@skyhook-io/radar-app 1.13.1 → 1.13.2

package/src/components/diagnose/investigationResourceEvidenceModel.ts

@@ -0,0 +1,322 @@
+const PRIMARY_CONFIG_KEY_MARKERS = ["address", "host", "url", "endpoint"];
+const SECONDARY_CONFIG_KEY_MARKERS = ["user", "database", "db", "name"];
+export const INVESTIGATION_CONFIG_ROW_LIMIT = 8;
+const SENSITIVE_KEY_TOKENS = new Set([
+  "password",
+  "passwd",
+  "passphrase",
+  "token",
+  "secret",
+  "key",
+  "credential",
+  "credentials",
+  "private",
+]);
+
+type ResourceRecord = Record<string, unknown>;
+
+export interface InvestigationResourceEvidenceInput {
+  kind: string;
+  metadata: {
+    annotations?: unknown;
+    creationTimestamp?: unknown;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+}
+
+export interface InvestigationConfigEntry {
+  key: string;
+  value?: string;
+  binary: boolean;
+  sensitive: boolean;
+}
+
+export interface InvestigationResourceConditionEvidence {
+  type: string;
+  status: string;
+  reason?: string;
+  message?: string;
+}
+
+export type InvestigationResourceEvidenceModel =
+  | {
+      kind: "configmap";
+      entries: InvestigationConfigEntry[];
+      summary: string;
+      hasDetails: boolean;
+    }
+  | {
+      kind: "secret";
+      keys: string[];
+      summary: string;
+      hasDetails: boolean;
+    }
+  | {
+      kind: "sealedsecret";
+      encryptedKeys: string[];
+      conditions: InvestigationResourceConditionEvidence[];
+      syncLabel: "Synced" | "Not synced" | "Sync unknown";
+      scope: "Cluster-wide" | "Namespace-wide" | "Strict";
+      observedGeneration?: string;
+      created?: { dateTime: string; label: string };
+      summary: string;
+      hasDetails: boolean;
+    };
+
+function valueRecord(value: unknown): ResourceRecord | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as ResourceRecord)
+    : undefined;
+}
+
+function stringValue(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+function keyMarkers(key: string): string[] {
+  return key
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter(Boolean);
+}
+
+function compactKey(key: string): string {
+  return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+
+export function isSensitiveInvestigationConfigKey(key: string): boolean {
+  const tokens = keyMarkers(key);
+  if (tokens.some((token) => SENSITIVE_KEY_TOKENS.has(token))) return true;
+
+  const compact = compactKey(key);
+  return [
+    "password",
+    "passphrase",
+    "token",
+    "secret",
+    "credential",
+    "privatekey",
+    "apikey",
+    "accesskey",
+  ].some((marker) => compact.includes(marker));
+}
+
+function isSensitiveInvestigationConfigValue(value: string): boolean {
+  return (
+    /\b[a-z][a-z0-9+.-]*:\/\/[^:/@\s]*:[^/\s?#]+@/i.test(value) ||
+    /\bBearer\s+[A-Za-z0-9\-._~+/]{20,}/i.test(value) ||
+    /\bsk-[A-Za-z0-9_-]{20,}\b/.test(value) ||
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/.test(value) ||
+    /\bAKIA[0-9A-Z]{16}\b/.test(value) ||
+    /\bgh[oprsu]_[A-Za-z0-9]{20,}\b/.test(value) ||
+    /\bgithub_pat_[A-Za-z0-9_]{22,}\b/.test(value) ||
+    /password[=:]\s*\S{8,}/i.test(value) ||
+    /\$(?:apr1|2[aby]|5|6)\$[./A-Za-z0-9$]{8,}/.test(value) ||
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/.test(
+      value,
+    )
+  );
+}
+
+function configKeyPriority(key: string): number {
+  const compact = compactKey(key);
+  if (PRIMARY_CONFIG_KEY_MARKERS.some((marker) => compact.includes(marker))) {
+    return 0;
+  }
+  if (SECONDARY_CONFIG_KEY_MARKERS.some((marker) => compact.includes(marker))) {
+    return 1;
+  }
+  return 2;
+}
+
+function configEntries(
+  resource: InvestigationResourceEvidenceInput,
+): InvestigationConfigEntry[] {
+  const plainData = valueRecord(resource.data);
+  const binaryData = valueRecord(resource.binaryData);
+  const entries: InvestigationConfigEntry[] = [];
+
+  for (const [key, value] of Object.entries(plainData ?? {})) {
+    if (typeof value !== "string") continue;
+    entries.push({
+      key,
+      value,
+      binary: false,
+      sensitive:
+        isSensitiveInvestigationConfigKey(key) ||
+        isSensitiveInvestigationConfigValue(value),
+    });
+  }
+  for (const key of Object.keys(binaryData ?? {})) {
+    entries.push({
+      key,
+      binary: true,
+      sensitive: isSensitiveInvestigationConfigKey(key),
+    });
+  }
+
+  return entries.sort(
+    (left, right) =>
+      configKeyPriority(left.key) - configKeyPriority(right.key) ||
+      left.key.localeCompare(right.key),
+  );
+}
+
+function secretKeys(resource: InvestigationResourceEvidenceInput): string[] {
+  // Radar's current get_resource producer structurally removes Secret values
+  // and emits only this explicit key-name list. Do not inspect data/stringData:
+  // this stays fail-closed even if an unexpected object reaches the UI.
+  if (!Array.isArray(resource.keys)) return [];
+  return resource.keys
+    .filter((key): key is string => typeof key === "string")
+    .sort((left, right) => left.localeCompare(right));
+}
+
+function sealedSecretEncryptedKeys(
+  resource: InvestigationResourceEvidenceInput,
+): string[] {
+  const spec = valueRecord(resource.spec);
+  return Object.keys(valueRecord(spec?.encryptedData) ?? {}).sort(
+    (left, right) => left.localeCompare(right),
+  );
+}
+
+function resourceConditions(
+  resource: InvestigationResourceEvidenceInput,
+): InvestigationResourceConditionEvidence[] {
+  const status = valueRecord(resource.status);
+  if (!Array.isArray(status?.conditions)) return [];
+
+  return status.conditions.flatMap((value) => {
+    const condition = valueRecord(value);
+    const type = stringValue(condition?.type);
+    const conditionStatus = stringValue(condition?.status);
+    if (!type || !conditionStatus) return [];
+    return [
+      {
+        type,
+        status: conditionStatus,
+        reason: stringValue(condition?.reason),
+        message: stringValue(condition?.message),
+      },
+    ];
+  });
+}
+
+function sealedSecretScope(
+  resource: InvestigationResourceEvidenceInput,
+): "Cluster-wide" | "Namespace-wide" | "Strict" {
+  const annotations = valueRecord(resource.metadata.annotations);
+  if (annotations?.["sealedsecrets.bitnami.com/cluster-wide"] === "true") {
+    return "Cluster-wide";
+  }
+  if (annotations?.["sealedsecrets.bitnami.com/namespace-wide"] === "true") {
+    return "Namespace-wide";
+  }
+  return "Strict";
+}
+
+function sealedSecretSyncLabel(
+  conditions: InvestigationResourceConditionEvidence[],
+): "Synced" | "Not synced" | "Sync unknown" {
+  const synced = conditions.find(
+    (condition) => condition.type.toLowerCase() === "synced",
+  );
+  if (synced?.status.toLowerCase() === "true") return "Synced";
+  if (synced?.status.toLowerCase() === "false") return "Not synced";
+  return "Sync unknown";
+}
+
+function timestamp(
+  value: unknown,
+): { dateTime: string; label: string } | undefined {
+  if (typeof value !== "string" || value.length === 0) return undefined;
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return { dateTime: value, label: value };
+  const iso = date.toISOString();
+  return {
+    dateTime: value,
+    label: `${iso.slice(0, 10)} ${iso.slice(11, 16)} UTC`,
+  };
+}
+
+function resourceKeySummary(keys: string[], previewLimit = 3): string {
+  if (keys.length === 0) return "No key names in this result";
+  const remaining = keys.length - previewLimit;
+  return `Keys: ${keys.slice(0, previewLimit).join(", ")}${remaining > 0 ? ` · ${remaining} more` : ""}`;
+}
+
+export function buildInvestigationResourceEvidenceModel(
+  resource: InvestigationResourceEvidenceInput,
+): InvestigationResourceEvidenceModel | undefined {
+  switch (resource.kind.toLowerCase()) {
+    case "configmap": {
+      const entries = configEntries(resource);
+      return {
+        kind: "configmap",
+        entries,
+        summary: resourceKeySummary(
+          entries.map((entry) => entry.key),
+          INVESTIGATION_CONFIG_ROW_LIMIT,
+        ),
+        hasDetails: entries.length > 0,
+      };
+    }
+    case "secret": {
+      const keys = secretKeys(resource);
+      return {
+        kind: "secret",
+        keys,
+        summary: resourceKeySummary(keys),
+        hasDetails: keys.length > 3,
+      };
+    }
+    case "sealedsecret": {
+      const encryptedKeys = sealedSecretEncryptedKeys(resource);
+      const conditions = resourceConditions(resource);
+      const syncLabel = sealedSecretSyncLabel(conditions);
+      const status = valueRecord(resource.status);
+      const observedGeneration =
+        typeof status?.observedGeneration === "number" ||
+        typeof status?.observedGeneration === "string"
+          ? String(status.observedGeneration)
+          : undefined;
+      const created = timestamp(resource.metadata.creationTimestamp);
+      const scope = sealedSecretScope(resource);
+      return {
+        kind: "sealedsecret",
+        encryptedKeys,
+        conditions,
+        syncLabel,
+        scope,
+        observedGeneration,
+        created,
+        summary: `${encryptedKeys.length} encrypted ${encryptedKeys.length === 1 ? "key" : "keys"} · ${syncLabel}`,
+        hasDetails: Boolean(
+          encryptedKeys.length > 0 ||
+          conditions.length > 0 ||
+          created ||
+          scope !== "Strict",
+        ),
+      };
+    }
+    default:
+      return undefined;
+  }
+}
+
+/** A compact, redacted summary suitable for the collapsed evidence-card row. */
+export function investigationResourceEvidenceSummary(
+  resource: InvestigationResourceEvidenceInput,
+): string | undefined {
+  return buildInvestigationResourceEvidenceModel(resource)?.summary;
+}
+
+/** Whether the specialized resource body adds facts beyond its summary. */
+export function investigationResourceEvidenceHasDetails(
+  resource: InvestigationResourceEvidenceInput,
+): boolean {
+  return buildInvestigationResourceEvidenceModel(resource)?.hasDetails ?? false;
+}

package/src/components/diagnose/investigationSourceFocus.test.ts

@@ -0,0 +1,143 @@
+import { describe, expect, it } from "vitest";
+import {
+  locateSourceExcerpt,
+  evidenceSourceExcerpt,
+} from "./investigationSourceFocus";
+
+describe("source excerpt targeting", () => {
+  it("targets the selected crash field when the same line is repeated in current and previous logs", () => {
+    const line = "2026-09-06T07:04:54Z Error: Missing MONGO_PASSWORD";
+    const display = JSON.stringify(
+      {
+        logsCurrent: { lines: [line] },
+        logsPrevious: { lines: [line] },
+        crashCauses: [{ logLine: line }],
+      },
+      null,
+      2,
+    );
+    expect(locateSourceExcerpt(display, line)).toBeUndefined();
+    const range = locateSourceExcerpt(display, {
+      text: line,
+      field: "logLine",
+    })!;
+    expect(display.slice(range.start, range.end)).toBe(JSON.stringify(line));
+    expect(range.start).toBeGreaterThan(display.indexOf('"crashCauses"'));
+    expect(
+      locateSourceExcerpt(
+        JSON.stringify({ a: { logLine: line }, b: { logLine: line } }, null, 2),
+        { text: line, field: "logLine" },
+      ),
+    ).toBeUndefined();
+    expect(
+      locateSourceExcerpt(JSON.stringify({ lines: [line] }, null, 2), {
+        text: line,
+        field: "logLine",
+      }),
+    ).toBeUndefined();
+  });
+  it("locates a single Secret key, never its values or a guess among multiple keys", () => {
+    expect(
+      evidenceSourceExcerpt({
+        type: "resource",
+        warnings: [],
+        resource: {
+          apiVersion: "v1",
+          metadata: { name: "api", namespace: "dev" },
+          kind: "Secret",
+          keys: ["QUALIFIRE_API_KEY"],
+          data: { password: "do-not-use" },
+        },
+      }),
+    ).toBe("QUALIFIRE_API_KEY");
+    expect(
+      evidenceSourceExcerpt({
+        type: "resource",
+        warnings: [],
+        resource: {
+          apiVersion: "v1",
+          metadata: { name: "api", namespace: "dev" },
+          kind: "Secret",
+          keys: ["FIRST_KEY", "SECOND_KEY"],
+        },
+      }),
+    ).toBeUndefined();
+    expect(
+      evidenceSourceExcerpt({
+        type: "resource",
+        warnings: [],
+        resource: {
+          apiVersion: "v1",
+          metadata: { name: "api", namespace: "dev" },
+          kind: "Secret",
+          data: { password: "do-not-use" },
+        },
+      }),
+    ).toBeUndefined();
+  });
+  it("targets a unique original log line", () => {
+    const text = "before\nMissing required MONGO_PASSWORD\nafter";
+    const range = locateSourceExcerpt(text, "Missing required MONGO_PASSWORD")!;
+    expect(text.slice(range.start, range.end)).toBe(
+      "Missing required MONGO_PASSWORD",
+    );
+  });
+  it("does not turn one line of a multi-line log collection into the source locator", () => {
+    const data = {
+      type: "logs" as const,
+      pod: "api-abc",
+      container: "api",
+      previous: false,
+      warnings: [],
+      logs: {
+        lines: ["ERROR missing DATABASE_URL"],
+        totalLines: 2,
+        matchedLines: 1,
+        fallback: false,
+      },
+    };
+    expect(evidenceSourceExcerpt(data)).toBe("ERROR missing DATABASE_URL");
+    expect(
+      evidenceSourceExcerpt({
+        ...data,
+        logs: {
+          ...data.logs,
+          lines: ["ERROR missing DATABASE_URL", "ERROR startup failed"],
+        },
+      }),
+    ).toBeUndefined();
+  });
+  it("targets JSON-escaped original text, including quotes and newlines", () => {
+    const message = 'Missing "secret"\nconfiguration';
+    const text = JSON.stringify({ message }, null, 2);
+    const range = locateSourceExcerpt(text, message)!;
+    expect(text.slice(range.start, range.end)).toBe(JSON.stringify(message));
+  });
+  it("does not guess for absent, short or repeated content", () => {
+    expect(
+      locateSourceExcerpt("redacted", "Missing required MONGO_PASSWORD"),
+    ).toBeUndefined();
+    expect(locateSourceExcerpt("Error", "Error")).toBeUndefined();
+    expect(
+      locateSourceExcerpt("long message; long message", "long message"),
+    ).toBeUndefined();
+    expect(
+      locateSourceExcerpt(
+        '{"a":"long message","b":"long message"}',
+        "long message",
+      ),
+    ).toBeUndefined();
+  });
+  it("does not invent a locator for aggregate or absence evidence", () => {
+    expect(
+      evidenceSourceExcerpt({ type: "events", events: [], scope: "namespace" }),
+    ).toBeUndefined();
+    expect(
+      evidenceSourceExcerpt({
+        type: "inventory",
+        resources: [],
+        scope: "namespace",
+      }),
+    ).toBeUndefined();
+  });
+});

package/src/components/diagnose/investigationSourceFocus.ts

@@ -0,0 +1,98 @@
+import type { InvestigationEvidenceData } from "./investigationEvidence";
+
+export type InvestigationSourceExcerpt =
+  string | { text: string; field: "logLine" };
+
+// Only exact producer-authored text is eligible. Titles and agent prose are
+// not locators; an ambiguous or missing match leaves the whole result visible.
+export function evidenceSourceExcerpt(
+  data: InvestigationEvidenceData,
+): InvestigationSourceExcerpt | undefined {
+  switch (data.type) {
+    case "crash":
+      return { text: data.crash.logLine, field: "logLine" };
+    case "startup":
+      return data.blocker.message;
+    case "issue":
+      return data.issue.message;
+    case "logs":
+      return data.logs?.lines?.length === 1 ? data.logs.lines[0] : undefined;
+    case "events":
+      return data.events.length === 1 ? data.events[0].message : undefined;
+    case "resource": {
+      // Secret values are deliberately never inspected, even to find a locator.
+      const keys = data.resource.keys;
+      return data.resource.kind === "Secret" &&
+        Array.isArray(keys) &&
+        keys.length === 1 &&
+        typeof keys[0] === "string"
+        ? keys[0]
+        : undefined;
+    }
+    default:
+      return undefined;
+  }
+}
+
+export function locateSourceExcerpt(
+  display: string,
+  excerpt?: InvestigationSourceExcerpt,
+): { start: number; end: number } | undefined {
+  if (!excerpt) return undefined;
+  const text = typeof excerpt === "string" ? excerpt : excerpt.text;
+  if (text.trim().length < 8) return undefined;
+  if (typeof excerpt !== "string") {
+    // PayloadBlock pretty-prints parsed JSON. Scope a selected crash line to
+    // its producer's logLine field: the same text may also occur in both log
+    // streams. Still reject multiple matching fields rather than picking one.
+    const prefix = `${JSON.stringify(excerpt.field)}: `;
+    const needle = prefix + JSON.stringify(text);
+    const start = display.indexOf(needle);
+    if (start < 0 || display.indexOf(needle, start + 1) !== -1)
+      return undefined;
+    return { start: start + prefix.length, end: start + needle.length };
+  }
+  // Structured output contains JSON-escaped strings; plain logs do not.
+  const quoted = JSON.stringify(text);
+  const needle = display.includes(quoted) ? quoted : text;
+  const start = display.indexOf(needle);
+  if (start < 0 || display.indexOf(needle, start + 1) !== -1) return undefined;
+  return { start, end: start + needle.length };
+}
+
+export function highlightRelatedEvidence(
+  row: HTMLElement,
+  sourceId?: string,
+): void {
+  const workspace = row.closest("[data-investigation-workspace]");
+  if (!workspace) return;
+  workspace
+    .querySelectorAll("[data-source-related]")
+    .forEach((node) => node.removeAttribute("data-source-related"));
+  const findings = workspace.querySelector<HTMLElement>(
+    "[data-investigation-findings-scroll]",
+  );
+  const activity = workspace.querySelector<HTMLElement>(
+    "[data-investigation-activity-scroll]",
+  );
+  if (!sourceId || !findings?.offsetParent || !activity?.offsetParent) return;
+  const viewport = findings.getBoundingClientRect();
+  workspace
+    .querySelectorAll<HTMLElement>("[data-evidence-source]")
+    .forEach((card) => {
+      if (
+        card.dataset.evidenceSource !== sourceId ||
+        !card.getClientRects().length
+      )
+        return;
+      const rect = card.getBoundingClientRect();
+      if (
+        rect.bottom > viewport.top &&
+        rect.top < viewport.bottom &&
+        rect.right > viewport.left &&
+        rect.left < viewport.right
+      ) {
+        card.setAttribute("data-source-related", "true");
+      }
+    });
+}