thothctl 0.18.7__tar.gz → 0.18.9__tar.gz

{thothctl-0.18.7 → thothctl-0.18.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: thothctl
-Version: 0.18.7
+Version: 0.18.9
 Summary: A CLI for Developer Control Plane. Accelerate your cloud IaC deployments.
 Project-URL: SourceCode, https://github.com/thothforge/thothctl
 Project-URL: HomePage, https://github.com/thothforge/thothctl

{thothctl-0.18.7 → thothctl-0.18.9}/src/thothctl/commands/scan/commands/iac.py

@@ -67,13 +67,13 @@ class RestoredIaCScanCommand(ClickCommand):
             
             # Create a panel with scan information
             scan_info = Panel(
-                f"[bold]Starting security scan (Original Mode)[/bold]\n\n"
+                f"[bold]Starting security scan[/bold]\n\n"
                 f"Directory: [cyan]{code_directory}[/cyan]\n"
                 f"Project: [magenta]{project_name}[/magenta]\n"
                 f"Tools: [yellow]{', '.join(tools)}[/yellow]\n"
                 f"Reports directory: [green]{reports_dir}[/green]\n"
-                f"Output: [blue]Original structure with unified styling[/blue]",
-                title="[bold blue]ThothCTL Original Scan[/bold blue]",
+                f"Enforcement: [{'red' if self._enforcement == 'hard' else 'green'}]{self._enforcement}[/{'red' if self._enforcement == 'hard' else 'green'}]",
+                title="[bold blue]ThothCTL Security Scan[/bold blue]",
                 border_style="blue"
             )
             self.console.print(scan_info)
@@ -171,12 +171,12 @@ class RestoredIaCScanCommand(ClickCommand):
 
             # Create completion panel
             completion_panel = Panel(
-                f"[bold green]Original scan completed successfully![/bold green]\n\n"
+                f"[bold green]Security scan completed![/bold green]\n\n"
                 f"⏱️  Scan time: [cyan]{scan_time:.2f} seconds[/cyan]\n"
                 f"📊 Reports directory: [blue]{reports_dir}[/blue]\n"
                 f"🎨 HTML reports: [blue]Generated with unified styling[/blue]\n"
                 f"🔍 Tools used: [yellow]{len(tools)}[/yellow]",
-                title="[bold green]Original Scan Complete[/bold green]",
+                title="[bold green]Scan Complete[/bold green]",
                 border_style="green"
             )
             self.console.print(completion_panel)
@@ -184,20 +184,90 @@ class RestoredIaCScanCommand(ClickCommand):
             # Exit with code 1 if hard enforcement failed
             if has_violations:
                 ctx = click.get_current_context()
-                self.console.print(
-                    "[bold red]⛔ Hard enforcement: policy violations detected. Exiting with code 1.[/bold red]"
+                # Collect violation details per tool
+                violation_lines = []
+                all_findings = []
+                for tool_name, tool_result in results.items():
+                    if tool_name == "summary" or not isinstance(tool_result, dict):
+                        continue
+                    rd = tool_result.get("report_data", {})
+                    failed = rd.get("failed_count", 0)
+                    errors = rd.get("error_count", 0)
+                    if failed + errors > 0:
+                        violation_lines.append(
+                            f"  • [yellow]{tool_name}[/yellow]: {failed} violation{'s' if failed != 1 else ''}, {errors} error{'s' if errors != 1 else ''}"
+                        )
+                        # Collect findings for the table (only HIGH/deny-level)
+                        for f in tool_result.get("findings", []):
+                            sev = f.get("severity", "HIGH").upper()
+                            if sev in ("HIGH", "CRITICAL"):
+                                all_findings.append({**f, "tool": tool_name})
+
+                # Build non-compliance table
+                findings_table = Table(
+                    title="Non-Compliance Findings",
+                    box=rich.box.SIMPLE_HEAVY,
+                    header_style="bold red",
+                    title_style="bold red",
+                    show_lines=False,
+                    expand=True,
+                )
+                findings_table.add_column("Tool", style="yellow", max_width=12)
+                findings_table.add_column("Severity", justify="center", max_width=10)
+                findings_table.add_column("Policy Violation", style="white", ratio=3)
+                findings_table.add_column("File", style="dim", ratio=2, overflow="ellipsis")
+
+                # Show up to 15 findings
+                display_findings = all_findings[:15]
+                for f in display_findings:
+                    sev = f.get("severity", "HIGH").upper()
+                    sev_style = "bold red" if sev == "CRITICAL" else "red"
+                    file_ref = f.get("file", "")
+                    if file_ref and len(file_ref) > 60:
+                        file_ref = "..." + file_ref[-57:]
+                    line = f.get("line", 0)
+                    file_display = f"{file_ref}:{line}" if line else file_ref
+
+                    findings_table.add_row(
+                        f.get("tool", ""),
+                        f"[{sev_style}]{sev}[/{sev_style}]",
+                        f.get("title", ""),
+                        file_display,
+                    )
+
+                remaining = len(all_findings) - len(display_findings)
+                if remaining > 0:
+                    findings_table.add_row(
+                        "", "", f"[dim]... and {remaining} more[/dim]", ""
+                    )
+
+                self.console.print()
+                self.console.print(findings_table)
+
+                violations_detail = "\n".join(violation_lines)
+                enforcement_panel = Panel(
+                    f"[bold red]Security policy violations detected[/bold red]\n\n"
+                    f"{violations_detail}\n\n"
+                    f"[dim]Mode:[/dim] [bold]--enforcement hard[/bold] — pipeline will exit with code 1\n"
+                    f"[dim]Fix:[/dim]  Resolve the violations above, or use [bold]--enforcement soft[/bold] to report without blocking.\n"
+                    f"[dim]Reports:[/dim] See [blue]{reports_dir}[/blue] for details.",
+                    title="[bold red]⛔ Enforcement Failed[/bold red]",
+                    border_style="red"
                 )
+                self.console.print(enforcement_panel)
                 ctx.exit(1)
 
         except Exception as e:
             error_panel = Panel(
-                f"[bold red]Original scan failed![/bold red]\n\n"
-                f"Error: [red]{str(e)}[/red]",
-                title="[bold red]Error[/bold red]",
+                f"[bold red]Security scan could not complete[/bold red]\n\n"
+                f"[red]{str(e)}[/red]\n\n"
+                f"[dim]This is an execution error, not a policy violation.\n"
+                f"Check that the required tools are installed and the target directory is valid.[/dim]",
+                title="[bold red]❌ Scan Error[/bold red]",
                 border_style="red"
             )
             self.console.print(error_panel)
-            self.logger.error(f"Original scan execution failed: {e}")
+            self.logger.error(f"Scan execution failed: {e}")
             raise
 
     def _parse_options(self, options_str: str) -> dict:

{thothctl-0.18.7 → thothctl-0.18.9}/src/thothctl/services/dashboard/dashboard_service.py

@@ -59,6 +59,49 @@ class DashboardService:
             except Exception as e:
                 logger.error(f"Scan results API error: {e}")
                 raise HTTPException(status_code=500, detail=str(e))
+
+        @self.app.get("/api/findings")
+        async def api_findings(
+            tool: str = None,
+            severity: str = None,
+            search: str = None,
+            limit: int = 100,
+            offset: int = 0,
+        ):
+            """API endpoint for individual findings with filtering."""
+            try:
+                result = self.data_loader.get_findings(
+                    tool=tool, severity=severity, search=search,
+                    limit=limit, offset=offset,
+                )
+                return result
+            except Exception as e:
+                logger.error(f"Findings API error: {e}")
+                raise HTTPException(status_code=500, detail=str(e))
+
+        @self.app.get("/api/reports/{report_path:path}")
+        async def api_serve_report(report_path: str):
+            """Serve individual HTML report files for iframe viewing."""
+            from fastapi.responses import FileResponse
+            import os
+
+            # Resolve path safely within the project directory
+            full_path = Path(os.getcwd()) / report_path
+            # Security: ensure the resolved path is within the project
+            try:
+                full_path = full_path.resolve()
+                cwd = Path(os.getcwd()).resolve()
+                if not str(full_path).startswith(str(cwd)):
+                    raise HTTPException(status_code=403, detail="Access denied")
+            except Exception:
+                raise HTTPException(status_code=403, detail="Invalid path")
+
+            if not full_path.exists() or not full_path.is_file():
+                raise HTTPException(status_code=404, detail="Report not found")
+            if full_path.suffix not in (".html", ".json", ".xml", ".sarif"):
+                raise HTTPException(status_code=403, detail="File type not allowed")
+
+            return FileResponse(str(full_path), media_type="text/html" if full_path.suffix == ".html" else "application/json")
         
         @self.app.get("/api/cost-analysis")
         async def api_cost_analysis():

{thothctl-0.18.7 → thothctl-0.18.9}/src/thothctl/services/dashboard/data_loader.py

@@ -62,19 +62,31 @@ class DashboardDataLoader:
             return self.cache[cache_key]["data"]
         
         try:
-            results = {"reports": [], "summary": {"total_issues": 0}}
+            results = {"reports": [], "summary": {"total_issues": 0}, "tools": []}
             
             html_reports = list(self.reports_dir.rglob("*.html"))
             xml_reports = list(self.reports_dir.rglob("*.xml"))
             
+            # Track which tools have reports
+            tools_found = set()
+
             for html_file in html_reports:
-                if "index.html" not in html_file.name:
-                    results["reports"].append({
-                        "file": str(html_file.relative_to(self.base_dir)),
-                        "type": "html",
-                        "timestamp": datetime.fromtimestamp(html_file.stat().st_mtime).isoformat(),
-                        "size": html_file.stat().st_size
-                    })
+                rel_path = str(html_file.relative_to(self.base_dir))
+                # Determine tool from path
+                tool = "other"
+                for t in ("checkov", "trivy", "kics", "opa", "terraform-compliance"):
+                    if t in rel_path:
+                        tool = t
+                        tools_found.add(t)
+                        break
+
+                results["reports"].append({
+                    "file": rel_path,
+                    "type": "html",
+                    "tool": tool,
+                    "timestamp": datetime.fromtimestamp(html_file.stat().st_mtime).isoformat(),
+                    "size": html_file.stat().st_size
+                })
             
             for xml_file in xml_reports:
                 try:
@@ -86,6 +98,8 @@ class DashboardDataLoader:
                 except:
                     pass
             
+            results["tools"] = sorted(tools_found)
+
             if not results["reports"]:
                 return {
                     "error": "No scan results found",
@@ -102,6 +116,166 @@ class DashboardDataLoader:
                 "action": "Check file permissions and try again", 
                 "command": "ls -la Reports/"
             }
+
+    def get_findings(self, tool: str = None, severity: str = None, search: str = None, limit: int = 100, offset: int = 0) -> Dict[str, Any]:
+        """Load individual findings from JSON reports with filtering."""
+        cache_key = "findings_all"
+        if not self._is_cache_valid(cache_key):
+            all_findings = []
+
+            # Parse Checkov JSON reports
+            checkov_dir = self.reports_dir / "checkov" / "security-scan"
+            if checkov_dir.exists():
+                for json_file in checkov_dir.rglob("results_json.json"):
+                    try:
+                        with open(json_file, "r") as f:
+                            data = json.load(f)
+                        results = data.get("results", {})
+                        # Handle both formats
+                        failed_checks = results.get("failed_checks", [])
+                        if not failed_checks:
+                            for check_type_data in results.values():
+                                if isinstance(check_type_data, dict):
+                                    failed_checks.extend(check_type_data.get("failed_checks", []))
+                        for check in failed_checks:
+                            all_findings.append({
+                                "tool": "checkov",
+                                "id": check.get("check_id", ""),
+                                "severity": check.get("severity", "MEDIUM") or "MEDIUM",
+                                "title": check.get("check_result", {}).get("name", check.get("name", "")),
+                                "name": check.get("name", ""),
+                                "file": check.get("file_path", ""),
+                                "line": check.get("file_line_range", [0, 0])[0],
+                                "resource": check.get("resource", ""),
+                                "guideline": check.get("guideline", ""),
+                            })
+                    except (json.JSONDecodeError, KeyError):
+                        continue
+
+            # Parse OPA/Conftest JSON reports
+            opa_report = self.reports_dir / "opa" / "conftest_results.json"
+            if opa_report.exists():
+                try:
+                    with open(opa_report, "r") as f:
+                        data = json.load(f)
+                    if isinstance(data, list):
+                        for result in data:
+                            filename = result.get("filename", "")
+                            for failure in result.get("failures", []):
+                                all_findings.append({
+                                    "tool": "opa",
+                                    "id": "OPA",
+                                    "severity": "HIGH",
+                                    "title": failure.get("msg", ""),
+                                    "name": failure.get("msg", ""),
+                                    "file": filename,
+                                    "line": 0,
+                                    "resource": "",
+                                    "guideline": "",
+                                })
+                            for warning in result.get("warnings", []):
+                                all_findings.append({
+                                    "tool": "opa",
+                                    "id": "OPA",
+                                    "severity": "MEDIUM",
+                                    "title": warning.get("msg", ""),
+                                    "name": warning.get("msg", ""),
+                                    "file": filename,
+                                    "line": 0,
+                                    "resource": "",
+                                    "guideline": "",
+                                })
+                except (json.JSONDecodeError, KeyError):
+                    pass
+
+            # Parse Trivy JSON reports
+            trivy_dir = self.reports_dir / "trivy"
+            if trivy_dir.exists():
+                for json_file in trivy_dir.rglob("results.json"):
+                    try:
+                        with open(json_file, "r") as f:
+                            data = json.load(f)
+                        for result in data.get("Results", []):
+                            for misconf in result.get("Misconfigurations", []):
+                                all_findings.append({
+                                    "tool": "trivy",
+                                    "id": misconf.get("ID", ""),
+                                    "severity": misconf.get("Severity", "MEDIUM"),
+                                    "title": misconf.get("Title", ""),
+                                    "name": misconf.get("Message", misconf.get("Title", "")),
+                                    "file": result.get("Target", ""),
+                                    "line": 0,
+                                    "resource": misconf.get("CauseMetadata", {}).get("Resource", ""),
+                                    "guideline": misconf.get("PrimaryURL", ""),
+                                })
+                    except (json.JSONDecodeError, KeyError):
+                        continue
+
+            # Parse KICS JSON reports
+            kics_report = self.reports_dir / "kics-results.json"
+            if kics_report.exists():
+                try:
+                    with open(kics_report, "r") as f:
+                        data = json.load(f)
+                    for query in data.get("queries", []):
+                        sev = (query.get("severity") or "MEDIUM").upper()
+                        for file_entry in query.get("files", []):
+                            all_findings.append({
+                                "tool": "kics",
+                                "id": query.get("query_id", "")[:12],
+                                "severity": sev,
+                                "title": query.get("query_name", ""),
+                                "name": query.get("query_name", ""),
+                                "file": file_entry.get("file_name", ""),
+                                "line": file_entry.get("line", 0),
+                                "resource": file_entry.get("resource_type", ""),
+                                "guideline": query.get("query_url", ""),
+                            })
+                except (json.JSONDecodeError, KeyError):
+                    pass
+
+            self._cache_data(cache_key, all_findings)
+        else:
+            all_findings = self.cache[cache_key]["data"]
+
+        # Apply filters
+        filtered = all_findings
+        if tool:
+            filtered = [f for f in filtered if f["tool"] == tool]
+        if severity:
+            filtered = [f for f in filtered if f["severity"].upper() == severity.upper()]
+        if search:
+            search_lower = search.lower()
+            filtered = [f for f in filtered if (
+                search_lower in f.get("title", "").lower() or
+                search_lower in f.get("file", "").lower() or
+                search_lower in f.get("resource", "").lower() or
+                search_lower in f.get("id", "").lower()
+            )]
+
+        # Severity counts for the filtered set
+        sev_counts = {}
+        for f in filtered:
+            s = f.get("severity", "UNKNOWN").upper()
+            sev_counts[s] = sev_counts.get(s, 0) + 1
+
+        # Tool counts
+        tool_counts = {}
+        for f in filtered:
+            t = f.get("tool", "unknown")
+            tool_counts[t] = tool_counts.get(t, 0) + 1
+
+        total = len(filtered)
+        page = filtered[offset:offset + limit]
+
+        return {
+            "findings": page,
+            "total": total,
+            "offset": offset,
+            "limit": limit,
+            "severity_counts": sev_counts,
+            "tool_counts": tool_counts,
+        }
     
     def get_cost_analysis(self) -> Dict[str, Any]:
         """Load from terraform plan files or cost analysis cache."""