@aikidosec/ci-api-client 1.0.0

package/lib/commands/upload.js

@@ -0,0 +1,94 @@
+import { Option } from 'commander';
+import { TUploadPayloadType, uploadCustomScanResult, } from '../aikidoApi.js';
+import { getApiKey } from '../configuration.js';
+import { outputError, outputHttpError, startSpinner, } from '../output.js';
+import { readFile } from 'fs';
+import { promisify } from 'util';
+async function cli(options, command) {
+    const apiKey = getApiKey();
+    if (!apiKey) {
+        outputError('Please set an api key using: aikido-cli apikey <key>');
+    }
+    const { apiOptions, cliOptions } = await parseCliOptions(options);
+    let loader = startSpinner('Uploading custom scan');
+    const onUploadComplete = (result) => {
+        if (result.success === 1) {
+            loader?.succeed('Upload completed');
+        }
+        else {
+            loader?.fail('Upload failed, please verify your payload data and try again');
+            process.exit(10);
+        }
+    };
+    const onUploadFail = (error) => {
+        loader?.fail();
+        outputHttpError(error);
+        process.exit(1);
+    };
+    await upload({
+        data: apiOptions,
+        onUploadComplete,
+        onUploadFail,
+    });
+}
+export const upload = async ({ data, onUploadComplete, onUploadFail, }) => {
+    try {
+        const result = await uploadCustomScanResult(data);
+        onUploadComplete?.(result);
+    }
+    catch (error) {
+        onUploadFail?.(error);
+        return;
+    }
+};
+const parseCliOptions = async (userCliOptions) => {
+    const apiOptions = {
+        repository_id: userCliOptions.repositoryId,
+        container_image_name: userCliOptions.containerImage ?? undefined,
+        payload_type: userCliOptions.type,
+        payload: '',
+    };
+    const cliOptions = {
+        payloadFile: userCliOptions.file,
+        payload: userCliOptions.payload,
+    };
+    if (userCliOptions.type == TUploadPayloadType.JsonSbom) {
+        if (userCliOptions.containerImage === undefined ||
+            userCliOptions.containerImage.trim() === '') {
+            outputError('Please provide a valid container image name with --container-image');
+        }
+    }
+    if (userCliOptions.file) {
+        try {
+            const data = await promisify(readFile)(userCliOptions.file, 'utf8');
+            apiOptions.payload = data;
+        }
+        catch (error) {
+            outputError('Cannot read file provided with --payloadFile, aborting');
+            process.exit(1);
+        }
+    }
+    else if (cliOptions.payload?.trim() != '') {
+        apiOptions.payload = cliOptions.payload;
+    }
+    else {
+        outputError('No payload provided, aborting');
+        process.exit(1);
+    }
+    return { apiOptions, cliOptions };
+};
+const requiredOption = (option) => {
+    option.required = true;
+    return option;
+};
+export const cliSetup = (program) => program
+    .command('upload')
+    .option('-s, --scan-id <scanid>', 'Set the scan id')
+    .requiredOption('-r, --repository-id <repositoryid>', 'Set the repository id')
+    .option('-i, --container-image <container-image-name>', 'Set the container image name. ')
+    .addOption(requiredOption(new Option('-t, --type <type>', 'Set the provided payload type. Available options are: checkov, json-sbom').choices(['checkov', 'json-sbom'])))
+    .option('-f, --file <payloadFile>', 'Specify the payload file. The cli command wil read the file and use the contents as payload data.')
+    .option('-p, --payload <payload>', 'Set the payload')
+    .description('Upload a custom scan result.')
+    .action(cli);
+export default { cli, cliSetup };

package/lib/configuration.d.ts

@@ -0,0 +1,4 @@
+import Configstore from 'configstore';
+export declare const getConfigStore: () => Configstore;
+export declare const getApiKey: () => any;
+export declare const setApiKey: (newApiKey: string) => void;

package/lib/configuration.js

@@ -0,0 +1,13 @@
+import Configstore from 'configstore';
+import { program } from './index.js';
+export const getConfigStore = () => {
+    return new Configstore(program.name());
+};
+export const getApiKey = () => {
+    return program.getOptionValue('apikey')
+        ? program.getOptionValue('apikey')
+        : getConfigStore().get('apikey');
+};
+export const setApiKey = (newApiKey) => {
+    return getConfigStore().set('apikey', newApiKey);
+};

package/lib/index.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+export declare const pkgJson: any;
+export declare const program: Command;
+declare global {
+    namespace NodeJS {
+        interface ProcessEnv {
+            [key: string]: any;
+            QUIET?: boolean;
+            CLI_DEBUG?: boolean | string;
+        }
+    }
+}

package/lib/index.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import chalk from 'chalk';
+import { Command } from 'commander';
+import dotenv from 'dotenv';
+import { readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import apiKey from './commands/apiKey.js';
+import scan from './commands/scan.js';
+import upload from './commands/upload.js';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const __rootdirname = dirname(__dirname);
+dotenv.config(process.env.NODE_ENV ? { path: `.env.${process.env.NODE_ENV}` } : {});
+const pkgJsonPath = join('/', __rootdirname, 'package.json');
+export const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
+export const program = new Command();
+program
+    .name(pkgJson.name)
+    .description(pkgJson.description)
+    .version(pkgJson.version);
+apiKey.cliSetup(program);
+scan.cliSetup(program);
+upload.cliSetup(program);
+program
+    .option('-q, --quiet', 'Disable console output when executing commands')
+    .on('option:quiet', function () {
+    process.env.QUIET = true;
+});
+program
+    .option('--debug', 'Add additional debug information to command output')
+    .on('option:debug', function () {
+    process.env.CLI_DEBUG = true;
+});
+program.option('--apikey <apikey>', 'Use a cli apikey instead of reading the key from the configuration');
+program.configureOutput({
+    outputError: (str, write) => write(chalk.red(str)),
+});
+program.parse();

package/lib/output.d.ts

@@ -0,0 +1,7 @@
+import { Ora } from 'ora';
+import { AxiosError } from 'axios';
+export declare const outputLog: (message: string) => void;
+export declare const outputDebug: (variable: any) => void;
+export declare const outputError: (message: string, exitCode?: number) => void;
+export declare const outputHttpError: (axiosError: AxiosError) => void;
+export declare const startSpinner: (message: string) => Ora | null;

package/lib/output.js

@@ -0,0 +1,53 @@
+import ora from 'ora';
+import { program } from './index.js';
+import chalk from 'chalk';
+export const outputLog = (message) => {
+    if (!process.env.QUIET) {
+        console.log(message);
+    }
+};
+export const outputDebug = (variable) => {
+    if (process.env.CLI_DEBUG == true || process.env.CLI_DEBUG == 'true') {
+        console.log(chalk.blue(typeof variable == 'object' ? JSON.stringify(variable) : variable));
+    }
+};
+export const outputError = (message, exitCode = 1) => {
+    program.error(message, {
+        exitCode,
+    });
+};
+export const outputHttpError = (axiosError) => {
+    if (axiosError.code === 'ECONNREFUSED') {
+        outputError(`Could not connect to Aikido API (${axiosError.message}). Please verify your network settings`);
+    }
+    else if (axiosError.response?.status &&
+        axiosError.response?.status === 401) {
+        outputError('Request failed. The provided api key is most likely no longer valid and has been rotated or revoked. Visit https://app.aikido.dev/settings/integrations/continuous-integration to generate a new key.');
+    }
+    else if (axiosError.response?.status &&
+        axiosError.response?.status === 403) {
+        outputError('Could not authenticate with the Aikido API. Please verify your Aikdio API key.');
+    }
+    else if (axiosError.response?.status &&
+        axiosError.response?.status === 500) {
+        outputError('Something went wrong contacting the Aikido API.');
+    }
+    const statusStr = axiosError.response?.status
+        ? ` (${axiosError.response?.status})`
+        : '';
+    if (axiosError.response) {
+        outputDebug(axiosError.response?.status);
+        outputDebug(axiosError.response?.headers);
+        outputDebug(axiosError.response?.data);
+    }
+    outputError(`Something unexpected went wrong${statusStr}... Please contact us if this problem persists.`);
+};
+export const startSpinner = (message) => {
+    if (process.env.QUIET) {
+        return null;
+    }
+    const spinner = ora(message);
+    spinner.color = 'magenta';
+    spinner.start();
+    return spinner;
+};

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@aikidosec/ci-api-client",
+  "version": "1.0.0",
+  "description": "CLI api client to easily integrate the Aikido public CI API into custom deploy scripts",
+  "license": "MIT",
+  "author": "Bert Devriese <bert@builtinbruges.com>",
+  "private": false,
+  "type": "module",
+  "main": "lib/index.js",
+  "bin": {
+    "aikido-api-client": "./lib/index.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AikidoSec/api-client.git"
+  },
+  "scripts": {
+    "start": "nodemon --watch 'src/**/*.ts' --esm --exec 'ts-node' src/index.ts",
+    "build": "tsc -p .",
+    "local": "yarn build && yarn global add file:$PWD; aikido-api-client",
+    "local-rm": "yarn global remove aikido-api-client",
+    "format": "prettier --write 'src/**/*.ts'",
+    "//": {
+      "refresh": "rm -rf ./node_modules ./yarn.lock && yarn"
+    }
+  },
+  "dependencies": {
+    "axios": "^1.4.0",
+    "chalk": "^5.3.0",
+    "commander": "^11.0.0",
+    "configstore": "^6.0.0",
+    "dotenv": "^16.3.1",
+    "ora": "^6.3.1"
+  },
+  "devDependencies": {
+    "@types/chalk": "^2.2.0",
+    "@types/commander": "^2.12.2",
+    "@types/configstore": "^6.0.0",
+    "@types/dotenv": "^8.2.0",
+    "@types/node": "^20.3.3",
+    "nodemon": "^2.0.22",
+    "prettier": "^2.8.8",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.1.6"
+  },
+  "keywords": [
+    "aikido",
+    "security",
+    "cli"
+  ]
+}

package/src/aikidoApi.ts

@@ -0,0 +1,148 @@
+import axios from 'axios';
+import { getApiKey } from './configuration.js';
+import { outputDebug } from './output.js';
+
+const getApiUrl = () => process.env.AIKIDO_API || 'https://app.aikido.dev';
+const getApiHeaders = () => ({
+  'Content-Type': 'application/json',
+  'X-AIK-API-SECRET': getApiKey(),
+});
+
+// #region Scan start
+export type TScanApiOptions = {
+  repository_id?: string | number;
+  base_commit_id?: string;
+  head_commit_id?: string;
+  branch_name?: string;
+  pull_request_metadata?: {
+    title?: string;
+    url?: string;
+  };
+  self_managed_scanners?: string[];
+  fail_on_dependency_scan?: boolean;
+  fail_on_sast_scan?: boolean;
+  fail_on_iac_scan?: boolean;
+  minimum_severity?: string;
+  version: string;
+};
+
+export type TStartScanResult = {
+  scan_id: number;
+};
+
+// Start a scan with options (see: startScanSchema)
+// and return the data
+export async function startScan(
+  data: TScanApiOptions
+): Promise<TStartScanResult> {
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/repository`;
+  const requestConfig = {
+    method: 'POST',
+    data,
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug(requestConfig);
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}
+// #endregion
+
+// #region Scan polling
+export type TPollIsScanningResult = {
+  all_scans_completed: boolean;
+  dependency_scan_completed: boolean;
+  sast_scan_completed: boolean;
+  iac_scan_completed: boolean;
+  sbom_scan_completed?: boolean;
+};
+
+type TPollScanCompletedOptions = {
+  gate_passed: boolean;
+};
+
+type TPollScanFeatureBranchCompletedOptions = {
+  new_issues_found: number;
+  new_dependency_issues_found: number;
+  new_sast_issues_found: number;
+  new_iac_issues_found: number;
+  diff_url: string;
+};
+
+type TPollScanDefaultBranchCompletedOptions = {
+  open_issues_found: number;
+  issue_links: string[];
+};
+
+export type TPollScanFeatureBranchCompletedResult = TPollIsScanningResult &
+  TPollScanCompletedOptions &
+  TPollScanFeatureBranchCompletedOptions;
+
+export type TPollScanCompletedDefaultBranchResult = TPollIsScanningResult &
+  TPollScanCompletedOptions &
+  TPollScanDefaultBranchCompletedOptions;
+
+export async function pollScanStatus(
+  scanId: number
+): Promise<
+  | TPollIsScanningResult
+  | TPollScanFeatureBranchCompletedResult
+  | TPollScanCompletedDefaultBranchResult
+> {
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/repository`;
+  const requestConfig = {
+    method: 'GET',
+    params: { scan_id: scanId },
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug(requestConfig);
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}
+// #endregion
+
+// #region Upload custom result
+export enum TUploadPayloadType {
+  Checkov = 'checkov',
+  JsonSbom = 'json-sbom',
+}
+
+export type TUploadApiOptions = {
+  scan_id?: number;
+  repository_id: string | number;
+  container_image_name?: string;
+  payload_type: TUploadPayloadType;
+  payload: string;
+};
+
+export type TUploadResult = {
+  success: number;
+};
+
+export async function uploadCustomScanResult(
+  data: TUploadApiOptions
+): Promise<TUploadResult> {
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/custom`;
+  const requestConfig = {
+    method: 'POST',
+    data,
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug(requestConfig);
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}

package/src/commands/apiKey.ts

@@ -0,0 +1,30 @@
+import { Argument, Command } from 'commander';
+import { setApiKey } from '../configuration.js';
+import { outputError, outputLog } from '../output.js';
+
+function cli(apiKey: string): void {
+  if (apiKey && apiKey.trim().length != 128) {
+    outputError('That does not seem right, please verify your api key');
+  }
+
+  setApiKey(apiKey);
+  outputLog(
+    apiKey
+      ? 'Your new Aikido API key has been set'
+      : 'Your Aikido API key has been removed'
+  );
+}
+
+export const cliSetup = (program: Command): Command =>
+  program
+    .command('apikey')
+    .addArgument(
+      new Argument(
+        '<key>',
+        'Your Aikido public CI API key. See also: https://app.aikido.dev/settings/integrations/continuous-integration. To remove your apikey, leave the <key> argument value empty.'
+      ).argOptional()
+    )
+    .description('Set (or remove) your Aikido public CI API key.')
+    .action(cli);
+
+export default { cli, cliSetup };