Blame · Line-by-line history

`advisories.tsx`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

advisories.tsxBlame371 lines · 1 contributor

Normal view Raw

f60ccdeClaude	1	/**
	2	* Block J2 — Security advisory / dependabot-style alert routes.
	3	*
	4	* GET /:owner/:repo/security/advisories — list open alerts
	5	* GET /:owner/:repo/security/advisories/all — dismissed + fixed too
	6	* POST /:owner/:repo/security/advisories/scan — owner-only; re-scan
	7	* POST /:owner/:repo/security/advisories/:id/dismiss
	8	* POST /:owner/:repo/security/advisories/:id/reopen
	9	*/
	10
	11	import { Hono } from "hono";
	12	import { and, eq } from "drizzle-orm";
	13	import { db } from "../db";
	14	import { repositories, users } from "../db/schema";
	15	import { Layout } from "../views/layout";
	16	import { RepoHeader, RepoNav } from "../views/components";
	17	import { softAuth, requireAuth } from "../middleware/auth";
	18	import type { AuthEnv } from "../middleware/auth";
	19	import { audit } from "../lib/notify";
	20	import {
	21	dismissAlert,
	22	listAlertsForRepo,
	23	reopenAlert,
	24	scanRepositoryForAlerts,
	25	seedAdvisories,
	26	} from "../lib/advisories";
	27
	28	const advisories = new Hono<AuthEnv>();
	29	advisories.use("*", softAuth);
	30
	31	async function loadRepo(ownerName: string, repoName: string) {
	32	const [owner] = await db
	33	.select()
	34	.from(users)
	35	.where(eq(users.username, ownerName))
	36	.limit(1);
	37	if (!owner) return null;
	38	const [repo] = await db
	39	.select()
	40	.from(repositories)
	41	.where(
	42	and(eq(repositories.ownerId, owner.id), eq(repositories.name, repoName))
	43	)
	44	.limit(1);
	45	if (!repo) return null;
	46	return { owner, repo };
	47	}
	48
	49	function severityColor(sev: string): string {
	50	switch (sev) {
	51	case "critical":
	52	return "var(--red)";
	53	case "high":
	54	return "var(--red)";
	55	case "moderate":
	56	return "var(--yellow)";
	57	default:
	58	return "var(--text-muted)";
	59	}
	60	}
	61
	62	// ---------- List ----------
	63
	64	async function renderList(
	65	c: any,
	66	ownerName: string,
	67	repoName: string,
	68	status: "open" \| "all"
	69	) {
	70	const ctx = await loadRepo(ownerName, repoName);
	71	if (!ctx) return c.notFound();
	72	const { repo } = ctx;
	73	const user = c.get("user");
	74	if (repo.isPrivate && (!user \|\| user.id !== repo.ownerId)) {
	75	return c.notFound();
	76	}
	77
	78	const isOwner = !!user && user.id === repo.ownerId;
	79	const alerts = await listAlertsForRepo(repo.id, status);
	80	const message = c.req.query("message");
	81	const error = c.req.query("error");
	82
	83	return c.html(
	84	<Layout
	85	title={`Security advisories — ${ownerName}/${repoName}`}
	86	user={user}
	87	>
	88	<RepoHeader owner={ownerName} repo={repoName} />
	89	<RepoNav owner={ownerName} repo={repoName} active="code" />
	90	<div class="settings-container">
	91	<div style="display:flex;justify-content:space-between;align-items:center">
	92	<h2 style="margin:0">Security advisories</h2>
	93	{isOwner && (
	94	<form
b9968e3Claude	95	method="post"
f60ccdeClaude	96	action={`/${ownerName}/${repoName}/security/advisories/scan`}
	97	>
	98	<button type="submit" class="btn btn-primary btn-sm">
	99	Re-scan
	100	</button>
	101	</form>
	102	)}
	103	</div>
	104	<p style="color:var(--text-muted);margin-top:8px">
	105	Cross-references this repo's parsed dependency graph against a
	106	curated advisory database. Run <em>Reindex</em> on{" "}
	107	<a href={`/${ownerName}/${repoName}/dependencies`}>Dependencies</a>{" "}
	108	first if no alerts show up.
	109	</p>
	110	{message && (
	111	<div class="auth-success" style="margin-top:12px">
	112	{decodeURIComponent(message)}
	113	</div>
	114	)}
	115	{error && (
	116	<div class="auth-error" style="margin-top:12px">
	117	{decodeURIComponent(error)}
	118	</div>
	119	)}
	120
	121	<div style="display:flex;gap:8px;margin:16px 0">
	122	<a
	123	href={`/${ownerName}/${repoName}/security/advisories`}
	124	class={`btn ${status === "open" ? "btn-primary" : ""}`}
	125	>
	126	Open
	127	</a>
	128	<a
	129	href={`/${ownerName}/${repoName}/security/advisories/all`}
	130	class={`btn ${status === "all" ? "btn-primary" : ""}`}
	131	>
	132	All
	133	</a>
	134	</div>
	135
	136	{alerts.length === 0 ? (
	137	<div class="panel-empty" style="padding:24px">
	138	No {status === "open" ? "open " : ""}advisories.
	139	{isOwner &&
	140	status === "open" &&
	141	" Click Re-scan to check against the advisory database."}
	142	</div>
	143	) : (
	144	<div class="panel">
	145	{alerts.map((a) => (
	146	<div
	147	class="panel-item"
	148	style="flex-direction:column;align-items:stretch;gap:6px"
	149	>
	150	<div
	151	style="display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap"
	152	>
	153	<div style="min-width:0">
	154	<span
	155	style={`font-size:10px;padding:2px 6px;border-radius:3px;background:${severityColor(
	156	a.advisory.severity
	157	)};color:#fff;text-transform:uppercase;margin-right:6px`}
	158	>
	159	{a.advisory.severity}
	160	</span>
	161	<span style="font-weight:600">
	162	{a.advisory.summary}
	163	</span>
	164	</div>
	165	<div
	166	style="font-size:10px;padding:2px 6px;border-radius:3px;background:var(--bg-subtle);text-transform:uppercase"
	167	>
	168	{a.status}
	169	</div>
	170	</div>
	171	<div
	172	style="font-size:12px;color:var(--text-muted);display:flex;gap:12px;flex-wrap:wrap"
	173	>
	174	<span style="font-family:var(--font-mono)">
	175	{a.advisory.ecosystem} · {a.dependencyName}
	176	{a.dependencyVersion
	177	? ` ${a.dependencyVersion}`
	178	: ""}
	179	</span>
	180	<span>affected: {a.advisory.affectedRange}</span>
	181	{a.advisory.fixedVersion && (
	182	<span>fixed in ≥ {a.advisory.fixedVersion}</span>
	183	)}
	184	<a
	185	href={`/${ownerName}/${repoName}/blob/HEAD/${a.manifestPath}`}
	186	>
	187	{a.manifestPath}
	188	</a>
	189	{a.advisory.referenceUrl && (
	190	<a
	191	href={a.advisory.referenceUrl}
	192	rel="noreferrer"
	193	target="_blank"
	194	>
	195	{a.advisory.ghsaId \|\| a.advisory.cveId \|\| "ref"}
	196	</a>
	197	)}
	198	</div>
	199	{a.status === "dismissed" && a.dismissedReason && (
	200	<div
	201	style="font-size:12px;color:var(--text-muted);font-style:italic"
	202	>
	203	Dismissed: {a.dismissedReason}
	204	</div>
	205	)}
	206	{isOwner && (
	207	<div style="display:flex;gap:6px">
	208	{a.status === "open" && (
	209	<form
b9968e3Claude	210	method="post"
f60ccdeClaude	211	action={`/${ownerName}/${repoName}/security/advisories/${a.id}/dismiss`}
	212	style="display:flex;gap:4px;align-items:center"
	213	>
	214	<input
	215	type="text"
	216	name="reason"
	217	placeholder="reason (optional)"
	218	maxLength={280}
	219	style="font-size:12px;padding:4px 6px"
	220	/>
	221	<button
	222	type="submit"
	223	class="btn btn-sm"
	224	style="font-size:11px"
	225	>
	226	Dismiss
	227	</button>
	228	</form>
	229	)}
	230	{a.status === "dismissed" && (
	231	<form
b9968e3Claude	232	method="post"
f60ccdeClaude	233	action={`/${ownerName}/${repoName}/security/advisories/${a.id}/reopen`}
	234	>
	235	<button
	236	type="submit"
	237	class="btn btn-sm"
	238	style="font-size:11px"
	239	>
	240	Reopen
	241	</button>
	242	</form>
	243	)}
	244	</div>
	245	)}
	246	</div>
	247	))}
	248	</div>
	249	)}
	250	</div>
	251	</Layout>
	252	);
	253	}
	254
	255	advisories.get("/:owner/:repo/security/advisories", async (c) => {
	256	const { owner: ownerName, repo: repoName } = c.req.param();
	257	return renderList(c, ownerName, repoName, "open");
	258	});
	259
	260	advisories.get("/:owner/:repo/security/advisories/all", async (c) => {
	261	const { owner: ownerName, repo: repoName } = c.req.param();
	262	return renderList(c, ownerName, repoName, "all");
	263	});
	264
	265	// ---------- Re-scan (owner-only) ----------
	266
	267	advisories.post(
	268	"/:owner/:repo/security/advisories/scan",
	269	requireAuth,
	270	async (c) => {
	271	const user = c.get("user")!;
	272	const { owner: ownerName, repo: repoName } = c.req.param();
	273	const ctx = await loadRepo(ownerName, repoName);
	274	if (!ctx) return c.notFound();
	275	const { repo } = ctx;
	276	if (user.id !== repo.ownerId) {
	277	return c.redirect(
	278	`/${ownerName}/${repoName}/security/advisories?error=${encodeURIComponent(
	279	"Only the repo owner can scan"
	280	)}`
	281	);
	282	}
	283	await seedAdvisories().catch(() => {});
	284	const result = await scanRepositoryForAlerts(repo.id);
	285	await audit({
	286	userId: user.id,
	287	repositoryId: repo.id,
	288	action: "advisories.scan",
	289	metadata: result \|\| {},
	290	});
	291	const to = `/${ownerName}/${repoName}/security/advisories`;
	292	if (!result) {
	293	return c.redirect(
	294	`${to}?error=${encodeURIComponent("Scan failed")}`
	295	);
	296	}
	297	const msg = `Scan complete — ${result.opened} new, ${result.closed} closed, ${result.matched} total matches.`;
	298	return c.redirect(`${to}?message=${encodeURIComponent(msg)}`);
	299	}
	300	);
	301
	302	// ---------- Dismiss / reopen (owner-only) ----------
	303
	304	advisories.post(
	305	"/:owner/:repo/security/advisories/:id/dismiss",
	306	requireAuth,
	307	async (c) => {
	308	const user = c.get("user")!;
	309	const { owner: ownerName, repo: repoName, id } = c.req.param();
	310	const ctx = await loadRepo(ownerName, repoName);
	311	if (!ctx) return c.notFound();
	312	const { repo } = ctx;
	313	if (user.id !== repo.ownerId) {
	314	return c.redirect(
	315	`/${ownerName}/${repoName}/security/advisories?error=${encodeURIComponent(
	316	"Only the repo owner can dismiss"
	317	)}`
	318	);
	319	}
	320	const body = await c.req.parseBody();
	321	const reason = String(body.reason \|\| "").trim();
	322	const ok = await dismissAlert(id, repo.id, reason);
	323	await audit({
	324	userId: user.id,
	325	repositoryId: repo.id,
	326	action: "advisories.dismiss",
	327	targetId: id,
	328	metadata: { reason: reason \|\| null },
	329	});
	330	const to = `/${ownerName}/${repoName}/security/advisories`;
	331	return c.redirect(
	332	`${to}?${ok ? "message" : "error"}=${encodeURIComponent(
	333	ok ? "Alert dismissed." : "Dismiss failed"
	334	)}`
	335	);
	336	}
	337	);
	338
	339	advisories.post(
	340	"/:owner/:repo/security/advisories/:id/reopen",
	341	requireAuth,
	342	async (c) => {
	343	const user = c.get("user")!;
	344	const { owner: ownerName, repo: repoName, id } = c.req.param();
	345	const ctx = await loadRepo(ownerName, repoName);
	346	if (!ctx) return c.notFound();
	347	const { repo } = ctx;
	348	if (user.id !== repo.ownerId) {
	349	return c.redirect(
	350	`/${ownerName}/${repoName}/security/advisories?error=${encodeURIComponent(
	351	"Only the repo owner can reopen"
	352	)}`
	353	);
	354	}
	355	const ok = await reopenAlert(id, repo.id);
	356	await audit({
	357	userId: user.id,
	358	repositoryId: repo.id,
	359	action: "advisories.reopen",
	360	targetId: id,
	361	});
	362	const to = `/${ownerName}/${repoName}/security/advisories`;
	363	return c.redirect(
	364	`${to}?${ok ? "message" : "error"}=${encodeURIComponent(
	365	ok ? "Alert reopened." : "Reopen failed"
	366	)}`
	367	);
	368	}
	369	);
	370
	371	export default advisories;