@skyhook-io/radar-app 1.13.1 → 1.13.3

package/src/components/diagnose/InvestigationResourceEvidence.test.tsx

@@ -0,0 +1,257 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+
+import { InvestigationResourceEvidence } from "./InvestigationResourceEvidence";
+import {
+  investigationResourceEvidenceHasDetails,
+  investigationResourceEvidenceSummary,
+  isSensitiveInvestigationConfigKey,
+} from "./investigationResourceEvidenceModel";
+import type { InvestigationKubernetesResource } from "./investigationEvidence";
+
+function render(resource: InvestigationKubernetesResource): string {
+  return renderToStaticMarkup(
+    <InvestigationResourceEvidence resource={resource} />,
+  );
+}
+
+describe("InvestigationResourceEvidence", () => {
+  it("keeps every ConfigMap key inspectable in a bounded table and hides sensitive-looking values", () => {
+    const html = render({
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: { namespace: "dev", name: "app-vars" },
+      data: {
+        Z_MISC: "last",
+        WORKERS: "4",
+        LOG_LEVEL: "info",
+        FEATURE_FLAG: "on",
+        CACHE_SIZE: "128",
+        DB_NAME: "atlas",
+        MONGO_USER: "opendev-nonprod",
+        API_ENDPOINT: "https://api.example.test",
+        REDIS_HOST: "redis.dev.svc",
+        DATABASE_URL: "mongodb://visible-user:hidden-pass@mongo.dev/db",
+        REDIS_URL: "redis://:another-hidden-pass@redis.dev/0",
+        DATABASE_PASSWORD: "do-not-render-this-password",
+      },
+    });
+
+    expect(html).toContain("ConfigMap values");
+    expect(html).toContain("12 keys");
+    expect(html).toContain("https://api.example.test");
+    expect(html).toContain("redis.dev.svc");
+    expect(html).toContain("opendev-nonprod");
+    expect(html).toContain("Value hidden · potentially sensitive");
+    expect(html).not.toContain("do-not-render-this-password");
+    expect(html).not.toContain("hidden-pass");
+    expect(html).not.toContain("another-hidden-pass");
+    expect(html).toContain("max-h-64 overflow-y-auto");
+    expect(html).toContain("Z_MISC");
+    expect(html.match(/<tr>/g)).toHaveLength(12);
+    expect(html).not.toContain("more keys available in Activity");
+    expect(html.indexOf("API_ENDPOINT")).toBeLessThan(
+      html.indexOf("MONGO_USER"),
+    );
+    expect(html.indexOf("MONGO_USER")).toBeLessThan(html.indexOf("CACHE_SIZE"));
+  });
+
+  it("renders the producer's key-only Secret shape and never exposes unexpected values", () => {
+    const html = render({
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: { namespace: "dev", name: "database" },
+      type: "Opaque",
+      keys: ["MONGO_PASSWORD", "username", "connection", "API_KEY"],
+      data: {
+        MONGO_PASSWORD: "c3VwZXItc2VjcmV0",
+        username: "b3BlbmRldg==",
+      },
+      stringData: { connection: "mongodb://user:password@example.test" },
+    });
+
+    expect(html).toContain("MONGO_PASSWORD");
+    expect(html).toContain("username");
+    expect(html).toContain("connection");
+    expect(html).not.toContain("Opaque");
+    expect(html).not.toContain("Secret values are never shown here.");
+    expect(html).not.toContain("c3VwZXItc2VjcmV0");
+    expect(html).not.toContain("b3BlbmRldg==");
+    expect(html).not.toContain("mongodb://");
+  });
+
+  it("shows SealedSecret state and key names without rendering ciphertext", () => {
+    const html = render({
+      apiVersion: "bitnami.com/v1alpha1",
+      kind: "SealedSecret",
+      metadata: {
+        namespace: "dev",
+        name: "project-infra",
+        generation: 8,
+        creationTimestamp: "2026-09-01T10:15:00Z",
+        annotations: {
+          "sealedsecrets.bitnami.com/namespace-wide": "true",
+        },
+      },
+      spec: {
+        encryptedData: {
+          MONGO_PASSWORD: "AgA-ciphertext-that-must-not-render",
+          API_TOKEN: "AgA-other-ciphertext-that-must-not-render",
+        },
+      },
+      status: {
+        observedGeneration: 8,
+        conditions: [
+          {
+            type: "Synced",
+            status: "True",
+            reason: "SealedSecretSynced",
+            message: "SealedSecret reconciled successfully",
+          },
+        ],
+      },
+    });
+
+    expect(html).toContain("Synced");
+    expect(html).toContain("Namespace-wide");
+    expect(html).not.toContain("Observed generation");
+    expect(html).toContain("2026-09-01 10:15 UTC");
+    expect(html).toContain("MONGO_PASSWORD");
+    expect(html).toContain("API_TOKEN");
+    expect(html).toContain("Synced=True");
+    expect(html).toContain("SealedSecretSynced");
+    expect(html.indexOf("SealedSecret reconciled successfully")).toBeLessThan(
+      html.indexOf("Namespace-wide"),
+    );
+    expect(html).not.toContain("AgA-ciphertext");
+    expect(html).not.toContain("AgA-other");
+    expect(html).not.toContain("Encrypted values stay hidden");
+  });
+
+  it("returns no specialized UI or summary for generic resources", () => {
+    const deployment = {
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { namespace: "dev", name: "api" },
+    };
+
+    expect(render(deployment)).toBe("");
+    expect(investigationResourceEvidenceSummary(deployment)).toBeUndefined();
+    expect(investigationResourceEvidenceHasDetails(deployment)).toBe(false);
+  });
+
+  it("does not add an empty second disclosure layer for resources without specialized details", () => {
+    const emptyConfigMap = {
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: { namespace: "dev", name: "empty-config" },
+      data: {},
+    };
+    const emptySecret = {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: { namespace: "dev", name: "empty-secret" },
+      type: "Opaque",
+      keys: [],
+    };
+
+    for (const resource of [emptyConfigMap, emptySecret]) {
+      expect(investigationResourceEvidenceSummary(resource)).toBeTruthy();
+      expect(investigationResourceEvidenceHasDetails(resource)).toBe(false);
+      expect(render(resource)).toBe("");
+    }
+    expect(investigationResourceEvidenceSummary(emptySecret)).toBe(
+      "No key names in this result",
+    );
+  });
+});
+
+describe("investigation resource summaries", () => {
+  it.each([0, 1, 3, 4])(
+    "adds Secret details only beyond the inline preview (%i keys)",
+    (count) => {
+      const resource = {
+        apiVersion: "v1",
+        kind: "Secret",
+        metadata: { name: "keys", namespace: "dev" },
+        keys: Array.from({ length: count }, (_, index) => `KEY_${index}`),
+      };
+      expect(investigationResourceEvidenceHasDetails(resource)).toBe(count > 3);
+      const summary = investigationResourceEvidenceSummary(resource)!;
+      if (count > 0) expect(summary).toContain("KEY_0");
+      if (count === 4) expect(summary).toContain("1 more");
+      expect(summary).not.toContain("values hidden");
+    },
+  );
+
+  it("summarizes ConfigMap key names without exposing values", () => {
+    const summary = investigationResourceEvidenceSummary({
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: { namespace: "dev", name: "vars" },
+      data: {
+        ZZZ: "last",
+        MONGO_USER: "opendev-nonprod",
+        MONGO_ADDRESS: "nonprod-boxer.example.mongodb.net",
+        API_TOKEN: "must-stay-hidden",
+      },
+    });
+
+    expect(summary).toBe("Keys: MONGO_ADDRESS, MONGO_USER, API_TOKEN, ZZZ");
+    expect(summary).not.toContain("must-stay-hidden");
+  });
+
+  it("includes key names even when their values must stay hidden", () => {
+    const summary = investigationResourceEvidenceSummary({
+      apiVersion: "v1",
+      kind: "ConfigMap",
+      metadata: { namespace: "dev", name: "vars" },
+      data: {
+        DATABASE_URL: "mongodb://user:hidden@mongo.dev/db",
+        PRIVATE_ENDPOINT: "https://private.example.test",
+        MONGO_ADDRESS: "mongo.dev.svc",
+        MONGO_USER: "opendev",
+      },
+    });
+
+    expect(summary).toBe(
+      "Keys: DATABASE_URL, MONGO_ADDRESS, PRIVATE_ENDPOINT, MONGO_USER",
+    );
+    expect(summary).not.toContain("hidden@mongo");
+    expect(summary).not.toContain("private.example.test");
+  });
+
+  it("uses conservative sensitive-key matching without treating ordinary words as keys", () => {
+    expect(isSensitiveInvestigationConfigKey("DATABASE_PASSWORD")).toBe(true);
+    expect(isSensitiveInvestigationConfigKey("clientSecret")).toBe(true);
+    expect(isSensitiveInvestigationConfigKey("private-key")).toBe(true);
+    expect(isSensitiveInvestigationConfigKey("monkey_species")).toBe(false);
+  });
+
+  it("hides bearer and provider tokens even when a ConfigMap key looks harmless", () => {
+    for (const value of [
+      "Bearer abcdefghijklmnopqrstuvwxyz012345",
+      "sk-proj-abcdefghijklmnopqrstuvwxyz012345",
+      "github_pat_11AA22BB33CC44DD55EE66FF77GG",
+      "dsn options password=correct-horse-battery-staple",
+      "$2y$10$abcdefghijklmnopqrstuv",
+    ]) {
+      const html = render({
+        apiVersion: "v1",
+        kind: "ConfigMap",
+        metadata: { namespace: "dev", name: "vars" },
+        data: { AUTHORIZATION: value },
+      });
+      expect(html).toContain("Value hidden · potentially sensitive");
+      expect(html).not.toContain(value);
+      expect(
+        investigationResourceEvidenceSummary({
+          apiVersion: "v1",
+          kind: "ConfigMap",
+          metadata: { namespace: "dev", name: "vars" },
+          data: { AUTHORIZATION: value },
+        }),
+      ).toBe("Keys: AUTHORIZATION");
+    }
+  });
+});

package/src/components/diagnose/InvestigationResourceEvidence.tsx

@@ -0,0 +1,214 @@
+import type { ReactNode } from "react";
+import {
+  buildInvestigationResourceEvidenceModel,
+  type InvestigationResourceEvidenceInput,
+  type InvestigationResourceEvidenceModel,
+} from "./investigationResourceEvidenceModel";
+
+export function InvestigationResourceEvidence({
+  resource,
+}: {
+  resource: InvestigationResourceEvidenceInput;
+}) {
+  const model = buildInvestigationResourceEvidenceModel(resource);
+  if (!model?.hasDetails) return null;
+  switch (model.kind) {
+    case "configmap":
+      return <ConfigMapEvidence model={model} />;
+    case "secret":
+      return <SecretEvidence model={model} />;
+    case "sealedsecret":
+      return <SealedSecretEvidence model={model} />;
+  }
+}
+
+function ConfigMapEvidence({
+  model,
+}: {
+  model: Extract<InvestigationResourceEvidenceModel, { kind: "configmap" }>;
+}) {
+  const entries = model.entries;
+
+  return (
+    <div className="overflow-hidden rounded-md border border-theme-border bg-theme-base/40">
+      <div className="flex items-center justify-between gap-3 border-b border-theme-border px-2.5 py-1.5">
+        <span className="text-xs font-medium text-theme-text-tertiary">
+          ConfigMap values
+        </span>
+        <span className="text-xs tabular-nums text-theme-text-tertiary">
+          {entries.length} {entries.length === 1 ? "key" : "keys"}
+        </span>
+      </div>
+      {entries.length > 0 ? (
+        <div className="max-h-64 overflow-y-auto">
+          <table className="w-full table-fixed text-left text-xs">
+            <caption className="sr-only">
+              Selected ConfigMap keys and values
+            </caption>
+            <colgroup>
+              <col className="w-[38%]" />
+              <col />
+            </colgroup>
+            <tbody className="divide-y divide-theme-border/70">
+              {entries.map((entry) => {
+                return (
+                  <tr key={`${entry.binary ? "binary" : "data"}-${entry.key}`}>
+                    <th
+                      scope="row"
+                      className="px-2.5 py-1.5 align-top font-mono text-xs font-medium text-theme-text-secondary"
+                    >
+                      <span className="block truncate">{entry.key}</span>
+                    </th>
+                    <td className="px-2.5 py-1.5 align-top font-mono text-xs leading-relaxed text-theme-text-primary">
+                      {entry.sensitive ? (
+                        <span className="font-sans text-theme-text-tertiary">
+                          Value hidden · potentially sensitive
+                        </span>
+                      ) : entry.binary ? (
+                        <span className="font-sans text-theme-text-tertiary">
+                          Binary value not shown
+                        </span>
+                      ) : (
+                        <span className="block max-h-20 overflow-y-auto whitespace-pre-wrap break-all pr-1">
+                          {entry.value}
+                        </span>
+                      )}
+                    </td>
+                  </tr>
+                );
+              })}
+            </tbody>
+          </table>
+        </div>
+      ) : (
+        <p className="px-2.5 py-2 text-xs text-theme-text-tertiary">
+          No data keys were found.
+        </p>
+      )}
+    </div>
+  );
+}
+
+function SecretEvidence({
+  model,
+}: {
+  model: Extract<InvestigationResourceEvidenceModel, { kind: "secret" }>;
+}) {
+  return (
+    <div>
+      <div className="flex flex-wrap items-center justify-between gap-2">
+        <span className="text-xs font-medium text-theme-text-tertiary">
+          Secret keys
+        </span>
+      </div>
+      {model.keys.length > 0 ? (
+        <div className="mt-1.5 flex flex-wrap gap-1">
+          {model.keys.map((key) => (
+            <span
+              key={key}
+              className="rounded border border-theme-border bg-theme-elevated/60 px-1.5 py-0.5 font-mono text-xs text-theme-text-secondary"
+            >
+              {key}
+            </span>
+          ))}
+        </div>
+      ) : (
+        <p className="mt-1.5 text-xs text-theme-text-tertiary">
+          No Secret key names were found.
+        </p>
+      )}
+    </div>
+  );
+}
+
+function SealedSecretEvidence({
+  model,
+}: {
+  model: Extract<InvestigationResourceEvidenceModel, { kind: "sealedsecret" }>;
+}) {
+  return (
+    <div className="overflow-hidden rounded-md border border-theme-border bg-theme-base/40">
+      <div className="flex flex-wrap items-center justify-between gap-2 border-b border-theme-border px-2.5 py-1.5">
+        <span className="text-xs font-medium text-theme-text-tertiary">
+          SealedSecret state
+        </span>
+        <span
+          className={
+            model.syncLabel === "Synced"
+              ? "text-xs font-medium text-emerald-500"
+              : model.syncLabel === "Not synced"
+                ? "text-xs font-medium text-red-400"
+                : "text-xs font-medium text-theme-text-tertiary"
+          }
+        >
+          {model.syncLabel}
+        </span>
+      </div>
+      {model.conditions.length > 0 ? (
+        <div className="px-2.5 py-2">
+          <div className="mb-1 text-xs font-medium text-theme-text-tertiary">
+            Conditions
+          </div>
+          <div className="space-y-1.5">
+            {model.conditions.map((condition) => (
+              <div
+                key={`${condition.type}-${condition.status}-${condition.reason ?? ""}`}
+                className="text-sm leading-relaxed text-theme-text-primary"
+              >
+                <span className="font-medium text-theme-text-primary">
+                  {condition.type}={condition.status}
+                </span>
+                {condition.reason ? ` · ${condition.reason}` : ""}
+                {condition.message ? ` — ${condition.message}` : ""}
+              </div>
+            ))}
+          </div>
+        </div>
+      ) : null}
+      <dl className="flex flex-wrap gap-x-5 gap-y-1 border-b border-theme-border px-2.5 py-1.5 text-xs">
+        <ResourceFact label="Scope" value={model.scope} />
+        <ResourceFact
+          label="Created"
+          value={
+            model.created ? (
+              <time dateTime={model.created.dateTime}>
+                {model.created.label}
+              </time>
+            ) : undefined
+          }
+        />
+      </dl>
+      <div className="px-2.5 py-2">
+        <div className="text-xs font-medium text-theme-text-tertiary">
+          Encrypted keys · {model.encryptedKeys.length}
+        </div>
+        {model.encryptedKeys.length > 0 ? (
+          <div className="mt-1 flex flex-wrap gap-1">
+            {model.encryptedKeys.map((key) => (
+              <span
+                key={key}
+                className="rounded border border-theme-border bg-theme-elevated/60 px-1.5 py-0.5 font-mono text-xs text-theme-text-secondary"
+              >
+                {key}
+              </span>
+            ))}
+          </div>
+        ) : (
+          <p className="mt-1 text-xs text-theme-text-tertiary">
+            No encrypted key names were found.
+          </p>
+        )}
+      </div>
+    </div>
+  );
+}
+
+function ResourceFact({ label, value }: { label: string; value: ReactNode }) {
+  if (value === undefined || value === null || value === "") return null;
+  return (
+    <div className="flex min-w-0 gap-1.5">
+      <dt className="text-theme-text-tertiary">{label}</dt>
+      <dd className="font-medium text-theme-text-secondary">{value}</dd>
+    </div>
+  );
+}

package/src/components/diagnose/InvestigationView.test.ts

@@ -0,0 +1,17 @@
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { expect, it } from "vitest";
+import { InvestigationStartErrorAlert } from "./InvestigationView";
+
+it("renders new-run failures as a pane-independent workspace alert", () => {
+  const html = renderToStaticMarkup(
+    createElement(InvestigationStartErrorAlert, {
+      error: "The run could not be created.",
+      onDismiss: () => {},
+    }),
+  );
+  expect(html).toContain('role="alert"');
+  expect(html).toContain("Couldn't start a new investigation");
+  expect(html).toContain("The run could not be created.");
+  expect(html).not.toContain('class="hidden');
+});