vibe-coding-qa 0.5.0__py3-none-any.whl

dashboard/backend/services/paths.py

@@ -0,0 +1,38 @@
+"""Shared helpers for locating a repository's working tree on disk."""
+
+import re
+from pathlib import Path
+
+from ..config import DASHBOARD_DIR
+
+_SLUG = re.compile(r"[^A-Za-z0-9_.-]+")
+
+
+def slug(source: str) -> str:
+    cleaned = source.rstrip("/")
+    if cleaned.endswith(".git"):
+        cleaned = cleaned[:-4]
+    cleaned = cleaned.split("://", 1)[-1]
+    if cleaned.startswith("git@"):
+        cleaned = cleaned.split(":", 1)[-1]
+    return _SLUG.sub("__", cleaned).strip("_")[:120] or "repository"
+
+
+def cached_clone_path(source: str) -> Path:
+    """Deterministic cache location for a remote repository clone."""
+    return DASHBOARD_DIR / "data" / "repos" / slug(source)
+
+
+def repository_dir(repository: dict) -> Path | None:
+    """Return the on-disk working tree for a repository, if one is available.
+
+    Local repositories map to their own path; remote repositories map to the
+    cached clone created on first scan. Returns ``None`` when nothing is on disk
+    (a remote repository that has never been scanned).
+    """
+    source = repository.get("source") or ""
+    if repository.get("source_type") == "local":
+        path = Path(source)
+        return path if path.is_dir() else None
+    path = cached_clone_path(source)
+    return path if path.is_dir() else None

dashboard/backend/services/repositories.py

@@ -0,0 +1,123 @@
+"""Repository registration and metadata refresh.
+
+A repository is either a validated local directory or a validated git source.
+Nothing is cloned at registration time: a remote repository is fetched with the
+existing engine loader when it is first scanned, so registration stays cheap and
+never performs a surprise network operation.
+"""
+
+from pathlib import Path
+
+from vibe_coding_qa.profile import analyze_repo
+
+from ..config import Settings
+from ..persistence.store import Store
+from ..security import ValidationError, resolve_repo_path, validate_git_source
+
+
+def _derive_name(source: str, source_type: str) -> str:
+    if source_type == "local":
+        return Path(source).name or source
+    cleaned = source.rstrip("/")
+    if cleaned.endswith(".git"):
+        cleaned = cleaned[:-4]
+    if "://" in cleaned:
+        cleaned = cleaned.split("://", 1)[1]
+    if cleaned.startswith("git@"):
+        cleaned = cleaned.split(":", 1)[-1]
+    parts = [p for p in cleaned.split("/") if p]
+    return "/".join(parts[-2:]) if len(parts) >= 2 else (parts[-1] if parts else source)
+
+
+class RepositoryService:
+    def __init__(self, store: Store, settings: Settings):
+        self.store = store
+        self.settings = settings
+
+    # ------------------------------------------------------------------ reads
+    def list(self) -> list[dict]:
+        return self.store.list_repositories()
+
+    def get(self, repository_id: int) -> dict | None:
+        return self.store.get_repository(repository_id)
+
+    def require(self, repository_id: int) -> dict:
+        repo = self.store.get_repository(repository_id)
+        if repo is None:
+            raise KeyError(f"Repository {repository_id} was not found.")
+        return repo
+
+    # ------------------------------------------------------------------ writes
+    def register(self, *, source: str, source_type: str, name: str | None = None) -> dict:
+        source_type = (source_type or "local").lower()
+        if source_type == "local":
+            resolved = resolve_repo_path(source, self.settings.allowed_repo_roots)
+            normalized = str(resolved)
+            metadata = self._detect(resolved)
+        elif source_type == "github":
+            normalized = validate_git_source(source)
+            metadata = {}
+        else:
+            raise ValidationError(f"Unsupported repository source type: {source_type}")
+
+        existing = self.store.get_repository_by_source(normalized)
+        if existing:
+            raise ValidationError(f"Repository is already registered: {normalized}")
+
+        return self.store.create_repository(
+            name=(name or "").strip() or _derive_name(normalized, source_type),
+            source=normalized,
+            source_type=source_type,
+            **metadata,
+        )
+
+    def refresh(self, repository_id: int) -> dict:
+        repo = self.require(repository_id)
+        if repo["source_type"] != "local":
+            raise ValidationError(
+                "Metadata for remote repositories is captured when they are scanned."
+            )
+        resolved = resolve_repo_path(repo["source"], self.settings.allowed_repo_roots)
+        metadata = self._detect(resolved)
+        return self.store.update_repository(repository_id, **metadata) or repo
+
+    def delete(self, repository_id: int) -> bool:
+        return self.store.delete_repository(repository_id)
+
+    # ------------------------------------------------------------- internals
+    def _detect(self, path: Path) -> dict:
+        """Detect the technology profile of a *local* repository."""
+        try:
+            profile = analyze_repo(path)
+        except Exception:
+            return {}
+        languages = {k: v for k, v in profile.languages.items() if v}
+        main_language = max(languages, key=languages.get) if languages else None
+        return {
+            "main_language": main_language,
+            "frameworks": profile.frameworks,
+            "package_manager": profile.package_manager,
+            "database_tech": profile.databases,
+            "auth_tech": profile.auth_providers,
+            "deployment": profile.deployment,
+        }
+
+    def metadata_from_scan(self, repository_id: int, architecture: dict, share_source_context: bool) -> None:
+        """Persist the richer metadata captured during a real scan.
+
+        Repository paths are only stored/echoed when the operator opted in to
+        sharing source context; otherwise the path stays on the server.
+        """
+        if not architecture:
+            return
+        languages = {k: v for k, v in (architecture.get("languages") or {}).items() if v}
+        main_language = max(languages, key=languages.get) if languages else None
+        self.store.update_repository(
+            repository_id,
+            main_language=main_language,
+            frameworks=list(architecture.get("frameworks") or []),
+            package_manager=architecture.get("package_manager"),
+            database_tech=list(architecture.get("databases") or []),
+            auth_tech=list(architecture.get("auth_providers") or []),
+            deployment=list(architecture.get("deployment") or []),
+        )

dashboard/backend/services/scans.py

@@ -0,0 +1,328 @@
+"""Bounded background scan runner.
+
+Scans are long-running and must not block the request thread, so they run in a
+bounded thread pool. Behaviour that the spec requires explicitly:
+
+* **Bounded concurrency** — a fixed pool of ``max_concurrent_scans`` workers;
+  extra scans queue instead of fanning out, and the queue itself is capped.
+* **Persistent job state** — every transition is written to SQLite, so a scan
+  interrupted by a restart is identifiable (see ``mark_interrupted_scans``).
+* **Real events, never simulated progress** — the engine reports each stage
+  through a callback that is persisted as a ``scan_events`` row and streamed
+  over SSE. The dashboard never invents percentages.
+* **No test execution without permission** — tests run only when the request
+  opts in *and* the operator enabled ``VCQA_ALLOW_TEST_EXECUTION``.
+* **The AI stage never gates a release** — AI review is recorded but the release
+  gate is computed by the engine alone.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import threading
+import time
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+
+from vibe_coding_qa.engine import run_pipeline
+from vibe_coding_qa.gates import coverage_gaps
+from vibe_coding_qa.scanners.dependencies import reset_osv_enabled, set_osv_enabled
+
+from .. import __version__
+from ..config import Settings
+from ..persistence.store import Store
+from ..profiles import get_profile
+from ..security import safe_error
+from .paths import cached_clone_path
+from .repositories import RepositoryService
+
+_TERMINAL = ("completed", "failed", "cancelled")
+
+
+def _git_head(path: Path) -> str | None:
+    try:
+        result = subprocess.run(
+            ["git", "-C", str(path), "rev-parse", "HEAD"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if result.returncode != 0:
+        return None
+    sha = result.stdout.strip()
+    return sha or None
+
+
+class ScanRunner:
+    def __init__(self, store: Store, settings: Settings, repositories: RepositoryService):
+        self.store = store
+        self.settings = settings
+        self.repositories = repositories
+        self._pool = ThreadPoolExecutor(
+            max_workers=max(1, settings.max_concurrent_scans), thread_name_prefix="vcqa-scan"
+        )
+        self._lock = threading.Lock()
+        self._submitted: set[int] = set()
+
+    # -------------------------------------------------------------- lifecycle
+    @property
+    def max_queue(self) -> int:
+        return max(1, self.settings.max_concurrent_scans) * 4
+
+    def active_scan_ids(self) -> set[int]:
+        with self._lock:
+            return set(self._submitted)
+
+    def pending_count(self) -> int:
+        _, total = self.store.list_scans(status="queued", limit=1)
+        _, running = self.store.list_scans(status="running", limit=1)
+        return total + running
+
+    def scan_settings(self) -> dict:
+        """Effective scan defaults (persisted operator settings, else env)."""
+        from .settings import scan_settings
+
+        return scan_settings(self.store, self.settings)
+
+    def allow_test_execution(self) -> bool:
+        """Tests never run unless the operator enabled the capability.
+
+        Either the environment flag or the persisted setting enables it; both are
+        deliberate operator actions.
+        """
+        return bool(self.scan_settings()["allow_test_execution"])
+
+    def shutdown(self) -> None:
+        self._pool.shutdown(wait=False, cancel_futures=True)
+
+    def recover_interrupted(self) -> list[int]:
+        """Mark scans a previous process left queued/running as failed."""
+        return self.store.mark_interrupted_scans()
+
+    # ----------------------------------------------------------------- create
+    def create(self, *, repository: dict, profile_key: str, options: dict) -> dict:
+        profile = get_profile(profile_key)
+        if self.pending_count() >= self.max_queue:
+            raise RuntimeError(
+                "The scan queue is full. Wait for running scans to finish before starting more."
+            )
+        stored_options = dict(options)
+        stored_options["profile"] = profile.key
+        scan = self.store.create_scan(
+            repository_id=repository["id"], profile=profile.key, options=stored_options
+        )
+        self.store.add_event(scan["id"], "queued", status="queued", message="Scan queued")
+        self._submit(scan["id"])
+        return scan
+
+    def cancel(self, scan_id: int) -> dict | None:
+        scan = self.store.get_scan(scan_id)
+        if scan is None:
+            return None
+        if scan["status"] == "queued":
+            updated = self.store.update_scan(
+                scan_id,
+                status="cancelled",
+                completed_at=scan["created_at"],
+                error="Cancelled before it started.",
+            )
+            self.store.add_event(scan_id, "cancelled", status="cancelled", message="Scan cancelled")
+            return updated
+        return scan
+
+    def _submit(self, scan_id: int) -> None:
+        with self._lock:
+            if scan_id in self._submitted:
+                return
+            self._submitted.add(scan_id)
+        try:
+            self._pool.submit(self._run, scan_id)
+        except RuntimeError:
+            with self._lock:
+                self._submitted.discard(scan_id)
+            self._fail(scan_id, "The scan runner is shutting down.")
+
+    # ---------------------------------------------------------------- execute
+    def _run(self, scan_id: int) -> None:
+        started = time.time()
+        try:
+            scan = self.store.get_scan(scan_id)
+            if scan is None or scan["status"] not in ("queued", "running"):
+                return
+            repository = self.store.get_repository(scan["repository_id"])
+            if repository is None:
+                self._fail(scan_id, "The repository no longer exists.")
+                return
+
+            profile = get_profile(scan.get("profile"))
+            options = scan.get("options") or {}
+            defaults = self.scan_settings()
+
+            self.store.update_scan(scan_id, status="running", started_at=_now())
+            self.store.add_event(scan_id, "started", status="running", message="Scan started")
+
+            source_path = self._prepare_source(repository, scan_id)
+            if source_path is None:
+                return
+
+            def progress(stage: str, status: str, message: str = "", data: dict | None = None) -> None:
+                self.store.add_event(scan_id, stage, status=status, message=message, data=data or {})
+
+            static_only = bool(options.get("static_only"))
+            run_tests_flag = bool(profile.run_tests) and not static_only
+            explicit_permission = bool(options.get("explicit_permission")) and self.allow_test_execution()
+
+            # ``None`` means "use the profile / operator default"; an explicit
+            # value always wins.
+            osv_option = options.get("osv")
+            osv_enabled = bool(profile.osv) and (
+                bool(defaults["osv_enabled"]) if osv_option is None else bool(osv_option)
+            )
+            ai_option = options.get("ai_review")
+            ai_requested = bool(profile.ai_review) if ai_option is None else bool(ai_option)
+
+            token = set_osv_enabled(osv_enabled)
+            if osv_enabled:
+                self.store.add_event(scan_id, "dependencies", status="running", message="OSV advisory lookups enabled")
+            else:
+                self.store.add_event(scan_id, "dependencies", status="skipped", message="OSV advisory lookups disabled")
+            try:
+                result = run_pipeline(
+                    str(source_path),
+                    run_tests_flag=run_tests_flag,
+                    no_execution=static_only or not run_tests_flag,
+                    explicit_permission=explicit_permission,
+                    apply_fixes=False,
+                    dry_run_fixes=False,
+                    github_token=self.settings.github_token or None,
+                    test_command=options.get("test_command") or None,
+                    test_timeout=int(options.get("test_timeout") or defaults["test_timeout"]),
+                    max_memory_mb=int(options.get("max_memory_mb") or defaults["max_memory_mb"]),
+                    max_cpu_seconds=int(options.get("max_cpu_seconds") or defaults["max_cpu_seconds"]),
+                    test_image=options.get("test_image") or defaults["test_image"],
+                    max_snapshot_mb=int(options.get("max_snapshot_mb") or defaults["max_snapshot_mb"]),
+                    max_write_mb=int(options.get("max_write_mb") or defaults["max_write_mb"]),
+                    keep_clone=True,
+                    progress=progress,
+                    modules=list(profile.modules),
+                    minimum_score=profile.minimum_score,
+                    ai_review_enabled=ai_requested,
+                )
+            finally:
+                reset_osv_enabled(token)
+
+            if not run_tests_flag:
+                reason = "static-only profile" if not profile.run_tests else "static-only requested"
+                self.store.add_event(scan_id, "tests", status="skipped", message=f"Test execution skipped ({reason})")
+            elif not explicit_permission:
+                self.store.add_event(
+                    scan_id, "tests", status="skipped",
+                    message="Test execution skipped: explicit permission was not granted.",
+                )
+
+            self._persist_result(scan_id, repository, result, profile, ai_requested)
+
+            duration_ms = int((time.time() - started) * 1000)
+            self.store.update_scan(scan_id, duration_ms=duration_ms)
+            self.store.add_event(
+                scan_id, "completed", status="completed",
+                message=f"Scan complete: {result.gate}",
+                data={"gate": result.gate, "score": result.overall_score},
+            )
+        except Exception as exc:  # noqa: BLE001 - never let a worker die silently
+            self._fail(scan_id, safe_error(exc, "The scan failed while running."))
+        finally:
+            with self._lock:
+                self._submitted.discard(scan_id)
+
+    # -------------------------------------------------------------- internals
+    def _prepare_source(self, repository: dict, scan_id: int) -> Path | None:
+        """Return a local directory to analyse, cloning remote repos on first use."""
+        if repository["source_type"] == "local":
+            path = Path(repository["source"])
+            if not path.is_dir():
+                self._fail(scan_id, "The local repository path is no longer available.")
+                return None
+            return path
+
+        cache_dir = cached_clone_path(repository["source"])
+        if cache_dir.is_dir() and (cache_dir / ".git").exists():
+            self.store.add_event(scan_id, "preparation", status="running", message="Reusing the cached clone")
+            return cache_dir
+        self.store.add_event(scan_id, "preparation", status="running", message="Cloning the remote repository")
+        try:
+            from vibe_coding_qa.repo import clone_repo
+
+            clone_repo(repository["source"], token=self.settings.github_token or None, workdir=cache_dir)
+        except Exception as exc:  # noqa: BLE001
+            self._fail(scan_id, safe_error(exc, "The remote repository could not be cloned."))
+            return None
+        return cache_dir
+
+    def _persist_result(self, scan_id: int, repository: dict, result, profile, ai_requested: bool) -> None:
+        tests = result.tests or {}
+        findings = [f.to_dict() for f in result.findings]
+        inserted = self.store.insert_findings(scan_id, repository["id"], findings)
+
+        test_status = tests.get("status")
+        test_status_value = getattr(test_status, "value", test_status)
+
+        architecture = tests.get("architecture") or {}
+        self.repositories.metadata_from_scan(repository["id"], architecture, True)
+        # Persist the full profile so the Architecture/Dependencies pages render
+        # instantly instead of re-walking the whole working tree on every request.
+        if architecture:
+            try:
+                self.store.set_setting(f"profile:{repository['id']}", architecture)
+            except Exception:  # noqa: BLE001
+                pass
+
+        # The release gate is decided by the engine alone. AI review is recorded
+        # as advisory status and never influences the gate.
+        if tests.get("ai_reviews"):
+            ai_status = "completed"
+        elif ai_requested:
+            ai_status = "unavailable"
+        else:
+            ai_status = "not_requested"
+
+        commit = _git_head(result.repo)
+        self.store.update_scan(
+            scan_id,
+            status="completed",
+            completed_at=_now(),
+            commit_sha=commit,
+            overall_score=result.overall_score,
+            gate=result.gate,
+            critical_count=result.critical_count,
+            high_count=result.high_count,
+            total_findings=inserted,
+            test_status=test_status_value,
+            tests_executed=tests.get("tests_executed"),
+            tests_passed=tests.get("tests_passed"),
+            tests_failed=tests.get("tests_failed"),
+            tests_skipped=tests.get("tests_skipped"),
+            scanner_versions={
+                "dashboard_version": __version__,
+                "profile": profile.key,
+                "modules": [module.module for module in result.modules],
+            },
+            coverage_gaps=coverage_gaps(result),
+            ai_review_status=ai_status,
+        )
+        self.store.update_repository(
+            repository["id"], last_scan_id=scan_id, last_commit_sha=commit
+        )
+
+    def _fail(self, scan_id: int, message: str) -> None:
+        self.store.update_scan(scan_id, status="failed", completed_at=_now(), error=message)
+        self.store.add_event(scan_id, "failed", status="failed", message=message)
+
+
+def _now() -> str:
+    from ..persistence.database import utcnow
+
+    return utcnow()

dashboard/backend/services/settings.py

@@ -0,0 +1,49 @@
+"""Operator scan defaults.
+
+These values are persisted in SQLite so the New Scan screen and the scan runner
+share a single source of truth. Environment variables remain the fallback, so a
+fresh install behaves exactly like the CLI until the operator changes something.
+"""
+
+from __future__ import annotations
+
+from ..config import Settings
+from ..persistence.store import Store
+from ..profiles import PROFILES
+from ..security import ValidationError
+
+FIELDS = (
+    "default_scan_profile",
+    "allow_test_execution",
+    "test_image",
+    "test_timeout",
+    "max_memory_mb",
+    "max_cpu_seconds",
+    "max_snapshot_mb",
+    "max_write_mb",
+    "osv_enabled",
+)
+
+
+def scan_settings(store: Store, settings: Settings) -> dict:
+    """The effective scan defaults: persisted values, else environment values."""
+    stored = store.all_settings().get("scan") or {}
+    return {
+        "default_scan_profile": str(stored.get("default_scan_profile") or settings.default_scan_profile),
+        "allow_test_execution": bool(stored.get("allow_test_execution", settings.allow_test_execution)),
+        "test_image": str(stored.get("test_image") or settings.default_test_image),
+        "test_timeout": int(stored.get("test_timeout") or settings.default_test_timeout),
+        "max_memory_mb": int(stored.get("max_memory_mb") or settings.default_max_memory_mb),
+        "max_cpu_seconds": int(stored.get("max_cpu_seconds") or settings.default_max_cpu_seconds),
+        "max_snapshot_mb": int(stored.get("max_snapshot_mb") or settings.default_max_snapshot_mb),
+        "max_write_mb": int(stored.get("max_write_mb") or settings.default_max_write_mb),
+        "osv_enabled": bool(stored.get("osv_enabled", settings.default_osv_enabled)),
+    }
+
+
+def update_scan_settings(store: Store, payload) -> dict:
+    if payload.default_scan_profile not in PROFILES:
+        raise ValidationError(f"Unknown scan profile: {payload.default_scan_profile}")
+    values = {field: getattr(payload, field) for field in FIELDS}
+    store.set_setting("scan", values)
+    return values