@docupace/pipeline 1.0.128 → 1.0.130

package/src/xray/notify.test.js

@@ -0,0 +1,161 @@
+import { describe, expect, jest, test } from '@jest/globals';
+import { notify } from './notify.js';
+
+function makeReadFile(files) {
+  return (path) => {
+    if (!(path in files)) {
+      const err = new Error(`ENOENT: ${path}`);
+      err.code = 'ENOENT';
+      throw err;
+    }
+    return files[path];
+  };
+}
+
+describe('notify', () => {
+  test('skips Slack entirely when the report-args file is missing', async () => {
+    const log = jest.fn();
+    const post = jest.fn();
+    const result = await notify({
+      reportArgsFile: '/tmp/does-not-exist',
+      readFile: makeReadFile({}),
+      post,
+      log,
+      delay: jest.fn(),
+    });
+
+    expect(result).toEqual({ posted: 0, skipped: true });
+    expect(post).not.toHaveBeenCalled();
+    expect(log).toHaveBeenCalledWith(
+      expect.stringContaining('No scan results file'),
+    );
+  });
+
+  test('skips a scan file that is missing or invalid JSON, continues with the rest', async () => {
+    const files = {
+      '/tmp/report-args':
+        'bad:xray-report/bad.json\ngood:xray-report/good.json\n',
+      'xray-report/bad.json': 'not json',
+      'xray-report/good.json': JSON.stringify({
+        vulnerabilities: [{ severity: 'Critical', issueId: 'X-1' }],
+      }),
+    };
+    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
+    const log = jest.fn();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log,
+      delay: jest.fn(),
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    expect(log).toHaveBeenCalledWith(expect.stringContaining('Skipping bad'));
+    expect(result.posted).toBe(1);
+  });
+
+  test('does not notify Slack when there are zero findings and notifyClean is false', async () => {
+    const files = {
+      '/tmp/report-args': 'clean:xray-report/clean.json\n',
+      'xray-report/clean.json': JSON.stringify({}),
+    };
+    const post = jest.fn();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay: jest.fn(),
+      notifyClean: false,
+    });
+
+    expect(result).toEqual({ posted: 0, skipped: true });
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  test('posts a clean parent message when notifyClean is true even with zero findings', async () => {
+    const files = {
+      '/tmp/report-args': 'clean:xray-report/clean.json\n',
+      'xray-report/clean.json': JSON.stringify({}),
+    };
+    const post = jest.fn().mockResolvedValue({ ts: '111.222' });
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay: jest.fn(),
+      notifyClean: true,
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    expect(post).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({ posted: 0, skipped: false, threadTs: '111.222' });
+  });
+
+  test('throws when Slack fails to create the parent message', async () => {
+    const files = {
+      '/tmp/report-args': 'scan:xray-report/x.json\n',
+      'xray-report/x.json': JSON.stringify({
+        vulnerabilities: [{ severity: 'Critical' }],
+      }),
+    };
+    const post = jest
+      .fn()
+      .mockResolvedValue({ ok: false, error: 'invalid_auth' });
+
+    await expect(
+      notify({
+        reportArgsFile: '/tmp/report-args',
+        readFile: makeReadFile(files),
+        post,
+        log: jest.fn(),
+        delay: jest.fn(),
+      }),
+    ).rejects.toThrow('Failed to create parent Slack message');
+  });
+
+  test('only threads findings at or above minSeverity, sorted Critical -> Low', async () => {
+    const files = {
+      '/tmp/report-args': 'scan:xray-report/x.json\n',
+      'xray-report/x.json': JSON.stringify({
+        vulnerabilities: [
+          { severity: 'Low', issueId: 'L-1' },
+          { severity: 'Critical', issueId: 'C-1' },
+          { severity: 'Medium', issueId: 'M-1' },
+        ],
+      }),
+    };
+    const post = jest
+      .fn()
+      .mockResolvedValueOnce({ ts: '111.222' }) // parent
+      .mockResolvedValue({ ts: '111.222' }); // thread replies
+    const delay = jest.fn().mockResolvedValue();
+
+    const result = await notify({
+      reportArgsFile: '/tmp/report-args',
+      readFile: makeReadFile(files),
+      post,
+      log: jest.fn(),
+      delay,
+      minSeverity: 'Medium',
+      channel: '#c',
+      token: 'xoxb-x',
+    });
+
+    // parent + Critical + Medium, Low excluded
+    expect(post).toHaveBeenCalledTimes(3);
+    expect(result.posted).toBe(2);
+    const threadedIds = post.mock.calls
+      .slice(1)
+      .map(([payload]) => payload.blocks[0].text.text);
+    expect(threadedIds[0]).toContain('*Critical*');
+    expect(threadedIds[1]).toContain('*Medium*');
+  });
+});

package/src/xray/report.js

@@ -0,0 +1,194 @@
+// Pure parsing/formatting logic for Xray findings, ported from bin/xray.sh's
+// jq pipeline. Kept dependency-free (no fs/network) so it's unit-testable.
+
+const SEVERITY_RANK = { Critical: 0, High: 1, Medium: 2, Low: 3 };
+
+export function rankOf(severity) {
+  return SEVERITY_RANK[severity] ?? 9;
+}
+
+const SCA_SECTIONS = [
+  ['vulnerabilities', 'Vulnerability'],
+  ['securityViolations', 'Security violation'],
+  ['licensesViolations', 'License violation'],
+  ['operationalRiskViolations', 'Operational risk'],
+];
+
+const CODE_SECTIONS = [
+  ['secrets', 'Secret'],
+  ['secretsViolations', 'Secret violation'],
+  ['sast', 'SAST'],
+  ['sastViolations', 'SAST violation'],
+  ['iac', 'IaC'],
+  ['iacViolations', 'IaC violation'],
+  ['maliciousCode', 'Malicious code'],
+];
+
+function scaRow(row, scan, kind) {
+  const severity = row.severity ?? 'Unknown';
+  const cvesAll = (row.cves ?? []).map((c) => c.cve).filter(Boolean);
+  return {
+    scan,
+    kind,
+    severity,
+    rank: rankOf(severity),
+    cve: cvesAll[0] ?? row.issueId ?? 'N/A',
+    cvesAll,
+    pkg: `${row.impactedPackageName ?? 'N/A'} ${row.impactedPackageVersion ?? ''}`,
+    fixed: (row.fixedVersions ?? []).join(', '),
+    directs: [
+      ...new Set((row.components ?? []).map((c) => c.name).filter(Boolean)),
+    ].join(', '),
+    path: '',
+    line: 0,
+  };
+}
+
+function codeRow(row, scan, kind) {
+  const severity = row.severity ?? 'Unknown';
+  return {
+    scan,
+    kind,
+    severity,
+    rank: rankOf(severity),
+    cve: row.ruleId ?? 'N/A',
+    cvesAll: [],
+    pkg: row.finding ?? row.scannerShortDescription ?? 'N/A',
+    fixed: '',
+    directs: '',
+    path: row.file ?? '',
+    line: row.startLine ?? 0,
+  };
+}
+
+// Flattens one simple-json scan report into the same per-finding record shape
+// bin/xray.sh's jq filter produced (one row per vulnerability/secret/etc).
+export function extractFindings(data, scanLabel) {
+  const findings = [];
+  for (const [key, kind] of SCA_SECTIONS) {
+    for (const row of data[key] ?? []) {
+      findings.push(scaRow(row, scanLabel, kind));
+    }
+  }
+  for (const [key, kind] of CODE_SECTIONS) {
+    for (const row of data[key] ?? []) {
+      findings.push(codeRow(row, scanLabel, kind));
+    }
+  }
+  return findings;
+}
+
+// Only Critical/High/Medium/Low are counted, matching the bash script's
+// count_sev — an "Unknown" severity finding is neither counted nor totaled.
+export function countBySeverity(findings) {
+  const counts = { Critical: 0, High: 0, Medium: 0, Low: 0 };
+  for (const f of findings) {
+    if (f.severity in counts) counts[f.severity] += 1;
+  }
+  const total = counts.Critical + counts.High + counts.Medium + counts.Low;
+  return { ...counts, total };
+}
+
+export function buildBuildLink({ workspace, repoSlug, buildNumber }) {
+  if (!workspace || !repoSlug || !buildNumber) return '';
+  return `https://bitbucket.org/${workspace}/${repoSlug}/pipelines/results/${buildNumber}`;
+}
+
+export function buildParentPayload({
+  channel,
+  project,
+  branch,
+  buildLink,
+  counts,
+}) {
+  const contextText = buildLink
+    ? `Detailed findings are in the thread below 👇  •  <${buildLink}|Pipeline run>`
+    : 'Detailed findings are in the thread below 👇';
+
+  return {
+    channel,
+    blocks: [
+      {
+        type: 'header',
+        text: { type: 'plain_text', text: '🚨 Xray Security Report' },
+      },
+      {
+        type: 'section',
+        text: {
+          type: 'mrkdwn',
+          text: `*Project:* ${project}${branch ? `  |  *Branch:* ${branch}` : ''}`,
+        },
+      },
+      {
+        type: 'section',
+        text: {
+          type: 'mrkdwn',
+          text: `🔴 *Critical:* ${counts.Critical}    🔥 *High:* ${counts.High}    🎃 *Medium:* ${counts.Medium}    👻 *Low:* ${counts.Low}`,
+        },
+      },
+      { type: 'context', elements: [{ type: 'mrkdwn', text: contextText }] },
+      { type: 'divider' },
+    ],
+  };
+}
+
+const SEVERITY_EMOJI = { Critical: '🔴', High: '🔥', Medium: '🎃' };
+const DEFAULT_EMOJI = '👻';
+const CVE_PATTERN = /^CVE-/;
+
+function nvdLink(id) {
+  return `<https://nvd.nist.gov/vuln/detail/${id}|${id}>`;
+}
+
+function idText(finding) {
+  if (finding.cvesAll.length > 0) {
+    return finding.cvesAll.map(nvdLink).join(', ');
+  }
+  return CVE_PATTERN.test(finding.cve) ? nvdLink(finding.cve) : finding.cve;
+}
+
+export function buildFindingText(finding) {
+  const emoji = SEVERITY_EMOJI[finding.severity] ?? DEFAULT_EMOJI;
+  let text =
+    `${emoji} *${finding.severity}* — ${finding.scan} (${finding.kind})` +
+    `\n*ID:* ${idText(finding)}` +
+    `\n*Component:* \`${finding.pkg}\``;
+  if (finding.fixed) text += `\n*Fixed in:* ${finding.fixed}`;
+  if (finding.directs) text += `\n*Via:* ${finding.directs}`;
+  if (finding.path) {
+    text += `\n*File:* \`${finding.path}${finding.line > 0 ? `:${finding.line}` : ''}\``;
+  }
+  return text;
+}
+
+export function buildThreadPayload({ channel, threadTs, finding }) {
+  return {
+    channel,
+    thread_ts: threadTs,
+    blocks: [
+      {
+        type: 'section',
+        text: { type: 'mrkdwn', text: buildFindingText(finding) },
+      },
+    ],
+  };
+}
+
+// Parses the "label:file" lines written by the scan step (one per completed
+// scan) into { label, file } pairs. Blank lines are skipped.
+export function parseReportArgs(content) {
+  return content
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const idx = line.indexOf(':');
+      return idx === -1
+        ? { label: line, file: '' }
+        : { label: line.slice(0, idx), file: line.slice(idx + 1) };
+    });
+}
+
+export function sortBySeverity(findings) {
+  return [...findings].sort((a, b) => a.rank - b.rank);
+}

package/src/xray/report.test.js

@@ -0,0 +1,278 @@
+import { describe, expect, test } from '@jest/globals';
+import {
+  rankOf,
+  extractFindings,
+  countBySeverity,
+  buildBuildLink,
+  buildParentPayload,
+  buildFindingText,
+  buildThreadPayload,
+  parseReportArgs,
+  sortBySeverity,
+} from './report.js';
+
+describe('rankOf', () => {
+  test('ranks known severities Critical -> Low', () => {
+    expect(rankOf('Critical')).toBe(0);
+    expect(rankOf('High')).toBe(1);
+    expect(rankOf('Medium')).toBe(2);
+    expect(rankOf('Low')).toBe(3);
+  });
+
+  test('unranked/unknown severities sort last', () => {
+    expect(rankOf('Unknown')).toBe(9);
+    expect(rankOf(undefined)).toBe(9);
+  });
+});
+
+describe('extractFindings', () => {
+  test('flattens SCA rows with CVE ids, package and direct components', () => {
+    const data = {
+      vulnerabilities: [
+        {
+          severity: 'Critical',
+          cves: [{ cve: 'CVE-2024-0001' }, { cve: 'CVE-2024-0002' }],
+          impactedPackageName: 'lodash',
+          impactedPackageVersion: '4.17.15',
+          fixedVersions: ['4.17.21'],
+          components: [{ name: 'my-app' }, { name: 'my-app' }],
+        },
+      ],
+    };
+
+    const [finding] = extractFindings(data, 'my-repo deps');
+
+    expect(finding).toMatchObject({
+      scan: 'my-repo deps',
+      kind: 'Vulnerability',
+      severity: 'Critical',
+      rank: 0,
+      cve: 'CVE-2024-0001',
+      cvesAll: ['CVE-2024-0001', 'CVE-2024-0002'],
+      pkg: 'lodash 4.17.15',
+      fixed: '4.17.21',
+      directs: 'my-app',
+      path: '',
+      line: 0,
+    });
+  });
+
+  test('falls back to issueId when a vulnerability has no CVEs', () => {
+    const data = {
+      securityViolations: [{ severity: 'High', issueId: 'XRAY-123' }],
+    };
+    const [finding] = extractFindings(data, 'scan');
+    expect(finding.cve).toBe('XRAY-123');
+    expect(finding.cvesAll).toEqual([]);
+    expect(finding.kind).toBe('Security violation');
+  });
+
+  test('flattens code rows (secrets/SAST/IaC) with file + line', () => {
+    const data = {
+      secrets: [
+        {
+          severity: 'Medium',
+          finding: 'AWS key',
+          file: 'src/config.js',
+          startLine: 12,
+        },
+      ],
+      sast: [
+        {
+          severity: 'Low',
+          ruleId: 'js/hardcoded-secret',
+          scannerShortDescription: 'x',
+        },
+      ],
+    };
+
+    const findings = extractFindings(data, 'scan');
+
+    expect(findings[0]).toMatchObject({
+      kind: 'Secret',
+      severity: 'Medium',
+      pkg: 'AWS key',
+      path: 'src/config.js',
+      line: 12,
+    });
+    expect(findings[1]).toMatchObject({
+      kind: 'SAST',
+      cve: 'js/hardcoded-secret',
+      pkg: 'x',
+    });
+  });
+
+  test('missing sections produce no findings', () => {
+    expect(extractFindings({}, 'scan')).toEqual([]);
+  });
+});
+
+describe('countBySeverity', () => {
+  test('counts only the four named severities and totals them', () => {
+    const findings = [
+      { severity: 'Critical' },
+      { severity: 'High' },
+      { severity: 'High' },
+      { severity: 'Unknown' },
+    ];
+    expect(countBySeverity(findings)).toEqual({
+      Critical: 1,
+      High: 2,
+      Medium: 0,
+      Low: 0,
+      total: 3,
+    });
+  });
+});
+
+describe('buildBuildLink', () => {
+  test('builds a pipeline results URL when all pieces are present', () => {
+    expect(
+      buildBuildLink({
+        workspace: 'dp-cloud',
+        repoSlug: 'my-repo',
+        buildNumber: '42',
+      }),
+    ).toBe('https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42');
+  });
+
+  test('returns empty string when any piece is missing', () => {
+    expect(
+      buildBuildLink({
+        workspace: 'dp-cloud',
+        repoSlug: '',
+        buildNumber: '42',
+      }),
+    ).toBe('');
+    expect(buildBuildLink({})).toBe('');
+  });
+});
+
+describe('buildParentPayload', () => {
+  test('includes branch and pipeline link when present', () => {
+    const payload = buildParentPayload({
+      channel: '#security-alerts',
+      project: 'my-repo',
+      branch: 'main',
+      buildLink: 'https://bitbucket.org/x/y/pipelines/results/1',
+      counts: { Critical: 1, High: 2, Medium: 0, Low: 0, total: 3 },
+    });
+
+    expect(payload.channel).toBe('#security-alerts');
+    const projectSection = payload.blocks[1].text.text;
+    expect(projectSection).toContain('*Project:* my-repo');
+    expect(projectSection).toContain('*Branch:* main');
+    expect(payload.blocks[3].elements[0].text).toContain('Pipeline run');
+  });
+
+  test('omits branch and link when not provided', () => {
+    const payload = buildParentPayload({
+      channel: '#c',
+      project: 'my-repo',
+      branch: '',
+      buildLink: '',
+      counts: { Critical: 0, High: 0, Medium: 0, Low: 0, total: 0 },
+    });
+
+    expect(payload.blocks[1].text.text).toBe('*Project:* my-repo');
+    expect(payload.blocks[3].elements[0].text).toBe(
+      'Detailed findings are in the thread below 👇',
+    );
+  });
+});
+
+describe('buildFindingText / buildThreadPayload', () => {
+  test('links CVE ids to NVD', () => {
+    const finding = {
+      severity: 'Critical',
+      scan: 'my-repo deps',
+      kind: 'Vulnerability',
+      cve: 'CVE-2024-0001',
+      cvesAll: ['CVE-2024-0001'],
+      pkg: 'lodash 4.17.15',
+      fixed: '4.17.21',
+      directs: 'my-app',
+      path: '',
+      line: 0,
+    };
+
+    const text = buildFindingText(finding);
+    expect(text).toContain('🔴 *Critical*');
+    expect(text).toContain(
+      '<https://nvd.nist.gov/vuln/detail/CVE-2024-0001|CVE-2024-0001>',
+    );
+    expect(text).toContain('*Fixed in:* 4.17.21');
+    expect(text).toContain('*Via:* my-app');
+    expect(text).not.toContain('*File:*');
+  });
+
+  test('non-CVE rule ids are left as plain text', () => {
+    const finding = {
+      severity: 'Low',
+      scan: 'scan',
+      kind: 'SAST',
+      cve: 'js/hardcoded-secret',
+      cvesAll: [],
+      pkg: 'x',
+      fixed: '',
+      directs: '',
+      path: 'src/config.js',
+      line: 12,
+    };
+
+    const text = buildFindingText(finding);
+    expect(text).toContain('👻 *Low*');
+    expect(text).toContain('*ID:* js/hardcoded-secret');
+    expect(text).toContain('*File:* `src/config.js:12`');
+  });
+
+  test('buildThreadPayload wraps the text in a Slack section block', () => {
+    const finding = {
+      severity: 'Medium',
+      scan: 'scan',
+      kind: 'IaC',
+      cve: 'N/A',
+      cvesAll: [],
+      pkg: 'x',
+      fixed: '',
+      directs: '',
+      path: '',
+      line: 0,
+    };
+    const payload = buildThreadPayload({
+      channel: '#c',
+      threadTs: '123.456',
+      finding,
+    });
+    expect(payload).toMatchObject({ channel: '#c', thread_ts: '123.456' });
+    expect(payload.blocks[0].text.text).toContain('🎃 *Medium*');
+  });
+});
+
+describe('parseReportArgs', () => {
+  test('splits "label:file" lines and ignores blanks', () => {
+    expect(
+      parseReportArgs(
+        'my-repo deps:xray-report/my-repo-audit.json\n\napp image:xray-report/app-docker.json\n',
+      ),
+    ).toEqual([
+      { label: 'my-repo deps', file: 'xray-report/my-repo-audit.json' },
+      { label: 'app image', file: 'xray-report/app-docker.json' },
+    ]);
+  });
+
+  test('returns empty file when a line has no colon', () => {
+    expect(parseReportArgs('just-a-label')).toEqual([
+      { label: 'just-a-label', file: '' },
+    ]);
+  });
+});
+
+describe('sortBySeverity', () => {
+  test('orders Critical -> High -> Medium -> Low without mutating input', () => {
+    const findings = [{ rank: 3 }, { rank: 0 }, { rank: 1 }];
+    const sorted = sortBySeverity(findings);
+    expect(sorted.map((f) => f.rank)).toEqual([0, 1, 3]);
+    expect(findings.map((f) => f.rank)).toEqual([3, 0, 1]);
+  });
+});

package/src/xray/slack.js

@@ -0,0 +1,14 @@
+import axios from 'axios';
+
+const SLACK_API = 'https://slack.com/api/chat.postMessage';
+
+// Thin wrapper so callers can mock the network boundary in tests.
+export async function postMessage(payload, token) {
+  const { data } = await axios.post(SLACK_API, payload, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      'Content-Type': 'application/json',
+    },
+  });
+  return data;
+}