n'est pas dans le même sous-réseau que l'IP."
    return None


def build_commands(interface: str, ip: str, netmask: str,
                   gateway: Optional[str] = None, mode: str = "static") -> List[str]:
    """Return the exact command(s) that would be run, as display strings.

    mode: 'static' or 'dhcp'
    """
    if mode == "dhcp":
        if SYSTEM == "Windows":
            return [
                f'netsh interface ip set address name="{interface}" source=dhcp',
                f'netsh interface ip set dns name="{interface}" source=dhcp',
            ]
        elif SYSTEM == "Darwin":
            return [f'networksetup -setdhcp "{interface}"']
        else:  # Linux
            return [
                f"sudo ip addr flush dev {interface}",
                f"sudo dhclient {interface}",
            ]

    prefix = _mask_to_prefix(netmask)
    if SYSTEM == "Windows":
        cmds = [
            f'netsh interface ip set address name="{interface}" static {ip} {netmask}'
            + (f" {gateway} 1" if gateway else "")
        ]
        return cmds
    elif SYSTEM == "Darwin":
        gw = gateway or "empty"
        return [f'networksetup -setmanual "{interface}" {ip} {netmask} {gw}']
    else:  # Linux
        cmds = [
            f"sudo ip addr flush dev {interface}",
            f"sudo ip addr add {ip}/{prefix} dev {interface}",
            f"sudo ip link set {interface} up",
        ]
        if gateway:
            cmds.append(f"sudo ip route replace default via {gateway} dev {interface}")
        return cmds


def apply(interface: str, ip: str, netmask: str,
          gateway: Optional[str] = None, mode: str = "static",
          confirm: bool = False) -> dict:
    """Apply the config. Returns {ok, commands, output, error}.

    Nothing runs unless confirm=True.
    """
    if mode == "static":
        err = validate(ip, netmask, gateway)
        if err:
            return {"ok": False, "commands": [], "output": "", "error": err}

    commands = build_commands(interface, ip, netmask, gateway, mode)

    if not confirm:
        return {"ok": True, "commands": commands, "output": "",
                "error": "", "dry_run": True}

    outputs: List[str] = []
    for cmd in commands:
        try:
            # shell=True so the exact preview command runs as shown
            proc = subprocess.run(cmd, shell=True, capture_output=True,
                                  text=True, timeout=30)
            tag = "OK" if proc.returncode == 0 else f"EXIT {proc.returncode}"
            piece = f"$ {cmd}\n[{tag}] {proc.stdout}{proc.stderr}".strip()
            outputs.append(piece)
            if proc.returncode != 0:
                return {"ok": False, "commands": commands,
                        "output": "\n\n".join(outputs),
                        "error": f"Échec de la commande (voir sortie). "
                                 f"Astuce : lance l'app avec les droits admin/root."}
        except Exception as e:
            outputs.append(f"$ {cmd}\n[ERREUR] {e}")
            return {"ok": False, "commands": commands,
                    "output": "\n\n".join(outputs), "error": str(e)}

    return {"ok": True, "commands": commands,
            "output": "\n\n".join(outputs), "error": ""}
PAGE = r"""<!doctype html>
<html lang="fr">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>NetScan — Console réseau AV</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Syne:wght@600;700;800&family=Plus+Jakarta+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
<style>
  :root{
    --bg:#08080c; --bg-2:#0d0d14; --panel:#111119; --panel-2:#15151f;
    --border:#20202e; --border-2:#2a2a3c;
    --text:#e9e9f2; --muted:#8a8aa0; --dim:#5a5a70;
    --accent:#965af6; --accent-2:#b58bff; --accent-dim:rgba(150,90,246,.14);
    --ok:#38d39f; --warn:#f4b740; --danger:#ff5c72;
    --sans:"Plus Jakarta Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;
    --display:"Syne",var(--sans);
    --mono:"JetBrains Mono",ui-monospace,SFMono-Regular,Menlo,monospace;
    --shadow:0 1px 0 rgba(255,255,255,.03) inset,0 20px 50px rgba(0,0,0,.5);
  }
  *{box-sizing:border-box}
  html,body{background:var(--bg)}
  body{margin:0;font-family:var(--sans);font-size:15px;line-height:1.55;color:var(--text);
    background:
      radial-gradient(900px 500px at 12% -10%,rgba(150,90,246,.10),transparent 60%),
      radial-gradient(700px 400px at 100% 0%,rgba(150,90,246,.06),transparent 55%),
      var(--bg);
    min-height:100vh}
  a{color:var(--accent-2);text-decoration:none}
  header{position:sticky;top:0;z-index:5;backdrop-filter:blur(10px);
    background:rgba(8,8,12,.82);border-bottom:1px solid var(--border);
    padding:15px 26px;display:flex;align-items:center;gap:14px}
  .logo{width:34px;height:34px;border-radius:9px;
    background:linear-gradient(135deg,var(--accent),#5b3aa8);
    display:flex;align-items:center;justify-content:center;color:#fff;
    font-family:var(--display);font-weight:800;font-size:16px;
    box-shadow:0 0 24px rgba(150,90,246,.45)}
  header h1{font-family:var(--display);font-size:19px;margin:0;font-weight:700;letter-spacing:.3px}
  header h1 span{color:var(--accent-2)}
  header .sys{margin-left:auto;color:var(--muted);font-size:12.5px;font-family:var(--mono);
    border:1px solid var(--border);padding:5px 11px;border-radius:8px;background:var(--panel)}
  main{max-width:1240px;margin:0 auto;padding:24px}
  .card{background:linear-gradient(180deg,var(--panel),var(--bg-2));
    border:1px solid var(--border);border-radius:16px;box-shadow:var(--shadow);
    margin-bottom:22px;overflow:hidden}
  .card > h2{font-family:var(--display);font-size:13px;text-transform:uppercase;
    letter-spacing:1.4px;color:var(--muted);margin:0;padding:16px 20px;
    border-bottom:1px solid var(--border);font-weight:700;display:flex;align-items:center;gap:9px}
  .card > h2::before{content:"";width:7px;height:7px;border-radius:99px;background:var(--accent);
    box-shadow:0 0 10px var(--accent)}
  .card .body{padding:20px}
  .row{display:flex;gap:14px;flex-wrap:wrap;align-items:flex-end}
  label{display:block;font-size:11.5px;color:var(--muted);margin-bottom:6px;font-weight:600;
    text-transform:uppercase;letter-spacing:.6px}
  input,select{background:var(--bg-2);border:1px solid var(--border-2);color:var(--text);
    padding:10px 12px;border-radius:10px;font-size:14px;min-width:150px;font-family:var(--sans)}
  input:focus,select:focus{outline:none;border-color:var(--accent);box-shadow:0 0 0 3px var(--accent-dim)}
  input::placeholder{color:var(--dim)}
  button{font-family:var(--sans);background:var(--accent);color:#fff;border:0;padding:11px 18px;
    border-radius:10px;font-size:14px;font-weight:650;cursor:pointer;transition:.15s;
    box-shadow:0 6px 18px rgba(150,90,246,.28)}
  button:hover{background:var(--accent-2);transform:translateY(-1px)}
  button.ghost{background:transparent;color:var(--accent-2);border:1px solid var(--border-2);box-shadow:none}
  button.ghost:hover{background:var(--accent-dim);color:#fff}
  button:disabled{opacity:.45;cursor:not-allowed;transform:none;box-shadow:none}
  button.danger{background:var(--danger);box-shadow:0 6px 18px rgba(255,92,114,.28)}
  .progress{height:7px;background:var(--bg-2);border-radius:99px;overflow:hidden;margin-top:16px;
    border:1px solid var(--border)}
  .progress>i{display:block;height:100%;width:0;
    background:linear-gradient(90deg,var(--accent),var(--accent-2));transition:width .25s;
    box-shadow:0 0 14px var(--accent)}
  .muted{color:var(--muted)} .dim{color:var(--dim)}
  .mono{font-family:var(--mono);font-size:13px}
  table{width:100%;border-collapse:collapse;font-size:14px}
  th,td{text-align:left;padding:12px 15px;border-bottom:1px solid var(--border);white-space:nowrap}
  th{font-size:11px;text-transform:uppercase;letter-spacing:.7px;color:var(--muted);font-weight:700;
    position:sticky;top:0;background:var(--panel);z-index:1}
  tbody tr{cursor:pointer;transition:background .12s}
  tbody tr:hover{background:var(--accent-dim)}
  .tablewrap{overflow-x:auto}
  .type{display:inline-flex;align-items:center;gap:8px;font-weight:600}
  .type .ic{font-size:17px}
  .chip{display:inline-flex;align-items:center;gap:5px;background:var(--panel-2);
    border:1px solid var(--border-2);border-radius:99px;padding:3px 10px;font-size:12px;
    margin:2px 4px 2px 0;color:var(--text)}
  .chip.svc{border-color:var(--accent);color:var(--accent-2);background:var(--accent-dim)}
  .chip.act{cursor:pointer;text-decoration:none}
  .chip.act:hover{background:var(--accent);color:#fff;border-color:var(--accent)}
  .dot{display:inline-block;width:8px;height:8px;border-radius:99px;background:var(--ok);
    margin-right:7px;box-shadow:0 0 8px var(--ok)}
  .remote{display:inline-flex;align-items:center;gap:6px;background:var(--accent-dim);
    border:1px solid var(--accent);color:var(--accent-2);border-radius:8px;padding:5px 11px;
    font-size:12.5px;font-weight:650}
  .remote:hover{background:var(--accent);color:#fff}
  .empty{padding:46px;text-align:center;color:var(--muted)}
  .stat{display:flex;gap:14px;flex-wrap:wrap;padding:18px 20px 2px}
  .stat .s{background:var(--bg-2);border:1px solid var(--border);border-radius:13px;
    padding:12px 18px;min-width:118px}
  .stat .s span{display:block;color:var(--muted);font-size:11px;text-transform:uppercase;letter-spacing:.5px}
  .stat .s b{font-family:var(--display);font-size:23px;font-weight:800}
  /* modal */
  .overlay{position:fixed;inset:0;background:rgba(4,4,8,.72);display:none;align-items:center;
    justify-content:center;z-index:20;padding:20px;backdrop-filter:blur(4px)}
  .overlay.show{display:flex}
  .modal{background:linear-gradient(180deg,var(--panel),var(--bg-2));border:1px solid var(--border-2);
    border-radius:18px;max-width:680px;width:100%;max-height:90vh;overflow:auto;box-shadow:var(--shadow)}
  .modal .head{display:flex;align-items:center;gap:12px;padding:18px 22px;border-bottom:1px solid var(--border);
    position:sticky;top:0;background:var(--panel);z-index:2}
  .modal .head .ic{font-size:24px}
  .modal .head h3{margin:0;font-family:var(--display);font-size:18px;font-weight:700}
  .modal .head .sub{color:var(--muted);font-size:12.5px;font-family:var(--mono)}
  .modal .head button{margin-left:auto;background:transparent;color:var(--muted);font-size:22px;
    padding:0 8px;box-shadow:none}
  .modal .head button:hover{color:var(--text);transform:none}
  .modal .body{padding:22px}
  .kv{display:grid;grid-template-columns:130px 1fr;gap:9px 16px;margin-bottom:18px}
  .kv div:nth-child(odd){color:var(--muted);font-size:13px}
  .sect-title{font-family:var(--display);font-size:12px;text-transform:uppercase;letter-spacing:1px;
    color:var(--muted);margin:18px 0 10px;font-weight:700}
  pre{background:var(--bg-2);border:1px solid var(--border);border-radius:11px;padding:13px;
    overflow:auto;font-size:12.5px;font-family:var(--mono);white-space:pre-wrap;word-break:break-word;color:var(--muted)}
  .banner{background:var(--accent-dim);border:1px solid var(--warn);border-radius:11px;padding:12px 15px;
    font-size:13px;color:var(--text);margin-bottom:16px}
  .split{display:grid;grid-template-columns:1fr 1fr;gap:22px}
  @media (max-width:800px){.split{grid-template-columns:1fr}}
  .bigremote{display:inline-flex;align-items:center;gap:9px;font-weight:700;margin-bottom:4px}
</style>
</head>
<body>
<header>
  <div class="logo">N</div>
  <h1>Net<span>Scan</span> · Console réseau AV</h1>
  <div class="sys" id="sys">…</div>
</header>

<main>
  <!-- SCAN -->
  <section class="card">
    <h2>Découverte du réseau</h2>
    <div class="body">
      <div class="row">
        <div>
          <label>Sous-réseau (CIDR)</label>
          <input id="cidr" placeholder="192.168.1.0/24" style="min-width:210px">
        </div>
        <button id="scanBtn" onclick="startScan()">▸ Scanner le réseau</button>
        <button class="ghost" onclick="loadInterfaces()">↻ Interfaces</button>
      </div>
      <div class="progress"><i id="bar"></i></div>
      <div class="muted mono" id="scanInfo" style="margin-top:10px;font-size:12.5px">Prêt.</div>
    </div>
  </section>

  <!-- RESULTS -->
  <section class="card">
    <h2>Appareils détectés</h2>
    <div class="stat">
      <div class="s"><span>En ligne</span><b id="cnt">0</b></div>
      <div class="s"><span>AV identifiés</span><b id="cntAv">0</b></div>
      <div class="s"><span>Avec page web</span><b id="cntWeb">0</b></div>
      <div class="s"><span>Sous-réseau</span><b id="cntNet" style="font-size:15px;font-family:var(--mono)">—</b></div>
    </div>
    <div class="tablewrap">
      <table>
        <thead><tr><th>Type</th><th>État</th><th>Adresse IP</th><th>Nom d'hôte</th><th>Fabricant</th><th>Contrôle</th></tr></thead>
        <tbody id="rows"><tr><td colspan="6" class="empty">Lance un scan pour cartographier le réseau.</td></tr></tbody>
      </table>
    </div>
  </section>

  <!-- IP CONFIG -->
  <section class="card">
    <h2>Configuration IP de cette machine</h2>
    <div class="body">
      <div class="banner">⚠️ Changer l'IP de cette machine peut couper ta connexion réseau actuelle.
        L'application doit être lancée avec les droits <b>administrateur / root</b> pour appliquer un changement.</div>
      <div class="split">
        <div>
          <div class="row" style="margin-bottom:14px">
            <div style="flex:1"><label>Interface</label>
              <select id="ifSel" style="width:100%" onchange="fillFromIface()"></select></div>
          </div>
          <div class="row" style="margin-bottom:14px">
            <div><label>Mode</label>
              <select id="mode" onchange="toggleMode()">
                <option value="static">IP statique</option>
                <option value="dhcp">DHCP (automatique)</option>
              </select></div>
          </div>
          <div id="staticFields">
            <div class="row" style="margin-bottom:14px">
              <div><label>Adresse IP</label><input id="newip" placeholder="192.168.1.50"></div>
              <div><label>Masque</label><input id="mask" placeholder="255.255.255.0"></div>
            </div>
            <div class="row" style="margin-bottom:14px">
              <div><label>Passerelle (optionnel)</label><input id="gw" placeholder="192.168.1.1"></div>
            </div>
          </div>
          <div class="row">
            <button class="ghost" onclick="previewIp()">Prévisualiser la commande</button>
            <button class="danger" id="applyBtn" onclick="applyIp()" disabled>Appliquer</button>
          </div>
        </div>
        <div>
          <label>Commande(s) qui seront exécutées</label>
          <pre id="cmdPreview">— clique sur « Prévisualiser » —</pre>
          <div id="ipResult" class="muted" style="font-size:13px"></div>
        </div>
      </div>
    </div>
  </section>

  <div class="dim" style="text-align:center;font-size:12px;padding:6px 0 24px">
    NetScan · outil de régie · à utiliser uniquement sur un réseau que tu administres
  </div>
</main>

<!-- device modal -->
<div class="overlay" id="ov" onclick="if(event.target===this)closeModal()">
  <div class="modal">
    <div class="head">
      <span class="ic" id="mIcon">📡</span>
      <div><h3 id="mTitle">Appareil</h3><div class="sub" id="mSub"></div></div>
      <button onclick="closeModal()">×</button>
    </div>
    <div class="body">
      <div id="mRemote" style="margin-bottom:16px"></div>
      <div class="kv" id="mKv"></div>
      <div class="sect-title">Capacités détectées</div>
      <div id="mCaps" class="muted" style="margin-bottom:6px">—</div>
      <div class="sect-title">Ports & services</div>
      <div class="row" style="margin-bottom:14px">
        <div style="flex:1"><label>Ports à scanner (ex: 22,80,443,8000-8100 — vide = ports courants + AV)</label>
          <input id="portSpec" style="width:100%" placeholder="défaut : ports courants + protocoles AV"></div>
        <button id="portBtn" onclick="scanPortsFor()">Scanner les ports</button>
      </div>
      <div id="portArea" class="muted">—</div>
    </div>
  </div>
</div>

<script>
let INTERFACES=[], DEVICES=[], CURRENT=null, POLL=null;
async function jget(u){const r=await fetch(u);return r.json();}
async function jpost(u,b){const r=await fetch(u,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(b||{})});return r.json();}
function esc(s){return (s??'').toString().replace(/[&<>"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]));}

async function loadInterfaces(){
  const d=await jget('/api/interfaces');
  INTERFACES=d.interfaces||[];
  document.getElementById('sys').textContent=(d.system||'?');
  if(d.suggested_cidr && !document.getElementById('cidr').value)
    document.getElementById('cidr').value=d.suggested_cidr;
  const sel=document.getElementById('ifSel');sel.innerHTML='';
  INTERFACES.forEach(i=>{const o=document.createElement('option');
    o.value=i.name;o.textContent=`${i.name} — ${i.ip}${i.is_primary?'  (principale)':''}`;sel.appendChild(o);});
  fillFromIface();
}
function fillFromIface(){
  const i=INTERFACES.find(x=>x.name===document.getElementById('ifSel').value);if(!i)return;
  document.getElementById('newip').value=i.ip||'';
  document.getElementById('mask').value=i.netmask||'255.255.255.0';
}
function toggleMode(){document.getElementById('staticFields').style.display=
  document.getElementById('mode').value==='dhcp'?'none':'block';}

async function startScan(){
  const cidr=document.getElementById('cidr').value.trim();
  const btn=document.getElementById('scanBtn');btn.disabled=true;
  const r=await jpost('/api/scan/start',{cidr});
  if(!r.ok){document.getElementById('scanInfo').textContent='Erreur : '+r.error;btn.disabled=false;return;}
  document.getElementById('cntNet').textContent=r.cidr;
  document.getElementById('scanInfo').textContent='Scan de '+r.cidr+' …';
  if(POLL)clearInterval(POLL);POLL=setInterval(pollScan,600);pollScan();
}
async function pollScan(){
  const s=await jget('/api/scan/status');
  const pct=s.total?Math.round(s.done/s.total*100):0;
  document.getElementById('bar').style.width=pct+'%';
  renderRows(s.devices||[]);
  if(s.running){
    document.getElementById('scanInfo').textContent=`Sondage… ${s.done}/${s.total} adr. (${pct}%) — ${(s.devices||[]).length} appareil(s)`;
  }else{
    clearInterval(POLL);POLL=null;document.getElementById('bar').style.width='100%';
    document.getElementById('scanBtn').disabled=false;
    const n=(s.devices||[]).length;
    document.getElementById('scanInfo').textContent=s.error?('Erreur : '+s.error):`Terminé — ${n} appareil(s) en ligne.`;
  }
}
function renderRows(devs){
  DEVICES=devs;
  document.getElementById('cnt').textContent=devs.length;
  document.getElementById('cntAv').textContent=devs.filter(d=>['projector','console','audio','video','lighting','control','camera'].includes(d.category)).length;
  document.getElementById('cntWeb').textContent=devs.filter(d=>d.web_remote).length;
  const tb=document.getElementById('rows');
  if(!devs.length){tb.innerHTML='<tr><td colspan="6" class="empty">Aucun appareil pour l’instant…</td></tr>';return;}
  tb.innerHTML=devs.map((d,idx)=>{
    const remote=d.web_remote?`<a class="remote" href="${esc(d.web_remote)}" target="_blank" rel="noopener" onclick="event.stopPropagation()">⧉ Ouvrir la page</a>`:'';
    const caps=(d.capabilities||[]).filter(c=>c.action==='info'||!d.web_remote).slice(0,3)
      .map(c=>`<span class="chip svc">${esc(c.label.split(' ')[0])}</span>`).join('');
    return `<tr onclick="openModal(${idx})">
      <td><span class="type"><span class="ic">${d.icon||'❓'}</span>${esc(d.type_label||'Inconnu')}</span></td>
      <td><span class="dot"></span>en ligne</td>
      <td class="mono">${esc(d.ip)}</td>
      <td>${esc(d.hostname)||'<span class="dim">—</span>'}</td>
      <td>${esc(d.vendor)||'<span class="dim">?</span>'}</td>
      <td>${remote||caps||'<span class="dim">—</span>'}</td></tr>`;
  }).join('');
}

// ---- modal ----
function openModal(idx){
  const d=DEVICES[idx];CURRENT=d.ip;
  document.getElementById('mIcon').textContent=d.icon||'📡';
  document.getElementById('mTitle').textContent=d.type_label||'Appareil';
  document.getElementById('mSub').textContent=d.ip+(d.vendor?('  ·  '+d.vendor):'');
  document.getElementById('mKv').innerHTML=
    `<div>Adresse IP</div><div class="mono">${esc(d.ip)}</div>
     <div>Type détecté</div><div>${d.icon||''} ${esc(d.type_label||'Inconnu')}</div>
     <div>Nom d'hôte</div><div>${esc(d.hostname)||'—'}</div>
     <div>MAC</div><div class="mono">${esc(d.mac)||'—'}</div>
     <div>Fabricant</div><div>${esc(d.vendor)||'inconnu'}</div>`;
  document.getElementById('mRemote').innerHTML=d.web_remote
    ?`<a class="remote bigremote" href="${esc(d.web_remote)}" target="_blank" rel="noopener">⧉ Ouvrir la page de contrôle</a>
      <div class="dim mono" style="font-size:12px;margin-top:4px">${esc(d.web_remote)}</div>`
    :'<span class="dim">Pas de page web détectée (scanne les ports pour vérifier).</span>';
  renderCaps(d.capabilities);
  const d2=d;
  if(Array.isArray(d2.ports))renderPorts(d2.ports);
  else if(Array.isArray(d2.quick_ports)&&d2.quick_ports.length)renderPorts(d2.quick_ports,null,true);
  else document.getElementById('portArea').innerHTML='<span class="dim">Clique sur « Scanner les ports » pour l’analyse complète.</span>';
  document.getElementById('ov').classList.add('show');
}
function closeModal(){document.getElementById('ov').classList.remove('show');}
function renderCaps(caps){
  const el=document.getElementById('mCaps');
  if(!caps||!caps.length){el.innerHTML='<span class="dim">Aucune capacité de contrôle détectée pour l’instant.</span>';return;}
  el.innerHTML=caps.map(c=>{
    if((c.action==='web'||c.action==='link')&&c.url)
      return `<a class="chip svc act" href="${esc(c.url)}" target="_blank" rel="noopener">⧉ ${esc(c.label)}</a>`;
    return `<span class="chip svc">${esc(c.label)}</span>`;
  }).join('');
}
async function scanPortsFor(){
  const btn=document.getElementById('portBtn');btn.disabled=true;btn.textContent='Scan…';
  const spec=document.getElementById('portSpec').value.trim();
  document.getElementById('portArea').innerHTML='<span class="muted">Scan des ports en cours…</span>';
  const r=await jpost('/api/ports',{ip:CURRENT,ports:spec});
  btn.disabled=false;btn.textContent='Scanner les ports';
  if(!r.ok){document.getElementById('portArea').textContent='Erreur : '+r.error;return;}
  renderPorts(r.ports,r.scanned);
  // refresh classification live
  const d=DEVICES.find(x=>x.ip===CURRENT);
  if(d){Object.assign(d,{ports:r.ports,category:r.category,type_label:r.type_label,icon:r.icon,web_remote:r.web_remote,capabilities:r.capabilities});}
  document.getElementById('mIcon').textContent=r.icon||'📡';
  document.getElementById('mTitle').textContent=r.type_label||'Appareil';
  document.getElementById('mRemote').innerHTML=r.web_remote
    ?`<a class="remote bigremote" href="${esc(r.web_remote)}" target="_blank" rel="noopener">⧉ Ouvrir la page de contrôle</a>
      <div class="dim mono" style="font-size:12px;margin-top:4px">${esc(r.web_remote)}</div>`
    :'<span class="dim">Pas de page web détectée.</span>';
  renderCaps(r.capabilities);
  renderRows(DEVICES);
}
function renderPorts(ports,scanned,quick){
  const area=document.getElementById('portArea');
  if(!ports.length){area.innerHTML=`<span class="dim">Aucun port ouvert${scanned?` sur ${scanned} testés`:''}.</span>`;return;}
  const note=quick?'<div class="dim" style="font-size:12px;margin-bottom:6px">Aperçu rapide — lance un scan complet pour tout voir.</div>':'';
  area.innerHTML=note+'<table style="margin-top:2px"><thead><tr><th>Port</th><th>Service</th><th>Bannière</th></tr></thead><tbody>'+
    ports.map(p=>`<tr style="cursor:default"><td class="mono">${p.port}</td><td><span class="chip svc">${esc(p.service)}</span></td>
      <td class="mono" style="white-space:normal;color:var(--muted)">${esc(p.banner)||'<span class="dim">—</span>'}</td></tr>`).join('')+
    '</tbody></table>';
}

// ---- ip config ----
function ipBody(){return {interface:document.getElementById('ifSel').value,
  ip:document.getElementById('newip').value.trim(),netmask:document.getElementById('mask').value.trim(),
  gateway:document.getElementById('gw').value.trim(),mode:document.getElementById('mode').value};}
async function previewIp(){
  const r=await jpost('/api/ipconfig/preview',ipBody());
  document.getElementById('cmdPreview').textContent=(r.commands||[]).join('\n')||'—';
  const res=document.getElementById('ipResult');
  if(r.error){res.style.color='var(--danger)';res.textContent='⚠️ '+r.error;document.getElementById('applyBtn').disabled=true;}
  else{res.style.color='var(--muted)';res.textContent='Vérifie la commande, puis clique sur « Appliquer ».';document.getElementById('applyBtn').disabled=false;}
}
async function applyIp(){
  const b=ipBody();
  if(!confirm('Appliquer ce changement d’IP ? Ta connexion réseau actuelle peut être coupée.'))return;
  b.confirm=true;
  const res=document.getElementById('ipResult');res.style.color='var(--muted)';res.textContent='Application en cours…';
  const r=await jpost('/api/ipconfig/apply',b);
  document.getElementById('cmdPreview').textContent=(r.commands||[]).join('\n');
  if(r.ok){res.style.color='var(--ok)';res.innerHTML='✅ Appliqué.<br><pre>'+esc(r.output||'')+'</pre>';}
  else{res.style.color='var(--danger)';res.innerHTML='❌ '+esc(r.error||'Échec')+'<br><pre>'+esc(r.output||'')+'</pre>';}
  setTimeout(loadInterfaces,1500);
}
document.addEventListener('keydown',e=>{if(e.key==='Escape')closeModal();});
loadInterfaces();
</script>
</body>
</html>
"""


# --- single-file namespace shim: let app code call scanner.X / ipconfig.X ---
class _SelfModule:
    def __getattr__(self, name):
        return globals()[name]
scanner = ipconfig = _SelfModule()

"""
NetScan — LAN inventory & AV admin console.

Zero-dependency: uses only the Python standard library (http.server).
Run it, and it opens http://127.0.0.1:5000 in your browser automatically.

Use only on networks you own or are authorized to administer.
"""

import json
import threading
import webbrowser
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer


# ---------------------------------------------------------------------------
# Background scan state (one scan at a time is plenty for a LAN)
# ---------------------------------------------------------------------------
_scan_lock = threading.Lock()
_scan = {
    "running": False, "done": 0, "total": 0,
    "cidr": None, "devices": [], "error": "",
}


def _run_scan(cidr: str) -> None:
    def progress(done, total):
        with _scan_lock:
            _scan["done"] = done
            _scan["total"] = total
    try:
        devices = scanner.scan_network(cidr, progress=progress)
        with _scan_lock:
            _scan["devices"] = devices
            _scan["error"] = ""
    except Exception as e:  # pragma: no cover
        with _scan_lock:
            _scan["error"] = str(e)
    finally:
        with _scan_lock:
            _scan["running"] = False


# ---------------------------------------------------------------------------
# API handlers (return a dict, or (status, dict))
# ---------------------------------------------------------------------------
def _h_interfaces():
    return {"interfaces": scanner.get_interfaces(),
            "suggested_cidr": scanner.suggest_cidr(),
            "system": scanner.SYSTEM}


def _h_scan_status():
    with _scan_lock:
        return {"running": _scan["running"], "done": _scan["done"],
                "total": _scan["total"], "cidr": _scan["cidr"],
                "devices": _scan["devices"], "error": _scan["error"]}


def _h_scan_start(d):
    cidr = (d.get("cidr") or "").strip() or scanner.suggest_cidr()
    if not cidr:
        return 400, {"ok": False, "error": "Aucun sous-réseau détecté."}
    with _scan_lock:
        if _scan["running"]:
            return 409, {"ok": False, "error": "Un scan est déjà en cours."}
        _scan.update(running=True, done=0, total=0, cidr=cidr, devices=[], error="")
    threading.Thread(target=_run_scan, args=(cidr,), daemon=True).start()
    return 200, {"ok": True, "cidr": cidr}


def _h_ports(d):
    ip = (d.get("ip") or "").strip()
    if not ip:
        return 400, {"ok": False, "error": "IP manquante."}
    ports = scanner.parse_ports(d.get("ports", ""))
    open_ports = scanner.scan_ports(ip, ports)

    vendor, hostname = "", ""
    with _scan_lock:
        for dev in _scan["devices"]:
            if dev["ip"] == ip:
                vendor, hostname = dev.get("vendor", ""), dev.get("hostname", "")
                break
    cls = scanner.classify_device(vendor, open_ports, hostname)
    web_remote = scanner._resolve_ip(cls["web_remote"], ip)
    capabilities = scanner._resolve_caps(cls["capabilities"], ip)
    with _scan_lock:
        for dev in _scan["devices"]:
            if dev["ip"] == ip:
                dev.update(ports=open_ports, category=cls["category"],
                           type_label=cls["type_label"], icon=cls["icon"],
                           web_remote=web_remote, capabilities=capabilities)
                break
    return 200, {"ok": True, "ip": ip, "ports": open_ports,
                 "scanned": len(ports), "type_label": cls["type_label"],
                 "icon": cls["icon"], "category": cls["category"],
                 "web_remote": web_remote, "capabilities": capabilities}


def _h_ip_preview(d):
    cmds = ipconfig.build_commands(d.get("interface", ""), d.get("ip", ""),
                                   d.get("netmask", ""), d.get("gateway") or None,
                                   d.get("mode", "static"))
    err = None
    if d.get("mode", "static") == "static":
        err = ipconfig.validate(d.get("ip", ""), d.get("netmask", ""),
                                d.get("gateway") or None)
    return 200, {"ok": err is None, "commands": cmds, "error": err or ""}


def _h_ip_apply(d):
    res = ipconfig.apply(d.get("interface", ""), d.get("ip", ""),
                         d.get("netmask", ""), d.get("gateway") or None,
                         d.get("mode", "static"), confirm=bool(d.get("confirm")))
    return 200, res


# ---------------------------------------------------------------------------
# HTTP server
# ---------------------------------------------------------------------------
class Handler(BaseHTTPRequestHandler):
    def log_message(self, *args):  # keep the console quiet
        pass

    def _send(self, code, body, ctype="application/json"):
        data = body if isinstance(body, bytes) else body.encode("utf-8")
        self.send_response(code)
        self.send_header("Content-Type", ctype + "; charset=utf-8")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        try:
            self.wfile.write(data)
        except (BrokenPipeError, ConnectionResetError):
            pass

    def _json(self, code, obj):
        self._send(code, json.dumps(obj), "application/json")

    def _read_json(self):
        try:
            n = int(self.headers.get("Content-Length", 0) or 0)
            raw = self.rfile.read(n) if n else b"{}"
            return json.loads(raw or b"{}")
        except Exception:
            return {}

    def do_GET(self):
        p = self.path.split("?", 1)[0]
        if p == "/":
            return self._send(200, PAGE, "text/html")
        if p == "/api/interfaces":
            return self._json(200, _h_interfaces())
        if p == "/api/scan/status":
            return self._json(200, _h_scan_status())
        return self._send(404, "not found", "text/plain")

    def do_POST(self):
        p = self.path.split("?", 1)[0]
        d = self._read_json()
        routes = {
            "/api/scan/start": _h_scan_start,
            "/api/ports": _h_ports,
            "/api/ipconfig/preview": _h_ip_preview,
            "/api/ipconfig/apply": _h_ip_apply,
        }
        fn = routes.get(p)
        if not fn:
            return self._send(404, "not found", "text/plain")
        code, obj = fn(d)
        self._json(code, obj)


def main():
    host = "0.0.0.0" if "--lan" in sys.argv else "127.0.0.1"
    port = 5000
    url = f"http://127.0.0.1:{port}"
    server = ThreadingHTTPServer((host, port), Handler)
    print(f"\n  NetScan lancé sur {url}")
    if host == "0.0.0.0":
        print(f"  Accessible sur le réseau : http://<ip-de-cette-machine>:{port}")
    print("  (ferme cette fenêtre ou Ctrl+C pour arrêter)\n")
    print("  Astuce : pour CHANGER une IP, lance avec les droits admin/root.\n")
    try:
        threading.Timer(1.0, lambda: webbrowser.open(url)).start()
    except Exception:
        pass
    try:
        server.serve_forever()
    except KeyboardInterrupt:
        print("\n  Arrêt de NetScan.")
        server.shutdown()


if __name__ == "__main__":
    main()