mobbdev 0.0.168 → 0.0.170

package/dist/index.mjs

@@ -188,14 +188,14 @@ var Project_Role_Type_Enum = /* @__PURE__ */ ((Project_Role_Type_Enum2) => {
   Project_Role_Type_Enum2["Writer"] = "writer";
   return Project_Role_Type_Enum2;
 })(Project_Role_Type_Enum || {});
-var Vulnerability_Report_Vendor_Enum = /* @__PURE__ */ ((Vulnerability_Report_Vendor_Enum3) => {
-  Vulnerability_Report_Vendor_Enum3["Checkmarx"] = "checkmarx";
-  Vulnerability_Report_Vendor_Enum3["CheckmarxXml"] = "checkmarxXml";
-  Vulnerability_Report_Vendor_Enum3["Codeql"] = "codeql";
-  Vulnerability_Report_Vendor_Enum3["Fortify"] = "fortify";
-  Vulnerability_Report_Vendor_Enum3["Snyk"] = "snyk";
-  Vulnerability_Report_Vendor_Enum3["Sonarqube"] = "sonarqube";
-  return Vulnerability_Report_Vendor_Enum3;
+var Vulnerability_Report_Vendor_Enum = /* @__PURE__ */ ((Vulnerability_Report_Vendor_Enum4) => {
+  Vulnerability_Report_Vendor_Enum4["Checkmarx"] = "checkmarx";
+  Vulnerability_Report_Vendor_Enum4["CheckmarxXml"] = "checkmarxXml";
+  Vulnerability_Report_Vendor_Enum4["Codeql"] = "codeql";
+  Vulnerability_Report_Vendor_Enum4["Fortify"] = "fortify";
+  Vulnerability_Report_Vendor_Enum4["Snyk"] = "snyk";
+  Vulnerability_Report_Vendor_Enum4["Sonarqube"] = "sonarqube";
+  return Vulnerability_Report_Vendor_Enum4;
 })(Vulnerability_Report_Vendor_Enum || {});
 var Vulnerability_Severity_Enum = /* @__PURE__ */ ((Vulnerability_Severity_Enum2) => {
   Vulnerability_Severity_Enum2["Critical"] = "critical";
@@ -308,7 +308,7 @@ var GetAnalsyisDocument = `
 var GetFixesDocument = `
     query getFixes($filters: fix_bool_exp!) {
   fixes: fix(where: $filters) {
-    issueType
+    safeIssueType
     id
     vulnerabilitySeverity
     issueLanguage
@@ -738,7 +738,7 @@ var ReportQueryResultZ = z.object({
       z.object({
         id: z.string().uuid(),
         issueLanguage: z.nativeEnum(IssueLanguage_Enum).nullable(),
-        issueType: z.nativeEnum(IssueType_Enum).nullable(),
+        safeIssueType: z.string(),
         confidence: z.number(),
         effortToApplyFix: z.nativeEnum(Effort_To_Apply_Fix_Enum).nullable(),
         modifiedBy: z.string().nullable(),
@@ -833,7 +833,7 @@ var ReportFixesQueryZ = z.array(
     gitBlameLogin: z.string().nullable(),
     effortToApplyFix: z.nativeEnum(Effort_To_Apply_Fix_Enum).nullable(),
     issueLanguage: z.nativeEnum(IssueLanguage_Enum).nullable(),
-    issueType: z.nativeEnum(IssueType_Enum).nullable(),
+    safeIssueType: z.string(),
     vulnerabilitySeverity: z.nativeEnum(Vulnerability_Severity_Enum).nullable().transform((i) => i ?? "low" /* Low */),
     fixReportId: z.string().uuid(),
     filePaths: z.array(
@@ -903,7 +903,8 @@ var FixQueryZ = z.object({
   modifiedBy: z.string().nullable(),
   gitBlameLogin: z.string().nullable(),
   issueLanguage: z.nativeEnum(IssueLanguage_Enum).nullable(),
-  issueType: z.nativeEnum(IssueType_Enum).nullable(),
+  safeIssueType: z.string(),
+  // issueType: z.nativeEnum(IssueType_Enum).nullable(),
   confidence: z.number(),
   fixReportId: z.string().uuid(),
   isExpired: z.boolean().default(false),
@@ -919,7 +920,6 @@ var FixQueryZ = z.object({
   vulnerabilityReportIssues: z.array(
     z.object({
       vendorIssueId: z.string(),
-      issueType: z.string(),
       issueLanguage: z.string()
     })
   ),
@@ -990,7 +990,17 @@ var FixScreenQueryResultZ = z.object({
       }).array()
     })
   }),
-  fix_by_pk: FixQueryZ,
+  fix_by_pk: FixQueryZ.merge(
+    z.object({
+      vulnerabilityReportIssues: z.array(
+        z.object({
+          vendorIssueId: z.string(),
+          issueType: z.string(),
+          issueLanguage: z.string()
+        })
+      )
+    })
+  ),
   fixesWithSameIssueType: z.object({
     fix: z.array(z.object({ id: z.string().uuid() }))
   })
@@ -1608,7 +1618,7 @@ var issueTypeMap = {
   ["AUTO_ESCAPE_FALSE" /* AutoEscapeFalse */]: "Auto-escape False"
 };
 var issueTypeZ = z4.nativeEnum(IssueType_Enum);
-var getIssueType = (issueType) => {
+var getIssueTypeFriendlyString = (issueType) => {
   const issueTypeZParseRes = issueTypeZ.safeParse(issueType);
   if (!issueTypeZParseRes.success) {
     return issueType ? issueType.replaceAll("_", " ") : "Other";
@@ -1643,7 +1653,7 @@ var getCommitDescription = ({
   if (!staticData) {
     return "";
   }
-  const issueTypeString = getIssueType(issueType);
+  const issueTypeString = getIssueTypeFriendlyString(issueType);
   let description = `This change fixes a **${severity} severity** (${severityToEmoji[severity]}) **${issueTypeString}** issue reported by **${capitalizeFirstLetter(
     vendor
   )}**.
@@ -2941,12 +2951,20 @@ function getFixGuidances({
   const fixGuidance = storeFixResult.success ? [storeFixResult.data.guidance({ questions, ...extraContext })] : [];
   return libGuidances.concat(fixGuidance).filter((guidance) => !!guidance);
 }
-function getGuidances({
-  questions,
-  issueType,
-  issueLanguage,
-  fixExtraContext
-}) {
+var IssueTypeAndLanguageZ = z8.object({
+  issueType: z8.nativeEnum(IssueType_Enum),
+  issueLanguage: z8.nativeEnum(IssueLanguage_Enum)
+});
+function getGuidances(args) {
+  const safeIssueTypeAndLanguage = IssueTypeAndLanguageZ.safeParse({
+    issueType: args.issueType,
+    issueLanguage: args.issueLanguage
+  });
+  if (!safeIssueTypeAndLanguage.success) {
+    return [];
+  }
+  const { questions, fixExtraContext } = args;
+  const { issueType, issueLanguage } = safeIssueTypeAndLanguage.data;
   const fixGuidances = getFixGuidances({
     issueType,
     issueLanguage,
@@ -2957,8 +2975,8 @@ function getGuidances({
     let questionGuidance = question.guidance;
     if (!questionGuidance && issueType && issueLanguage) {
       const getFixInformation = curriedQuestionInformationByQuestion({
-        issueType: z8.nativeEnum(IssueType_Enum).parse(issueType),
-        language: z8.nativeEnum(IssueLanguage_Enum).parse(issueLanguage)
+        issueType,
+        language: issueLanguage
       });
       const { guidance } = getFixInformation(question);
       questionGuidance = guidance({
@@ -3637,7 +3655,7 @@ function getFetch(url) {
   }
   return fetch2;
 }
-function getOktoKit(options) {
+function getOctoKit(options) {
   const token = !options?.auth && !isGithubOnPrem(options?.url) ? GITHUB_API_TOKEN : options?.auth;
   const baseUrl = options?.url && isGithubOnPrem(options.url) ? `${new URL(options.url).origin}/api/v3` : void 0;
   return new Octokit({
@@ -3654,7 +3672,7 @@ function isGithubActionActionToken(token) {
 }
 async function githubValidateParams(url, accessToken) {
   try {
-    const oktoKit = getOktoKit({ auth: accessToken, url });
+    const oktoKit = getOctoKit({ auth: accessToken, url });
     if (accessToken && !isGithubActionActionToken(accessToken)) {
       await oktoKit.rest.users.getAuthenticated();
     }
@@ -3681,57 +3699,57 @@ async function githubValidateParams(url, accessToken) {
 }
 
 // src/features/analysis/scm/github/github.ts
-function getGithubSdk(parmas = {}) {
-  const octokit = getOktoKit(parmas);
+function getGithubSdk(params = {}) {
+  const octokit = getOctoKit(params);
   return {
-    async postPrComment(params) {
-      return octokit.request(POST_COMMENT_PATH, params);
+    async postPrComment(params2) {
+      return octokit.request(POST_COMMENT_PATH, params2);
     },
-    async updatePrComment(params) {
-      return octokit.request(UPDATE_COMMENT_PATH, params);
+    async updatePrComment(params2) {
+      return octokit.request(UPDATE_COMMENT_PATH, params2);
     },
-    async getPrComments(params) {
-      return octokit.request(GET_PR_COMMENTS_PATH, params);
+    async getPrComments(params2) {
+      return octokit.request(GET_PR_COMMENTS_PATH, params2);
     },
-    async getPrComment(params) {
-      return octokit.request(GET_PR_COMMENT_PATH, params);
+    async getPrComment(params2) {
+      return octokit.request(GET_PR_COMMENT_PATH, params2);
     },
-    async deleteComment(params) {
-      return octokit.request(DELETE_COMMENT_PATH, params);
+    async deleteComment(params2) {
+      return octokit.request(DELETE_COMMENT_PATH, params2);
     },
-    async replyToCodeReviewComment(params) {
-      return octokit.request(REPLY_TO_CODE_REVIEW_COMMENT_PATH, params);
+    async replyToCodeReviewComment(params2) {
+      return octokit.request(REPLY_TO_CODE_REVIEW_COMMENT_PATH, params2);
     },
-    async getPrDiff(params) {
+    async getPrDiff(params2) {
       return octokit.request(GET_PR, {
-        ...params,
+        ...params2,
         mediaType: { format: "diff" }
       });
     },
-    async getPr(params) {
-      return octokit.request(GET_PR, { ...params });
+    async getPr(params2) {
+      return octokit.request(GET_PR, { ...params2 });
     },
-    async createOrUpdateRepositorySecret(params) {
-      return octokit.request(CREATE_OR_UPDATE_A_REPOSITORY_SECRET, params);
+    async createOrUpdateRepositorySecret(params2) {
+      return octokit.request(CREATE_OR_UPDATE_A_REPOSITORY_SECRET, params2);
     },
-    async getRepositoryPublicKey(params) {
-      return octokit.request(GET_A_REPOSITORY_PUBLIC_KEY, params);
+    async getRepositoryPublicKey(params2) {
+      return octokit.request(GET_A_REPOSITORY_PUBLIC_KEY, params2);
     },
-    async postGeneralPrComment(params) {
-      return octokit.request(POST_GENERAL_PR_COMMENT, params);
+    async postGeneralPrComment(params2) {
+      return octokit.request(POST_GENERAL_PR_COMMENT, params2);
     },
-    async getGeneralPrComments(params) {
-      return octokit.request(GET_GENERAL_PR_COMMENTS, params);
+    async getGeneralPrComments(params2) {
+      return octokit.request(GET_GENERAL_PR_COMMENTS, params2);
     },
-    async deleteGeneralPrComment(params) {
-      return octokit.request(DELETE_GENERAL_PR_COMMENT, params);
+    async deleteGeneralPrComment(params2) {
+      return octokit.request(DELETE_GENERAL_PR_COMMENT, params2);
     },
     async getGithubUsername() {
       const res = await octokit.rest.users.getAuthenticated();
       return res.data.login;
     },
-    async getGithubIsUserCollaborator(params) {
-      const { username, repoUrl } = params;
+    async getGithubIsUserCollaborator(params2) {
+      const { username, repoUrl } = params2;
       try {
         const { owner, repo } = parseGithubOwnerAndRepo(repoUrl);
         const res = await octokit.rest.repos.checkCollaborator({
@@ -3747,8 +3765,8 @@ function getGithubSdk(parmas = {}) {
       }
       return false;
     },
-    async getGithubPullRequestStatus(params) {
-      const { repoUrl, prNumber } = params;
+    async getGithubPullRequestStatus(params2) {
+      const { repoUrl, prNumber } = params2;
       const { owner, repo } = parseGithubOwnerAndRepo(repoUrl);
       const res = await octokit.rest.pulls.get({
         owner,
@@ -3763,8 +3781,8 @@ function getGithubSdk(parmas = {}) {
       }
       return res.data.state;
     },
-    async getGithubIsRemoteBranch(params) {
-      const { repoUrl, branch } = params;
+    async getGithubIsRemoteBranch(params2) {
+      const { repoUrl, branch } = params2;
       const { owner, repo } = parseGithubOwnerAndRepo(repoUrl);
       try {
         const res = await octokit.rest.repos.getBranch({
@@ -3891,8 +3909,8 @@ function getGithubSdk(parmas = {}) {
         sha: res.data.sha
       };
     },
-    async getGithubBlameRanges(params) {
-      const { ref, gitHubUrl, path: path9 } = params;
+    async getGithubBlameRanges(params2) {
+      const { ref, gitHubUrl, path: path9 } = params2;
       const { owner, repo } = parseGithubOwnerAndRepo(gitHubUrl);
       const res = await octokit.graphql(
         GET_BLAME_DOCUMENT,
@@ -3915,8 +3933,8 @@ function getGithubSdk(parmas = {}) {
       }));
     },
     // todo: refactor the name for this function
-    async createPr(params) {
-      const { sourceRepoUrl, filesPaths, userRepoUrl, title, body } = params;
+    async createPr(params2) {
+      const { sourceRepoUrl, filesPaths, userRepoUrl, title, body } = params2;
       const { owner: sourceOwner, repo: sourceRepo } = parseGithubOwnerAndRepo(sourceRepoUrl);
       const { owner, repo } = parseGithubOwnerAndRepo(userRepoUrl);
       const [sourceFilePath, secondFilePath] = filesPaths;
@@ -5721,6 +5739,10 @@ async function adoValidateParams({
       await getAdoClientParams({ url, accessToken, tokenOrg })
     );
     await api2.connect();
+    if (url) {
+      const git = await api2.getGitApi();
+      await validateAdoRepo({ git, repoUrl: url });
+    }
   } catch (e) {
     console.log("adoValidateParams error", e);
     const error = e;
@@ -5763,6 +5785,20 @@ async function _getOrgsForOauthToken({
   const orgs = accounts.value.map((account) => account.accountName).filter((value, index, array) => array.indexOf(value) === index);
   return orgs;
 }
+async function validateAdoRepo({
+  git,
+  repoUrl
+}) {
+  const isAdoRepo = !!parseScmURL(repoUrl, "Ado" /* Ado */);
+  if (!isAdoRepo) {
+    return;
+  }
+  const { repo, projectName } = parseAdoOwnerAndRepo(repoUrl);
+  const branches = await git.getBranches(repo, projectName);
+  if (!branches || branches.length === 0) {
+    throw new InvalidRepoUrlError("no branches");
+  }
+}
 
 // src/features/analysis/scm/ado/ado.ts
 async function getAdoSdk(params) {
@@ -5770,12 +5806,8 @@ async function getAdoSdk(params) {
   return {
     async getAdoIsUserCollaborator({ repoUrl }) {
       try {
-        const { repo, projectName } = parseAdoOwnerAndRepo(repoUrl);
         const git = await api2.getGitApi();
-        const branches = await git.getBranches(repo, projectName);
-        if (!branches || branches.length === 0) {
-          throw new InvalidRepoUrlError("no branches");
-        }
+        await validateAdoRepo({ git, repoUrl });
         return true;
       } catch (e) {
         return false;
@@ -5805,10 +5837,12 @@ async function getAdoSdk(params) {
       try {
         const branchStatus = await git.getBranch(repo, branch, projectName);
         if (!branchStatus || !branchStatus.commit) {
+          console.log(`no branch status: ${JSON.stringify(branchStatus)}`);
           throw new InvalidRepoUrlError("no branch status");
         }
         return branchStatus.name === branch;
       } catch (e) {
+        console.error(`error in getAdoIsRemoteBranch: ${JSON.stringify(e)}`);
         return false;
       }
     },
@@ -6238,20 +6272,33 @@ Refresh the page in order to see the changes.`,
     redirectUrl: commentRes.data.html_url,
     commentId
   });
-  const issueType = getIssueType(fix.issueType ?? null);
+  const issueType = getIssueTypeFriendlyString(fix.safeIssueType);
   const title = `# ${MobbIconMarkdown} ${issueType} fix is ready`;
   const patchAndQuestions = await PatchAndQuestionsZ.parseAsync(
     fix.patchAndQuestions
   );
+  const validFixParseRes = z18.object({
+    vulnerabilitySeverity: z18.nativeEnum(Vulnerability_Severity_Enum),
+    issueLanguage: z18.nativeEnum(IssueLanguage_Enum),
+    safeIssueType: z18.nativeEnum(IssueType_Enum)
+  }).safeParse(fix);
+  if (!validFixParseRes.success) {
+    debug5(
+      `fix ${fixId} does not have all the required fields to create a comment`,
+      validFixParseRes.error
+    );
+    return;
+  }
+  const validFix = validFixParseRes.data;
   const subTitle = getCommitDescription({
-    issueType: fix.issueType,
+    issueType: validFix.safeIssueType,
     vendor: scanner,
-    severity: fix.vulnerabilitySeverity,
-    issueLanguage: fix.issueLanguage,
+    severity: validFix.vulnerabilitySeverity,
+    issueLanguage: validFix.issueLanguage,
     guidances: getGuidances({
       questions: patchAndQuestions.questions.map(toQuestion),
-      issueType: fix.issueType,
-      issueLanguage: fix.issueLanguage,
+      issueType: validFix.safeIssueType,
+      issueLanguage: validFix.issueLanguage,
       fixExtraContext: patchAndQuestions.extraContext
     })
   });
@@ -6283,7 +6330,7 @@ function buildAnalysisSummaryComment(params) {
         if (!fix) {
           throw new Error(`fix ${vulnerabilityReportIssue.fixId} not found`);
         }
-        const issueType = getIssueType(fix.issueType ?? null);
+        const issueType = getIssueTypeFriendlyString(fix.safeIssueType);
         const vulnerabilityReportIssueCount = (result[issueType] || 0) + 1;
         return {
           ...result,
@@ -8044,7 +8091,7 @@ async function scan(scanOptions, { skipPrompts = false } = {}) {
   const selectedScanner = scanner || await choseScanner();
   if (selectedScanner !== SCANNERS.Checkmarx && selectedScanner !== SCANNERS.Snyk) {
     throw new CliError(
-      "Vulnerability scanning via Bugsy is available only with Snyk at the moment. Additional scanners will follow soon."
+      "Vulnerability scanning via Bugsy is available only with Snyk and Checkmarx at the moment. Additional scanners will follow soon."
     );
   }
   selectedScanner === SCANNERS.Checkmarx && validateCheckmarxInstallation();

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "mobbdev",
-  "version": "0.0.168",
+  "version": "0.0.170",
   "description": "Automated secure code remediation tool",
-  "repository": "https://github.com/mobb-dev/bugsy",
+  "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "scripts": {
@@ -12,12 +12,14 @@
     "build": "tsc && tsup-node --env.NODE_ENV production",
     "build:dev": "tsup-node --env.NODE_ENV development",
     "test": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run",
+    "test:coverage": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --coverage ",
     "test:watch": "TOKEN=$(../../scripts/login_auth0.sh) vitest",
     "lint": "eslint --cache --max-warnings 0 --ignore-path .eslintignore --ext .ts,.tsx,.jsx .",
     "lint:fix": "eslint --fix --cache --max-warnings 0 --ignore-path .eslintignore --ext .js,.ts,.tsx,.jsx .",
     "lint:fix:files": "eslint --fix --cache --max-warnings 0 --ignore-path .eslintignore --ext .js,.ts,.tsx,.jsx",
     "prepack": "dotenv-vault pull production .env && pnpm build",
-    "generate": "pnpm run env -- graphql-codegen -r dotenv/config --config client_codegen.ts"
+    "generate": "pnpm run env -- graphql-codegen -r dotenv/config --config client_codegen.ts",
+    "test:e2e": "cd ./__e2e__ && npm i && npm run test"
   },
   "bin": {
     "mobbdev": "bin/cli.mjs"
@@ -63,19 +65,19 @@
     "supports-color": "9.4.0",
     "tar": "6.2.1",
     "tmp": "0.2.3",
-    "undici": "6.19.8",
+    "undici": "6.20.0",
     "uuid": "10.0.0",
     "ws": "8.18.0",
     "yargs": "17.7.2",
     "zod": "3.23.8"
   },
   "devDependencies": {
-    "@graphql-codegen/cli": "5.0.2",
-    "@graphql-codegen/typescript": "4.0.9",
+    "@graphql-codegen/cli": "5.0.3",
+    "@graphql-codegen/typescript": "4.1.0",
     "@graphql-codegen/typescript-graphql-request": "6.2.0",
-    "@graphql-codegen/typescript-operations": "4.2.3",
+    "@graphql-codegen/typescript-operations": "4.3.0",
     "@octokit/request-error": "3.0.3",
-    "@octokit/types": "13.6.0",
+    "@octokit/types": "13.6.1",
     "@types/adm-zip": "0.5.5",
     "@types/chalk-animation": "1.6.3",
     "@types/configstore": "6.0.2",
@@ -89,14 +91,16 @@
     "@types/yargs": "17.0.33",
     "@typescript-eslint/eslint-plugin": "7.17.0",
     "@typescript-eslint/parser": "7.17.0",
+    "@vitest/coverage-istanbul": "2.1.2",
+    "@vitest/ui": "^2.1.2",
     "eslint": "8.57.0",
-    "eslint-plugin-import": "2.30.0",
+    "eslint-plugin-import": "2.31.0",
     "eslint-plugin-prettier": "5.2.1",
     "eslint-plugin-simple-import-sort": "10.0.0",
     "prettier": "3.3.3",
     "tsup": "7.2.0",
     "typescript": "4.9.5",
-    "vitest": "0.34.6"
+    "vitest": "2.1.2"
   },
   "engines": {
     "node": ">=18.18.0"