atris 3.82.4 → 3.82.7

package/lib/sentinel-events.js

@@ -112,8 +112,11 @@ function cleanRepo(name) {
   return REPO_SHAPE.test(s) && !strictSecret(s) ? s : 'project';
 }
 
+// The project name for any Sentinel upload: lib/sentinel-guard.js
+// projectName (git remote repo name, else folder name) passed through the
+// secret check above.
 function repoName(root) {
-  return cleanRepo(path.basename(path.resolve(root || process.cwd())));
+  return cleanRepo(require('./sentinel-guard').projectName(root || process.cwd()));
 }
 
 function makeEvent({ kind, repo, severity = 'info', title, detail = '', status, fingerprint: fp, occurredAt = new Date() }) {
@@ -249,6 +252,112 @@ async function reportFindings(root, kind, openEvents, { token, base, env = proce
   return { ...res, sent: res.ok ? plan.events.length + extra.length : 0, resolved: plan.resolved.length };
 }
 
+// ---------------------------------------------------------------- review fixes
+
+// Review findings a later review closed (status fixed in a review upload).
+// The overview counts a fix when a stored open event comes back resolved,
+// so a finding never sent open goes first as open (dated when its review
+// found it) and then as resolved in a second call. One call would store it
+// resolved and the fix would never count. Local state remembers what was
+// sent: uploading the same review again never counts a fix twice.
+// Open review findings are not sent as events: the overview already counts
+// them from the review itself.
+//
+// The record is keyed by the shared project name, not the checkout path, so
+// every copy of one project on this machine shares it. Each entry is keyed
+// by the closure id: the project name plus the finding's fingerprint, the
+// same pair the server stores the event under.
+//
+// Accepted limit: the server has no idempotency field yet. Two machines
+// (or two uploads racing on one) can each send the open then resolved pair
+// for one finding. Both land on the same stored event and it stays one
+// row. Its fixed time moves to the later send.
+const REVIEW_STATE_KIND = 'review';
+const FIXED_DETAIL = 'A later review found the line that closes this problem.';
+
+function reviewStatePath(repo, env) {
+  return path.join(sentinelDir(env), 'state', `review-${hash(cleanRepo(repo)).slice(0, 16)}.json`);
+}
+
+function closureId(repo, fp) {
+  return `${cleanRepo(repo)}/${fp}`;
+}
+
+function readStateFile(file) {
+  try {
+    const s = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return { open: (s && s.open) || {}, resolved: (s && s.resolved) || {} };
+  } catch { return { open: {}, resolved: {} }; }
+}
+
+// Earlier builds keyed this record by checkout path; fold that one in so a
+// fix already sent from this checkout is not sent again.
+function readReviewState(root, repo, env) {
+  const state = readStateFile(reviewStatePath(repo, env));
+  if (root) {
+    const legacy = readStateFile(statePath(root, REVIEW_STATE_KIND, env));
+    for (const part of ['open', 'resolved']) {
+      for (const [fp, at] of Object.entries(legacy[part])) {
+        const id = fp.includes('/') ? fp : closureId(repo, fp);
+        if (!state[part][id]) state[part][id] = at;
+      }
+    }
+  }
+  return state;
+}
+
+function writeReviewState(repo, state, env) {
+  const file = reviewStatePath(repo, env);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify({ repo: cleanRepo(repo), kind: REVIEW_STATE_KIND, ...state, updated_at: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
+function reviewFixEvent(body, f, status, at) {
+  return makeEvent({
+    kind: 'threat',
+    repo: body.repo,
+    severity: f.severity === 'informational' ? 'info' : f.severity,
+    title: f.title,
+    detail: status === 'resolved' ? FIXED_DETAIL : '',
+    status,
+    fingerprint: f.id,
+    occurredAt: at,
+  });
+}
+
+async function reportReviewFixes(root, body, { token, base, env = process.env, foundAt = null, now = new Date() } = {}) {
+  const repo = cleanRepo(body && body.repo);
+  const findings = ((body && body.findings) || []).filter((f) => f && /^f-[0-9a-f]{12}$/.test(String(f.id || '')));
+  const fixed = findings.filter((f) => f.status === 'fixed');
+  const state = readReviewState(root, repo, env);
+  const id = (f) => closureId(repo, f.id);
+  // A finding open again can be fixed again later and count again.
+  const back = findings.filter((f) => f.status === 'open' && state.resolved[id(f)]);
+  if (back.length) {
+    for (const f of back) delete state.resolved[id(f)];
+    try { writeReviewState(repo, state, env); } catch {}
+  }
+  if (!fixed.length) return { ok: true, sent: 0, fixed: 0 };
+  const todo = fixed.filter((f) => !state.resolved[id(f)]);
+  if (!todo.length) return { ok: true, sent: 0, fixed: 0, already: fixed.length };
+  if (!token) return { ok: false, reason: 'not logged in', sent: 0, fixed: 0 };
+  const found = foundAt && !Number.isNaN(Date.parse(foundAt)) ? new Date(foundAt) : now;
+  const opening = todo.filter((f) => !state.open[id(f)]);
+  if (opening.length) {
+    const res = await postEvents(opening.map((f) => reviewFixEvent(body, f, 'open', found)), { token, base });
+    if (!res.ok) return { ...res, sent: 0, fixed: 0 };
+    for (const f of opening) state.open[id(f)] = found.toISOString();
+    try { writeReviewState(repo, state, env); } catch {}
+  }
+  const res = await postEvents(todo.map((f) => reviewFixEvent(body, f, 'resolved', now)), { token, base });
+  if (!res.ok) return { ...res, sent: opening.length, fixed: 0 };
+  for (const f of todo) { state.resolved[id(f)] = now.toISOString(); delete state.open[id(f)]; }
+  try { writeReviewState(repo, state, env); } catch {}
+  return { ok: true, sent: opening.length + todo.length, fixed: todo.length };
+}
+
 // ---------------------------------------------------------------- queue
 
 function queuePath(env = process.env) {
@@ -307,10 +416,12 @@ module.exports = {
   fillPlain,
   slotOk,
   repoName,
+  cleanRepo,
   makeEvent,
   postEvents,
   chunks,
   reportFindings,
+  reportReviewFixes,
   readState,
   statePath,
   queuePath,