bevor-cli 0.1.0__py3-none-any.whl

bevor_cli/commands/findings/bulk.py

@@ -0,0 +1,110 @@
+"""``bevor findings bulk`` / ``bevor agent submit``."""
+
+import json
+from pathlib import Path
+from typing import List, Optional, cast
+
+import typer
+from bevor_sdk.helpers.converters.sarif import sarif_to_bevor
+from bevor_sdk.types import ID
+from bevor_sdk.types.requests.security import FindingBodyDict
+from bevor_sdk.types.requests.security.findings import AddFindingBodyDict
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+from bevor_cli.findings_yaml import FindingYamlParser
+
+_YAML_SUFFIXES = frozenset({".yaml", ".yml"})
+
+
+def _read(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8")
+    except OSError as exc:
+        output.error(f"Cannot read file: {exc}")
+        raise typer.Exit(1) from exc
+
+
+def bulk_findings(
+    source: Path = typer.Argument(
+        ..., help="A .json file, .sarif file, .yaml/.yml file, or a directory of YAML files."
+    ),
+    version: Optional[str] = typer.Option(
+        None,
+        "--version",
+        help="Version id to stage against (default: configured analysis head).",
+    ),
+) -> None:
+    """Import many findings at once to the configured analysis head, or ``--version`` if given
+
+    ``source`` is dispatched by type:
+
+    - a directory: every ``.yaml``/``.yml`` file in it is parsed, each of which
+      may itself contain multiple findings (``---``-separated documents).
+    - a ``.yaml``/``.yml`` file: parsed the same way, as a single source.
+    - a ``.sarif`` file: converted from SARIF into Bevor findings.
+    """
+
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    body = AddFindingBodyDict(findings=[])
+    version_id: ID | None = None
+    if version is None:
+        analysis_id = state.validate_analysis()
+    else:
+        version_id = ID(version)
+        v_ = client.analysis_versions.get(version_id)
+        analysis_id = v_.analysis_meta.id
+        body["version_id"] = version_id
+
+    if source.is_dir():
+        findings = FindingYamlParser.from_directory(source).parse_many()
+    elif source.suffix.lower() in _YAML_SUFFIXES:
+        if not source.is_file():
+            output.error(f"File does not exist: {source}")
+            raise typer.Exit(1)
+        findings = FindingYamlParser.from_file(source).parse_many()
+    elif source.suffix.lower() == ".sarif":
+        if not source.is_file():
+            output.error(f"File does not exist: {source}")
+            raise typer.Exit(1)
+        try:
+            sarif_raw = json.loads(_read(source))
+        except json.JSONDecodeError as exc:
+            output.error(f"Invalid JSON in {source.name}: {exc}")
+            raise typer.Exit(1) from exc
+        try:
+            findings = sarif_to_bevor(sarif_raw)
+        except ValueError as exc:
+            output.error(f"Invalid sarif format {exc.args}")
+            raise typer.Exit(1)
+    elif source.suffix.lower() == ".json":
+        if not source.is_file():
+            output.error(f"File does not exist: {source}")
+            raise typer.Exit(1)
+        try:
+            raw = json.loads(_read(source))
+        except json.JSONDecodeError as exc:
+            output.error(f"Could not read JSON: {exc}")
+            raise typer.Exit(1) from exc
+        findings = cast(List[FindingBodyDict], raw["findings"])
+    else:
+        output.error(
+            "Unsupported source (use a .json file, .sarif file, .yaml/.yml file, or a directory of YAML files)."
+        )
+        raise typer.Exit(1)
+
+    body["findings"] = findings
+
+    findings_added = client.analyses.add_findings(analysis_id=analysis_id, body=body)
+    output.success(f"Imported {len(findings_added.results)} finding(s) onto version {version_id or 'head'}.")

bevor_cli/commands/findings/delete.py

@@ -0,0 +1,28 @@
+"""``bevor analyses findings delete``."""
+
+import typer
+from bevor_sdk.types import ID
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+
+
+def delete_finding(
+    finding_id: str = typer.Argument(..., help="Finding id to delete."),
+) -> None:
+    """Stage a finding deletion."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    client.findings.delete(ID(finding_id))
+
+    output.success("Finding deletion staged.")

bevor_cli/commands/findings/edit.py

@@ -0,0 +1,109 @@
+"""``bevor analyses findings edit``."""
+
+from pathlib import Path
+from typing import Any
+
+import click
+import typer
+from bevor_sdk.types import ID
+from bevor_sdk.types.requests.security import EditFindingBodyDict
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+from bevor_cli.findings_yaml import FindingFormatError, FindingYamlParser, ParsedFindingDoc
+
+
+def _interactive_edit_doc(client: BevorInternalClient, *, finding_id: str) -> ParsedFindingDoc:
+    existing = client.findings.get(ID(finding_id))
+
+    ftype = typer.prompt("Type", default=str(existing.type)).strip()
+    lvl = typer.prompt("Level", default=str(existing.level)).strip()
+    fname = typer.prompt("Name", default=existing.name).strip()
+
+    typer.echo("", err=True)
+    typer.echo(
+        "Opening your $EDITOR — edit explanation (Markdown ok). Save and exit to continue.",
+        err=True,
+    )
+    explanation = click.edit(existing.explanation)
+    if explanation is None:
+        output.error("Aborted.")
+        raise typer.Exit(1)
+    body_st = explanation.strip()
+    if not body_st:
+        output.error("Explanation cannot be empty.")
+        raise typer.Exit(1)
+
+    rec_raw = typer.prompt(
+        "Recommendation (optional, empty to clear)",
+        default=existing.recommendation or "",
+        show_default=False,
+    ).strip()
+
+    yaml_doc: dict[str, Any] = {
+        "type": ftype,
+        "level": lvl,
+        "name": fname,
+        "explanation": body_st,
+    }
+    if rec_raw:
+        yaml_doc["recommendation"] = rec_raw
+
+    return ParsedFindingDoc(index=1, yaml=yaml_doc)
+
+
+def edit_finding(
+    finding_id: str = typer.Argument(..., help="Finding id to edit."),
+    file: Path | None = typer.Option(
+        None,
+        "--file",
+        "-f",
+        help="YAML with one mapping: ``type``, ``level``, ``name``, ``explanation``; optional "
+        "``recommendation`` / ``reference``.",
+    ),
+) -> None:
+    """Stage an edit to a finding (`--file` YAML or interactive matching current metadata)."""
+
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    if file is not None:
+        try:
+            payload, err = FindingYamlParser.from_file(file).parse_edit()
+        except FindingFormatError as exc:
+            output.error(
+                str(exc), hint="One YAML mapping per file (same layout as findings add ``--file``)."
+            )
+            raise typer.Exit(1) from exc
+    else:
+        payload, err = FindingYamlParser.validate_edit_doc(
+            _interactive_edit_doc(client, finding_id=finding_id)
+        )
+
+    if err:
+        output.error(err)
+        raise typer.Exit(1)
+    assert payload is not None
+
+    client.findings.edit_metadata(
+        ID(finding_id),
+        EditFindingBodyDict(
+            type=payload["type"],
+            level=payload["level"],
+            name=str(payload["name"]),
+            explanation=str(payload["explanation"]),
+            recommendation=payload.get("recommendation"),
+            poc=payload.get("poc"),
+        ),
+    )
+
+    output.success("Finding edit staged.")

bevor_cli/commands/findings/get.py

@@ -0,0 +1,62 @@
+"""``bevor analyses findings get`` — same lookup as ``bevor findings get``."""
+
+from typing import Mapping
+
+import typer
+from bevor_sdk.types import ID
+from bevor_sdk.types.literals import FindingLevel
+from rich.table import Table
+from rich.text import Text
+
+from bevor_cli.annotations.confirmations import JSON_OUT
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+from bevor_cli.output import console
+
+LEVEL_COLORS: Mapping[FindingLevel, str] = {
+    "critical": "red",
+    "high": "bright_red",
+    "medium": "yellow",
+    "low": "blue",
+}
+
+
+def get_finding(
+    finding_id: str = typer.Argument(..., help="Finding ID."), json_out: JSON_OUT = False
+) -> None:
+    """Get the finding details."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    finding = client.findings.get(ID(finding_id))
+
+    if json_out:
+        typer.echo(finding.model_dump_json(indent=2))
+        return
+
+    level_style = LEVEL_COLORS[finding.level]
+
+    table = Table(show_header=False, box=None, padding=(0, 1))
+    table.add_column(style="bold")
+    table.add_column()
+
+    table.add_row("ID", str(finding.id))
+    table.add_row("Code", str(finding.code_id))
+    table.add_row("Name", finding.name)
+    table.add_row("Type", str(finding.type))
+    table.add_row("Level", Text(finding.level, style=level_style))
+    table.add_row("Explanation", finding.explanation)
+    if finding.recommendation:
+        table.add_row("Recommendation", finding.recommendation)
+    if finding.poc:
+        table.add_row("POC (unverified)", finding.poc)
+
+    console.print(table)

bevor_cli/commands/findings/interactive.py

@@ -0,0 +1,329 @@
+"""Interactive + static Rich display for findings."""
+
+from __future__ import annotations
+
+from textwrap import wrap
+from typing import Callable, List
+
+import click
+import typer
+from bevor_sdk.types.literals import FindingDraftOperation
+from bevor_sdk.types.responses.security import FindingSchema
+from rich.console import Group
+from rich.live import Live
+from rich.panel import Panel
+from rich.rule import Rule
+from rich.table import Table
+from rich.text import Text
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.commands.findings.get import LEVEL_COLORS
+
+_LIST_WINDOW = 8
+_MIN_DETAIL_LINES = 6
+
+_OP_COLORS = {"add": "green", "edit": "yellow", "delete": "red"}
+
+
+def _op_badge(operation: FindingDraftOperation | None) -> Text:
+    if not operation:
+        return Text("—", style="dim")
+    return Text(operation.upper(), style=f"bold {_OP_COLORS.get(operation, 'white')}")
+
+
+def _nav_delta(key: str) -> int:
+    if not key:
+        return 0
+    if len(key) == 1 and key.lower() in ("j", "l"):
+        return 1
+    if len(key) == 1 and key.lower() in ("k", "h"):
+        return -1
+    if key.endswith("B"):  # down arrow
+        return 1
+    if key.endswith("A"):  # up arrow
+        return -1
+    return 0
+
+
+def _action_hints(finding: FindingSchema) -> str:
+    parts = ["↑↓/j/k move", "q quit"]
+    if finding.actions.edit.is_allowed:
+        parts.append("e edit")
+    if finding.actions.revert.is_allowed:
+        parts.append("r revert")
+    if finding.actions.delete.is_allowed:
+        parts.append("x delete")
+    return "   ".join(parts)
+
+
+def _fit_text(text: str, *, max_lines: int, width: int) -> Text:
+    if not text:
+        return Text("—")
+    lines = wrap(text, width=width)
+    if len(lines) <= max_lines:
+        return Text("\n".join(lines))
+    clipped = lines[:max_lines]
+    clipped[-1] = clipped[-1][: max(0, width - 1)] + "…"
+    return Text("\n".join(clipped))
+
+
+def _detail_text_budget() -> int:
+    height = output.console.size.height
+    list_rows = _LIST_WINDOW + 5  # header, caption, borders
+    overhead = list_rows + 14  # context panel, rule, hints
+    return max(_MIN_DETAIL_LINES, height - overhead)
+
+
+def _findings_table(
+    rows: List[FindingSchema],
+    focus: int | None = None,
+    *,
+    windowed: bool = False,
+) -> Group | Table:
+    if not windowed or focus is None:
+        table = Table("Level", "Type", "Name", "Original", "ID")
+        for i, finding in enumerate(rows):
+            style = "reverse" if focus is not None and i == focus else ""
+            table.add_row(
+                Text(finding.level, style=LEVEL_COLORS[finding.level]),
+                finding.type,
+                finding.name,
+                str(finding.origin_finding_id == finding.id),
+                str(finding.id),
+                style=style,
+            )
+        return table
+
+    start = max(0, min(focus - _LIST_WINDOW // 2, len(rows) - _LIST_WINDOW))
+    end = min(len(rows), start + _LIST_WINDOW)
+    start = max(0, end - _LIST_WINDOW)
+
+    above = start
+    below = len(rows) - end
+    table = Table(
+        "Level",
+        "Type",
+        "Name",
+        "Original",
+        "ID",
+        caption=f"↑ {above}   {focus + 1}/{len(rows)}   ↓ {below}",
+        caption_justify="center",
+    )
+    for i in range(start, end):
+        finding = rows[i]
+        table.add_row(
+            Text(finding.level, style=LEVEL_COLORS[finding.level]),
+            finding.type,
+            finding.name,
+            str(finding.origin_finding_id == finding.id),
+            str(finding.id),
+            style="reverse" if i == focus else "",
+        )
+    for _ in range(_LIST_WINDOW - (end - start)):
+        table.add_row("", "", "", "", "", style="dim")
+
+    return table
+
+
+def _findings_table_with_ops(
+    rows: List[FindingSchema],
+    focus: int | None = None,
+    *,
+    windowed: bool = False,
+) -> Group | Table:
+    if not windowed or focus is None:
+        table = Table("Op", "Level", "Type", "Name", "Original", "ID")
+        for i, finding in enumerate(rows):
+            style = "reverse" if focus is not None and i == focus else ""
+            table.add_row(
+                _op_badge(finding.operation),
+                Text(finding.level, style=LEVEL_COLORS[finding.level]),
+                finding.type,
+                finding.name,
+                str(finding.origin_finding_id == finding.id),
+                str(finding.id),
+                style=style,
+            )
+        return table
+
+    start = max(0, min(focus - _LIST_WINDOW // 2, len(rows) - _LIST_WINDOW))
+    end = min(len(rows), start + _LIST_WINDOW)
+    start = max(0, end - _LIST_WINDOW)
+
+    above = start
+    below = len(rows) - end
+    table = Table(
+        "Op",
+        "Level",
+        "Type",
+        "Name",
+        "Original",
+        "ID",
+        caption=f"↑ {above}   {focus + 1}/{len(rows)}   ↓ {below}",
+        caption_justify="center",
+    )
+    for i in range(start, end):
+        finding = rows[i]
+        table.add_row(
+            _op_badge(finding.operation),
+            Text(finding.level, style=LEVEL_COLORS[finding.level]),
+            finding.type,
+            finding.name,
+            str(finding.origin_finding_id == finding.id),
+            str(finding.id),
+            style="reverse" if i == focus else "",
+        )
+    for _ in range(_LIST_WINDOW - (end - start)):
+        table.add_row("", "", "", "", "", "", style="dim")
+
+    return table
+
+
+def _kv_table(*, dim: bool = False) -> Table:
+    table = Table(show_header=False, box=None, padding=(0, 1))
+    label_style = "dim bold" if dim else "bold"
+    value_style = "dim" if dim else ""
+    table.add_column(style=label_style, no_wrap=True)
+    table.add_column(style=value_style)
+    return table
+
+
+def _context_panel(finding: FindingSchema) -> Panel:
+    author = finding.created_by_user.username or str(finding.created_by_user.id)
+    meta = _kv_table(dim=True)
+    meta.add_row("ID", str(finding.id))
+    meta.add_row("Analysis", str(finding.version.analysis_id))
+    meta.add_row("Project", str(finding.code_id))
+    meta.add_row("Code version", str(finding.code_id))
+    meta.add_row("Created", str(finding.created_at.date()))
+    meta.add_row("Created by", author)
+    meta.add_row("Node", str(finding.node_id))
+    return Panel(meta, title="Context", border_style="dim", padding=(0, 1))
+
+
+def _finding_panel(finding: FindingSchema, *, text_budget: int) -> Panel:
+    width = max(40, output.console.size.width - 8)
+    header = _kv_table()
+    header.add_row("Level", Text(finding.level, style=LEVEL_COLORS[finding.level]))
+    header.add_row("Type", str(finding.type))
+    header.add_row("Acknowledged", str(finding.is_acknowledged))
+
+    sections = 1 + bool(finding.recommendation) + bool(finding.poc)
+    body_lines = max(2, text_budget - sections * 2 - 4)
+
+    body: list[Text | Table] = [header, Text("")]
+    body.append(Text("Explanation", style="bold"))
+    body.append(_fit_text(finding.explanation or "", max_lines=body_lines, width=width))
+    if finding.recommendation:
+        body.extend(
+            [
+                Text(""),
+                Text("Recommendation", style="bold"),
+                _fit_text(finding.recommendation, max_lines=3, width=width),
+            ]
+        )
+    if finding.poc:
+        body.extend(
+            [
+                Text(""),
+                Text("POC", style="bold"),
+                _fit_text(finding.poc, max_lines=2, width=width),
+            ]
+        )
+
+    return Panel(Group(*body), title=finding.name, border_style="cyan", padding=(0, 1))
+
+
+def _detail_panel(finding: FindingSchema) -> Group:
+    return Group(
+        _context_panel(finding),
+        Rule(style="dim"),
+        _finding_panel(finding, text_budget=_detail_text_budget()),
+    )
+
+
+def _render(rows: List[FindingSchema], focus: int) -> Group:
+    return Group(
+        _findings_table(rows, focus=focus, windowed=True),
+        _detail_panel(rows[focus]),
+        Text("↑↓ or j/k move   q quit", style="dim"),
+    )
+
+
+def print_findings_table(rows: List[FindingSchema]) -> None:
+    table = _findings_table(rows)
+    assert isinstance(table, Table)
+    output.console.print(table)
+
+
+def print_findings_table_with_ops(rows: List[FindingSchema]) -> None:
+    table = _findings_table_with_ops(rows)
+    assert isinstance(table, Table)
+    output.console.print(table)
+
+
+def browse_findings_with_actions(
+    client: BevorInternalClient,
+    refetch: Callable[[], List[FindingSchema]],
+    rows: List[FindingSchema],
+) -> None:
+    focus = 0
+
+    rows = list(rows)
+
+    def render() -> Group:
+        f = rows[focus]
+        return Group(
+            _findings_table_with_ops(rows, focus=focus, windowed=True),
+            _detail_panel(f),
+            Text(_action_hints(f), style="dim"),
+        )
+
+    with Live(
+        render(),
+        console=output.console,
+        transient=True,
+        auto_refresh=False,
+        vertical_overflow="visible",
+    ) as live:
+        while rows:
+            try:
+                ch = click.getchar()
+            except (EOFError, KeyboardInterrupt):
+                raise typer.Abort from None
+
+            key = ch if isinstance(ch, str) else ch.decode("utf-8", "replace")
+            if key.lower() == "q":
+                return
+
+            f = rows[focus]
+
+            if key.lower() == "r" and f.actions.revert.is_allowed:
+                live.stop()
+                if typer.confirm(f"Revert staged {f.operation} on {f.name!r}?"):
+                    client.findings.revert(f.id)
+                    rows = refetch()
+                    focus = min(focus, len(rows) - 1)
+                live.start()
+                if not rows:
+                    return
+                live.update(render(), refresh=True)
+                continue
+
+            if key.lower() == "x" and f.actions.delete.is_allowed:
+                live.stop()
+                if typer.confirm(f"Stage a deletion for {f.name!r}?"):
+                    client.findings.delete(f.id)
+                    rows = refetch()
+                    focus = min(focus, len(rows) - 1)
+                live.start()
+                if not rows:
+                    return
+                live.update(render(), refresh=True)
+                continue
+
+            delta = _nav_delta(key)
+            if delta:
+                focus = (focus + delta) % len(rows)
+                live.update(render(), refresh=True)