vibe-coding-qa 0.5.0__py3-none-any.whl

dashboard/backend/api/__init__.py

@@ -0,0 +1,5 @@
+"""FastAPI routers for the dashboard API."""
+
+from . import ai, dashboard, deps, findings, intel, repositories, scans, system
+
+__all__ = ["ai", "dashboard", "deps", "findings", "intel", "repositories", "scans", "system"]

dashboard/backend/api/ai.py

@@ -0,0 +1,142 @@
+"""AI routes.
+
+These endpoints are advisory only. They never influence the release gate, never
+apply a patch without an explicit, confirmed approval call, and never return the
+provider API key. When no provider is configured they answer with
+``configured = false`` and an actionable message instead of inventing content.
+"""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends
+
+from ..schemas import (
+    AIChatRequest,
+    AIChatResponse,
+    AIConversationOut,
+    AIReviewOut,
+    AIReviewRequest,
+    ApproveRequest,
+    ConversationOut,
+    GenericMessage,
+    RemediationOut,
+    RemediationProposeRequest,
+    SummaryOut,
+    SummaryRequest,
+    TestGenerateOut,
+    ThreatModelOut,
+    ThreatModelRequest,
+)
+from .deps import Services, get_services
+
+router = APIRouter(tags=["ai"])
+
+ServicesDep = Annotated[Services, Depends(get_services)]
+
+
+# ------------------------------------------------------------------- assistant
+@router.post("/api/ai/chat", response_model=AIChatResponse)
+def chat(payload: AIChatRequest, services: ServicesDep) -> dict:
+    return services.ai.chat(
+        message=payload.message,
+        repository_id=payload.repository_id,
+        conversation_id=payload.conversation_id,
+    )
+
+
+@router.get("/api/ai/conversations", response_model=list[ConversationOut])
+def list_conversations(services: ServicesDep, repository_id: int | None = None) -> list[dict]:
+    conversations = services.store.list_conversations(repository_id)
+    return [
+        {**item, "message_count": len(services.store.list_messages(item["id"]))}
+        for item in conversations
+    ]
+
+
+@router.get("/api/ai/conversations/{conversation_id}", response_model=AIConversationOut)
+def get_conversation(conversation_id: int, services: ServicesDep) -> dict:
+    conversation = services.store.get_conversation(conversation_id)
+    if conversation is None:
+        raise KeyError(f"Conversation {conversation_id} was not found.")
+    return conversation
+
+
+@router.delete("/api/ai/conversations/{conversation_id}", response_model=GenericMessage)
+def delete_conversation(conversation_id: int, services: ServicesDep) -> dict:
+    if services.store.get_conversation(conversation_id) is None:
+        raise KeyError(f"Conversation {conversation_id} was not found.")
+    services.store.delete_conversation(conversation_id)
+    return {"detail": "Conversation deleted."}
+
+
+# -------------------------------------------------------------- security analyst
+@router.post("/api/ai/findings/{finding_id}/review", response_model=AIReviewOut)
+def review_finding(finding_id: int, payload: AIReviewRequest, services: ServicesDep) -> dict:
+    return services.ai.review_finding(finding_id, payload.kind)
+
+
+@router.post("/api/ai/findings/{finding_id}/test", response_model=TestGenerateOut)
+def generate_test(finding_id: int, services: ServicesDep) -> dict:
+    """Draft a regression test. It is returned as text and never written to disk."""
+    return services.ai.generate_test(finding_id)
+
+
+# ----------------------------------------------------------------- remediation
+@router.post("/api/ai/remediations", response_model=RemediationOut, status_code=201)
+def propose_remediation(payload: RemediationProposeRequest, services: ServicesDep) -> dict:
+    """Generate a patch proposal. Nothing is applied to the working tree."""
+    return services.ai.propose_remediation(payload.finding_id)
+
+
+@router.get("/api/ai/remediations", response_model=list[RemediationOut])
+def list_remediations(
+    services: ServicesDep,
+    repository_id: int | None = None,
+    finding_id: int | None = None,
+) -> list[dict]:
+    return services.store.list_proposals(repository_id=repository_id, finding_id=finding_id)
+
+
+@router.get("/api/ai/remediations/{proposal_id}", response_model=RemediationOut)
+def get_remediation(proposal_id: int, services: ServicesDep) -> dict:
+    proposal = services.store.get_proposal(proposal_id)
+    if proposal is None:
+        raise KeyError(f"Proposal {proposal_id} was not found.")
+    return proposal
+
+
+@router.post("/api/ai/remediations/{proposal_id}/approve", response_model=RemediationOut)
+def approve_remediation(
+    proposal_id: int, payload: ApproveRequest, services: ServicesDep
+) -> dict:
+    """Apply a proposal to the working tree.
+
+    Requires ``confirm = true``; a backup of the original file is written first
+    so the change can be rolled back.
+    """
+    return services.ai.approve_remediation(
+        proposal_id,
+        confirm=payload.confirm,
+        run_tests=payload.run_tests,
+        explicit_permission=payload.explicit_permission,
+    )
+
+
+@router.post("/api/ai/remediations/{proposal_id}/rollback", response_model=RemediationOut)
+def rollback_remediation(proposal_id: int, services: ServicesDep) -> dict:
+    return services.ai.rollback_remediation(proposal_id)
+
+
+# ---------------------------------------------------------------------- reports
+@router.post("/api/ai/summary", response_model=SummaryOut)
+def executive_summary(payload: SummaryRequest, services: ServicesDep) -> dict:
+    return services.ai.executive_summary(
+        repository_id=payload.repository_id, scan_id=payload.scan_id
+    )
+
+
+@router.post("/api/ai/threat-model", response_model=ThreatModelOut)
+def threat_model(payload: ThreatModelRequest, services: ServicesDep) -> dict:
+    return services.ai.threat_model(payload.repository_id)

dashboard/backend/api/dashboard.py

@@ -0,0 +1,34 @@
+"""Dashboard aggregation routes (overview cards, charts and the activity feed)."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from ..schemas import ActivityOut, OverviewOut
+from .deps import Services, get_services
+
+router = APIRouter(tags=["dashboard"])
+
+ServicesDep = Annotated[Services, Depends(get_services)]
+
+
+@router.get("/api/dashboard/overview", response_model=OverviewOut)
+def overview(
+    services: ServicesDep,
+    repository_id: int | None = None,
+) -> dict:
+    """Overview metrics derived from persisted scans only.
+
+    ``has_data`` is false and every series is empty until a scan has actually
+    completed — the dashboard never renders invented numbers.
+    """
+    if repository_id is not None:
+        services.repositories.require(repository_id)
+    return services.dashboard.overview(repository_id)
+
+
+@router.get("/api/dashboard/activity", response_model=ActivityOut)
+def activity(services: ServicesDep, limit: int = Query(default=30, ge=1, le=100)) -> dict:
+    return services.dashboard.activity(limit)

dashboard/backend/api/deps.py

@@ -0,0 +1,51 @@
+"""Shared service container exposed to the API through a FastAPI dependency.
+
+The container is created once per application instance and stored on
+``app.state``, so every route sees the same SQLite store, scan runner and AI
+service. This keeps the routes thin and makes the wiring testable.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from fastapi import Request
+
+from ..ai.service import AIService
+from ..config import Settings, get_settings
+from ..persistence.database import Database
+from ..persistence.store import Store
+from ..services.dashboard import DashboardService
+from ..services.repositories import RepositoryService
+from ..services.scans import ScanRunner
+
+
+@dataclass
+class Services:
+    settings: Settings
+    database: Database
+    store: Store
+    repositories: RepositoryService
+    scans: ScanRunner
+    dashboard: DashboardService
+    ai: AIService
+
+
+def build_services(settings: Settings | None = None) -> Services:
+    resolved = settings or get_settings()
+    database = Database(resolved.db_path)
+    store = Store(database)
+    repositories = RepositoryService(store, resolved)
+    return Services(
+        settings=resolved,
+        database=database,
+        store=store,
+        repositories=repositories,
+        scans=ScanRunner(store, resolved, repositories),
+        dashboard=DashboardService(store, resolved),
+        ai=AIService(store, resolved),
+    )
+
+
+def get_services(request: Request) -> Services:
+    return request.app.state.services

dashboard/backend/api/findings.py

@@ -0,0 +1,102 @@
+"""Finding routes: filter, inspect with real source evidence, and triage."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from vibe_coding_qa.scanners import redact_secrets
+
+from ..schemas import FindingDetailOut, FindingListOut, FindingOut, FindingStatusUpdate
+from ..services.paths import repository_dir
+from ..security import ValidationError, resolve_repo_file
+from .deps import Services, get_services
+
+router = APIRouter(tags=["findings"])
+
+ServicesDep = Annotated[Services, Depends(get_services)]
+
+_EVIDENCE_RADIUS = 12
+
+
+@router.get("/api/findings", response_model=FindingListOut)
+def list_findings(
+    services: ServicesDep,
+    repository_id: int | None = None,
+    scan_id: int | None = None,
+    severity: list[str] | None = Query(default=None),
+    module: list[str] | None = Query(default=None),
+    status: list[str] | None = Query(default=None),
+    search: str | None = None,
+    limit: int | None = Query(default=None, ge=1, le=200),
+    offset: int = Query(default=0, ge=0),
+) -> dict:
+    """List findings.
+
+    Without an explicit ``scan_id`` the store restricts results to the newest
+    completed scan per repository, so the UI shows the current state instead of
+    historical duplicates.
+    """
+    page_size = limit or services.settings.finding_page_size
+    page_size = min(page_size, services.settings.max_page_size)
+    items, total = services.store.list_findings(
+        repository_id=repository_id,
+        scan_id=scan_id,
+        severity=severity,
+        module=module,
+        status=status,
+        search=search,
+        limit=page_size,
+        offset=offset,
+    )
+    return {"items": items, "total": total, "limit": page_size, "offset": offset}
+
+
+@router.get("/api/findings/{finding_id}", response_model=FindingDetailOut)
+def get_finding(finding_id: int, services: ServicesDep) -> dict:
+    finding = services.store.get_finding(finding_id)
+    if finding is None:
+        raise KeyError(f"Finding {finding_id} was not found.")
+
+    detail = dict(finding)
+    detail["evidence"] = _source_evidence(services, finding)
+    detail["history"] = services.store.finding_history(finding["fingerprint"], finding["repository_id"])
+    detail["related"] = services.store.findings_in_file(
+        finding["repository_id"], finding["file"], exclude_id=finding_id
+    )
+    review = services.store.latest_ai_review(finding_id)
+    detail["latest_ai_review"] = review
+    return detail
+
+
+@router.patch("/api/findings/{finding_id}", response_model=FindingOut)
+def update_finding_status(
+    finding_id: int, payload: FindingStatusUpdate, services: ServicesDep
+) -> dict:
+    """Triage a single finding. The status is local to the dashboard."""
+    if services.store.get_finding(finding_id) is None:
+        raise KeyError(f"Finding {finding_id} was not found.")
+    return services.store.set_finding_status(finding_id, payload.status)
+
+
+def _source_evidence(services: Services, finding: dict, radius: int = _EVIDENCE_RADIUS) -> list[str]:
+    """Numbered, redacted lines around the finding, read from the working tree."""
+    repository = services.store.get_repository(finding["repository_id"])
+    if repository is None:
+        return []
+    root = repository_dir(repository)
+    if root is None:
+        return []
+    try:
+        target = resolve_repo_file(root, finding["file"])
+    except (OSError, RuntimeError, ValueError, ValidationError):
+        return []
+    try:
+        lines = target.read_text(encoding="utf-8", errors="ignore").splitlines()
+    except OSError:
+        return []
+    index = max(0, int(finding["line"]) - 1)
+    start = max(0, index - radius)
+    end = min(len(lines), index + radius + 1)
+    return [redact_secrets(f"{number + 1:>5}: {lines[number]}") for number in range(start, end)]

dashboard/backend/api/intel.py

@@ -0,0 +1,41 @@
+"""Architecture and dependency intelligence routes.
+
+Both read only static evidence (the repository profile, resolved lockfiles and
+the persisted findings of the latest scan). When the evidence is missing the
+response says so rather than filling the gap with guesswork.
+"""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from ..schemas import ArchitectureOut, DependenciesOut
+from ..services.intel import build_architecture, build_dependencies
+from .deps import Services, get_services
+
+router = APIRouter(tags=["intelligence"])
+
+ServicesDep = Annotated[Services, Depends(get_services)]
+
+
+@router.get("/api/architecture/{repository_id}", response_model=ArchitectureOut)
+def architecture(repository_id: int, services: ServicesDep) -> dict:
+    repository = services.repositories.require(repository_id)
+    return build_architecture(services.store, repository)
+
+
+@router.get("/api/dependencies/{repository_id}", response_model=DependenciesOut)
+def dependencies(
+    repository_id: int,
+    services: ServicesDep,
+    osv: bool = Query(default=False, description="Query the OSV advisory database (network access)"),
+) -> dict:
+    """Dependencies with resolved versions.
+
+    OSV lookups are opt-in: a GET never performs network calls unless the caller
+    asks for them explicitly.
+    """
+    repository = services.repositories.require(repository_id)
+    return build_dependencies(services.store, repository, osv=osv)

dashboard/backend/api/repositories.py

@@ -0,0 +1,62 @@
+"""Repository routes: register, inspect, refresh and remove repositories."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from ..schemas import GenericMessage, RepositoryCreate, RepositoryOut, ScanListOut
+from .deps import Services, get_services
+
+router = APIRouter(tags=["repositories"])
+
+ServicesDep = Annotated[Services, Depends(get_services)]
+
+
+@router.get("/api/repositories", response_model=list[RepositoryOut])
+def list_repositories(services: ServicesDep) -> list[dict]:
+    return services.repositories.list()
+
+
+@router.post("/api/repositories", response_model=RepositoryOut, status_code=201)
+def create_repository(payload: RepositoryCreate, services: ServicesDep) -> dict:
+    """Register a local directory or a remote git source.
+
+    Nothing is cloned here: a remote repository is fetched the first time it is
+    scanned, so registration never performs a surprise network operation.
+    """
+    return services.repositories.register(
+        source=payload.source, source_type=payload.source_type, name=payload.name
+    )
+
+
+@router.get("/api/repositories/{repository_id}", response_model=RepositoryOut)
+def get_repository(repository_id: int, services: ServicesDep) -> dict:
+    return services.repositories.require(repository_id)
+
+
+@router.post("/api/repositories/{repository_id}/refresh", response_model=RepositoryOut)
+def refresh_repository(repository_id: int, services: ServicesDep) -> dict:
+    return services.repositories.refresh(repository_id)
+
+
+@router.delete("/api/repositories/{repository_id}", response_model=GenericMessage)
+def delete_repository(repository_id: int, services: ServicesDep) -> dict:
+    services.repositories.require(repository_id)
+    services.repositories.delete(repository_id)
+    return {"detail": "Repository and its scan history were deleted."}
+
+
+@router.get("/api/repositories/{repository_id}/scans", response_model=ScanListOut)
+def repository_scans(
+    repository_id: int,
+    services: ServicesDep,
+    limit: int = Query(default=50, ge=1, le=200),
+    offset: int = Query(default=0, ge=0),
+) -> dict:
+    services.repositories.require(repository_id)
+    items, total = services.store.list_scans(
+        repository_id=repository_id, limit=limit, offset=offset
+    )
+    return {"items": items, "total": total, "limit": limit, "offset": offset}

dashboard/backend/api/scans.py

@@ -0,0 +1,168 @@
+"""Scan routes: create, list, inspect, cancel, diff, and stream live events."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi.responses import StreamingResponse
+
+from ..profiles import get_profile
+from ..schemas import ScanCreate, ScanEventOut, ScanListOut, ScanOut
+from ..security import ValidationError
+from ..services.intel import compare_scans
+from ..services.settings import scan_settings
+from .deps import Services, get_services
+
+router = APIRouter(tags=["scans"])
+
+ServicesDep = Annotated[Services, Depends(get_services)]
+
+_TERMINAL = {"completed", "failed", "cancelled"}
+_POLL_SECONDS = 0.5
+_MAX_STREAM_SECONDS = 60 * 60
+
+
+# NOTE: this must be declared before ``/api/scans/{scan_id}`` so that "compare"
+# is not parsed as a scan id.
+@router.get("/api/scans/compare")
+def diff_scans(
+    services: ServicesDep,
+    base: int = Query(description="Baseline scan id"),
+    head: int = Query(description="Scan id to compare against the baseline"),
+) -> dict:
+    if base == head:
+        raise ValidationError("Pick two different scans to compare.")
+    return compare_scans(services.store, base, head)
+
+
+@router.post("/api/scans", response_model=ScanOut, status_code=202)
+def create_scan(payload: ScanCreate, services: ServicesDep) -> dict:
+    """Queue a scan. It runs in the bounded background pool, not in this request."""
+    repository = services.repositories.require(payload.repository_id)
+    defaults = scan_settings(services.store, services.settings)
+
+    profile_key = (payload.profile or defaults["default_scan_profile"]).strip()
+    try:
+        get_profile(profile_key)
+    except KeyError as exc:
+        raise ValidationError(f"Unknown scan profile: {profile_key}") from exc
+
+    options = payload.options.model_dump(exclude_none=True)
+    try:
+        return services.scans.create(repository=repository, profile_key=profile_key, options=options)
+    except RuntimeError as exc:  # the queue is bounded on purpose
+        raise HTTPException(status_code=429, detail=str(exc)) from exc
+
+
+@router.get("/api/scans", response_model=ScanListOut)
+def list_scans(
+    services: ServicesDep,
+    repository_id: int | None = None,
+    status: str | None = Query(default=None, pattern="^(queued|running|completed|failed|cancelled)$"),
+    limit: int = Query(default=50, ge=1, le=200),
+    offset: int = Query(default=0, ge=0),
+) -> dict:
+    items, total = services.store.list_scans(
+        repository_id=repository_id, status=status, limit=limit, offset=offset
+    )
+    return {"items": items, "total": total, "limit": limit, "offset": offset}
+
+
+@router.get("/api/scans/{scan_id}", response_model=ScanOut)
+def get_scan(scan_id: int, services: ServicesDep) -> dict:
+    scan = services.store.get_scan(scan_id)
+    if scan is None:
+        raise KeyError(f"Scan {scan_id} was not found.")
+    return scan
+
+
+@router.post("/api/scans/{scan_id}/cancel", response_model=ScanOut)
+def cancel_scan(scan_id: int, services: ServicesDep) -> dict:
+    """Cancel a scan that has not started yet.
+
+    A scan already executing inside the sandbox is left to finish: interrupting
+    it mid-run would risk leaving the engine in an inconsistent state.
+    """
+    scan = services.scans.cancel(scan_id)
+    if scan is None:
+        raise KeyError(f"Scan {scan_id} was not found.")
+    return scan
+
+
+@router.get("/api/scans/{scan_id}/events.json", response_model=list[ScanEventOut])
+def scan_events_snapshot(
+    scan_id: int,
+    services: ServicesDep,
+    after: int = Query(default=0, ge=0),
+) -> list[dict]:
+    """Every persisted event for a scan (used for polling and by the tests)."""
+    if services.store.get_scan(scan_id) is None:
+        raise KeyError(f"Scan {scan_id} was not found.")
+    return services.store.list_events(scan_id, after_id=after)
+
+
+@router.get("/api/scans/{scan_id}/events")
+async def scan_events_stream(scan_id: int, request: Request, services: ServicesDep, after: int = 0):
+    """Server-Sent Events for a scan.
+
+    Only events the engine actually emitted are sent: the dashboard never
+    fabricates progress. The stream ends once the scan reaches a terminal state
+    and every event has been delivered.
+    """
+    if services.store.get_scan(scan_id) is None:
+        raise KeyError(f"Scan {scan_id} was not found.")
+
+    return StreamingResponse(
+        _event_stream(request, services, scan_id, after),
+        media_type="text/event-stream",
+        headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"},
+    )
+
+
+async def _event_stream(request: Request, services: Services, scan_id: int, after: int):
+    last_id = max(0, after)
+    elapsed = 0.0
+    yield _sse("open", {"scan_id": scan_id})
+    while True:
+        if await request.is_disconnected():
+            return
+
+        events = services.store.list_events(scan_id, after_id=last_id)
+        if events:
+            for event in events:
+                last_id = event["id"]
+                yield _sse("scan-event", {
+                    "id": event["id"],
+                    "scan_id": event["scan_id"],
+                    "ts": event["ts"],
+                    "stage": event["stage"],
+                    "status": event.get("status"),
+                    "message": event.get("message"),
+                    "data": event.get("data") or {},
+                })
+            continue
+
+        scan = services.store.get_scan(scan_id)
+        status = (scan or {}).get("status")
+        if status in _TERMINAL:
+            yield _sse("end", {"scan_id": scan_id, "status": status})
+            return
+        if status is None:
+            yield _sse("end", {"scan_id": scan_id, "status": "missing"})
+            return
+
+        elapsed += _POLL_SECONDS
+        if elapsed >= _MAX_STREAM_SECONDS:
+            yield _sse("end", {"scan_id": scan_id, "status": status, "reason": "stream-timeout"})
+            return
+
+        # Comment frame keeps proxies and browsers from closing the connection.
+        yield ": keep-alive\n\n"
+        await asyncio.sleep(_POLL_SECONDS)
+
+
+def _sse(event: str, payload: dict) -> str:
+    return f"event: {event}\ndata: {json.dumps(payload, ensure_ascii=False)}\n\n"

dashboard/backend/api/system.py

@@ -0,0 +1,69 @@
+"""System routes: health, scan profiles, and operator settings."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends
+
+from .. import __version__
+from ..profiles import list_profiles
+from ..schemas import (
+    AIConnectionTestOut,
+    AISettingsIn,
+    AISettingsOut,
+    HealthOut,
+    ScanSettingsIn,
+    ScanSettingsOut,
+)
+from ..services.settings import scan_settings, update_scan_settings
+from .deps import Services, get_services
+
+router = APIRouter(tags=["system"])
+
+ServicesDep = Annotated[Services, Depends(get_services)]
+
+
+@router.get("/api/health", response_model=HealthOut)
+def health(services: ServicesDep) -> dict:
+    """Liveness plus the facts the UI needs to render its header."""
+    return {
+        "status": "ok",
+        "version": __version__,
+        "database": services.settings.db_path.name,
+        "ai_configured": services.ai.config().enabled,
+        "repositories": services.store.count_repositories(),
+        "scans": services.store.count_scans(),
+    }
+
+
+@router.get("/api/profiles")
+def profiles() -> list[dict]:
+    """The available scan profiles and exactly what each one changes."""
+    return list_profiles()
+
+
+@router.get("/api/settings/scan", response_model=ScanSettingsOut)
+def read_scan_settings(services: ServicesDep) -> dict:
+    return scan_settings(services.store, services.settings)
+
+
+@router.put("/api/settings/scan", response_model=ScanSettingsOut)
+def write_scan_settings(payload: ScanSettingsIn, services: ServicesDep) -> dict:
+    return update_scan_settings(services.store, payload)
+
+
+@router.get("/api/settings/ai", response_model=AISettingsOut)
+def read_ai_settings(services: ServicesDep) -> dict:
+    """The AI configuration. The API key itself is never returned."""
+    return services.ai.settings_view()
+
+
+@router.put("/api/settings/ai", response_model=AISettingsOut)
+def write_ai_settings(payload: AISettingsIn, services: ServicesDep) -> dict:
+    return services.ai.update_settings(payload)
+
+
+@router.post("/api/settings/ai/test", response_model=AIConnectionTestOut)
+def test_ai_connection(services: ServicesDep) -> dict:
+    return services.ai.test_connection()