feat: pre-deploy scan visibility and pinned scanner version (#1378)

* feat: pre-deploy scan visibility and pinned scanner version

Pin managed Trivy installs and add an opt-in pre-deploy scan advisory so a
manual deploy can surface each image's latest scan before it runs.

- Managed Trivy now installs a pinned, known-good version by default for
  reproducible installs. Auto-update still tracks the latest release, and an
  explicit update always pulls the latest.
- Add an opt-in pre-deploy scan advisory: when enabled, deploying a stack from
  the editor first shows each image's latest cached scan severity for review.
  It is visibility only and never blocks; deploy enforcement is unchanged.
- Backend: pre_deploy_scan_advisory setting, PUT
  /security/pre-deploy-scan-advisory, a cache-only GET
  /security/stacks/:name/pre-deploy-summary, and a node-scoped
  getLatestVulnScanByDigestForNode lookup.
- Frontend: advisory toggle on the Security page scanner setup, and a
  PreDeployScanDialog wired into the editor deploy flow that fails open when the
  summary is unavailable.
- Docs: scanner configuration, version pinning, and the advisory.

* fix: harden pre-deploy advisory guard, toggle visibility, and installer busy state

Addresses review findings on the pre-deploy advisory.

- Block a second editor deploy during the async advisory window with a
  synchronous pending ref, cleared on cancel and in the deploy's finally, so a
  double-click can no longer start two deploys.
- Keep the pre-deploy advisory toggle visible to admins whenever the setting is
  on, so it can still be turned off after the scanner becomes unavailable.
- Resolve the managed Trivy version inside the install lock so the busy state and
  serialization cover the latest-version fetch and the managed-install check.

backend/src/__tests__/database-latest-vuln-scan-by-digest.test.ts

@@ -0,0 +1,89 @@
+/**
+ * getLatestVulnScanByDigestForNode: the node-scoped, vulnerability-bearing
+ * latest-scan lookup that powers the pre-deploy advisory. It must (a) only ever
+ * return a scan for the requested node, and (b) only consider scanner sets that
+ * actually ran the vulnerability scanner, so a secret-only or config scan is
+ * never mistaken for a clean vuln scan.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { setupTestDb, cleanupTestDb } from './helpers/setupTestDb';
+import type { DatabaseService as DatabaseServiceType, VulnerabilityScan } from '../services/DatabaseService';
+
+let tmpDir: string;
+let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
+
+function insertScan(
+  db: DatabaseServiceType,
+  over: Partial<Omit<VulnerabilityScan, 'id'>>,
+): number {
+  return db.createVulnerabilityScan({
+    node_id: 1,
+    image_ref: 'img',
+    image_digest: 'sha256:default',
+    scanned_at: 1000,
+    total_vulnerabilities: 0,
+    critical_count: 0,
+    high_count: 0,
+    medium_count: 0,
+    low_count: 0,
+    unknown_count: 0,
+    fixable_count: 0,
+    secret_count: 0,
+    misconfig_count: 0,
+    scanners_used: 'vuln',
+    highest_severity: null,
+    os_info: null,
+    trivy_version: null,
+    scan_duration_ms: null,
+    triggered_by: 'manual',
+    status: 'completed',
+    error: null,
+    stack_context: null,
+    ...over,
+  });
+}
+
+beforeAll(async () => {
+  tmpDir = await setupTestDb();
+  ({ DatabaseService } = await import('../services/DatabaseService'));
+});
+
+afterAll(() => cleanupTestDb(tmpDir));
+
+describe('getLatestVulnScanByDigestForNode', () => {
+  it('includes vuln and vuln,secret rows but excludes secret-only and config scans', () => {
+    const db = DatabaseService.getInstance();
+    const digest = 'sha256:setfilter';
+    // Newer rows that did NOT run the vuln scanner must be ignored even though
+    // they are more recent than the vuln-bearing rows.
+    insertScan(db, { image_digest: digest, scanners_used: 'secret', scanned_at: 5000, critical_count: 99 });
+    insertScan(db, { image_digest: digest, scanners_used: 'config', scanned_at: 4000, critical_count: 88 });
+    insertScan(db, { image_digest: digest, scanners_used: 'vuln', scanned_at: 1000, critical_count: 1 });
+    insertScan(db, { image_digest: digest, scanners_used: 'vuln,secret', scanned_at: 2000, critical_count: 2 });
+
+    const found = db.getLatestVulnScanByDigestForNode(digest, 1);
+    expect(found).not.toBeNull();
+    expect(found?.scanners_used).toBe('vuln,secret');
+    expect(found?.critical_count).toBe(2);
+  });
+
+  it('is node-scoped: a scan from another node is not returned', () => {
+    const db = DatabaseService.getInstance();
+    const digest = 'sha256:nodescope';
+    insertScan(db, { node_id: 2, image_digest: digest, scanners_used: 'vuln', scanned_at: 9000, critical_count: 7 });
+
+    expect(db.getLatestVulnScanByDigestForNode(digest, 1)).toBeNull();
+    expect(db.getLatestVulnScanByDigestForNode(digest, 2)?.critical_count).toBe(7);
+  });
+
+  it('ignores non-completed scans', () => {
+    const db = DatabaseService.getInstance();
+    const digest = 'sha256:status';
+    insertScan(db, { image_digest: digest, scanners_used: 'vuln', status: 'in_progress', scanned_at: 8000 });
+    expect(db.getLatestVulnScanByDigestForNode(digest, 1)).toBeNull();
+  });
+
+  it('returns null for an empty digest', () => {
+    expect(DatabaseService.getInstance().getLatestVulnScanByDigestForNode('', 1)).toBeNull();
+  });
+});

backend/src/__tests__/security-pre-deploy-scan-advisory-route.test.ts

@@ -0,0 +1,96 @@
+/**
+ * PUT /api/security/pre-deploy-scan-advisory.
+ *
+ * Flips the per-instance `pre_deploy_scan_advisory` setting that drives the
+ * manual-deploy scan advisory. Visibility only, so it is admin-gated but carries
+ * no tier gate: reachable by any admin on Community as well as Admiral. The
+ * value is reflected back on GET /trivy-status.
+ */
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import request from 'supertest';
+import bcrypt from 'bcrypt';
+import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTestDb';
+
+let tmpDir: string;
+let app: import('express').Express;
+let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
+let adminCookie: string;
+let viewerCookie: string;
+
+beforeAll(async () => {
+  tmpDir = await setupTestDb();
+  ({ DatabaseService } = await import('../services/DatabaseService'));
+
+  const { LicenseService } = await import('../services/LicenseService');
+  vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
+
+  ({ app } = await import('../index'));
+  adminCookie = await loginAsTestAdmin(app);
+
+  const viewerHash = await bcrypt.hash('viewerpass4', 1);
+  DatabaseService.getInstance().addUser({ username: 'advisory-viewer', password_hash: viewerHash, role: 'viewer' });
+  const viewerRes = await request(app).post('/api/auth/login').send({ username: 'advisory-viewer', password: 'viewerpass4' });
+  const cookies = viewerRes.headers['set-cookie'] as string | string[];
+  viewerCookie = Array.isArray(cookies) ? cookies[0] : cookies;
+});
+
+afterAll(() => cleanupTestDb(tmpDir));
+
+describe('PUT /api/security/pre-deploy-scan-advisory', () => {
+  it('rejects unauthenticated requests with 401', async () => {
+    const res = await request(app).put('/api/security/pre-deploy-scan-advisory').send({ enabled: true });
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects an authenticated viewer with 403', async () => {
+    const res = await request(app)
+      .put('/api/security/pre-deploy-scan-advisory')
+      .set('Cookie', viewerCookie)
+      .send({ enabled: true });
+    expect(res.status).toBe(403);
+  });
+
+  it('rejects a non-boolean enabled with 400', async () => {
+    const res = await request(app)
+      .put('/api/security/pre-deploy-scan-advisory')
+      .set('Cookie', adminCookie)
+      .send({ enabled: 'yes' });
+    expect(res.status).toBe(400);
+  });
+
+  it('accepts a Community admin (no tier gate) and persists the setting', async () => {
+    const { LicenseService } = await import('../services/LicenseService');
+    const spy = vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('community');
+    try {
+      const res = await request(app)
+        .put('/api/security/pre-deploy-scan-advisory')
+        .set('Cookie', adminCookie)
+        .send({ enabled: true });
+      expect(res.status).toBe(200);
+      expect(res.body.preDeployScanAdvisory).toBe(true);
+      expect(DatabaseService.getInstance().getGlobalSettings().pre_deploy_scan_advisory).toBe('1');
+    } finally {
+      spy.mockReturnValue('paid');
+    }
+  });
+
+  it('reflects the persisted value on GET /trivy-status', async () => {
+    await request(app)
+      .put('/api/security/pre-deploy-scan-advisory')
+      .set('Cookie', adminCookie)
+      .send({ enabled: true });
+    const res = await request(app).get('/api/security/trivy-status').set('Cookie', adminCookie);
+    expect(res.status).toBe(200);
+    expect(res.body.preDeployScanAdvisory).toBe(true);
+  });
+
+  it('disables the setting', async () => {
+    const res = await request(app)
+      .put('/api/security/pre-deploy-scan-advisory')
+      .set('Cookie', adminCookie)
+      .send({ enabled: false });
+    expect(res.status).toBe(200);
+    expect(res.body.preDeployScanAdvisory).toBe(false);
+    expect(DatabaseService.getInstance().getGlobalSettings().pre_deploy_scan_advisory).toBe('0');
+  });
+});

backend/src/__tests__/security-pre-deploy-summary-route.test.ts

@@ -0,0 +1,137 @@
+/**
+ * GET /api/security/stacks/:stackName/pre-deploy-summary.
+ *
+ * Read-only advisory data for the pre-deploy dialog. It must:
+ *  - short-circuit (no compose/digest/scan work) when the advisory is off,
+ *  - resolve each image ref to a digest before the node-scoped scan lookup,
+ *  - never trigger a scan (cache-only),
+ *  - reject an invalid stack name, and require auth.
+ */
+import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from 'vitest';
+import request from 'supertest';
+import bcrypt from 'bcrypt';
+import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTestDb';
+import type { VulnerabilityScan } from '../services/DatabaseService';
+
+let tmpDir: string;
+let app: import('express').Express;
+let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
+let ComposeService: typeof import('../services/ComposeService').ComposeService;
+let TrivyService: typeof import('../services/TrivyService').default;
+let adminCookie: string;
+let viewerCookie: string;
+
+function makeScan(over: Partial<VulnerabilityScan>): VulnerabilityScan {
+  return {
+    id: 1, node_id: 1, image_ref: 'img', image_digest: 'sha256:a', scanned_at: 1000,
+    total_vulnerabilities: 5, critical_count: 3, high_count: 2, medium_count: 1, low_count: 4,
+    unknown_count: 0, fixable_count: 0, secret_count: 0, misconfig_count: 0,
+    scanners_used: 'vuln', highest_severity: 'CRITICAL', os_info: null, trivy_version: null,
+    scan_duration_ms: null, triggered_by: 'manual', status: 'completed', error: null,
+    stack_context: null, policy_evaluation: null, ...over,
+  };
+}
+
+function setAdvisory(enabled: boolean): void {
+  DatabaseService.getInstance().updateGlobalSetting('pre_deploy_scan_advisory', enabled ? '1' : '0');
+}
+
+beforeAll(async () => {
+  tmpDir = await setupTestDb();
+  ({ DatabaseService } = await import('../services/DatabaseService'));
+  ({ ComposeService } = await import('../services/ComposeService'));
+  TrivyService = (await import('../services/TrivyService')).default;
+  ({ app } = await import('../index'));
+  adminCookie = await loginAsTestAdmin(app);
+
+  const viewerHash = await bcrypt.hash('viewerpass5', 1);
+  DatabaseService.getInstance().addUser({ username: 'summary-viewer', password_hash: viewerHash, role: 'viewer' });
+  const viewerRes = await request(app).post('/api/auth/login').send({ username: 'summary-viewer', password: 'viewerpass5' });
+  const cookies = viewerRes.headers['set-cookie'] as string | string[];
+  viewerCookie = Array.isArray(cookies) ? cookies[0] : cookies;
+});
+
+afterAll(() => {
+  setAdvisory(false);
+  cleanupTestDb(tmpDir);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  setAdvisory(false);
+});
+
+describe('GET /api/security/stacks/:stackName/pre-deploy-summary', () => {
+  it('rejects unauthenticated requests with 401', async () => {
+    const res = await request(app).get('/api/security/stacks/web/pre-deploy-summary');
+    expect(res.status).toBe(401);
+  });
+
+  it('short-circuits to { enabled: false } without any compose/digest work when off', async () => {
+    setAdvisory(false);
+    const listImages = vi.spyOn(ComposeService.prototype, 'listStackImages');
+    const getDigest = vi.spyOn(TrivyService.getInstance(), 'getImageDigest');
+
+    const res = await request(app).get('/api/security/stacks/web/pre-deploy-summary').set('Cookie', adminCookie);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ enabled: false });
+    expect(listImages).not.toHaveBeenCalled();
+    expect(getDigest).not.toHaveBeenCalled();
+  });
+
+  it('returns per-image cached scan counts, resolving refs to digests (cache-only)', async () => {
+    setAdvisory(true);
+    vi.spyOn(ComposeService.prototype, 'listStackImages').mockResolvedValue(['nginx:1.14', 'redis:7']);
+    vi.spyOn(TrivyService.getInstance(), 'getImageDigest').mockImplementation(
+      async (ref: string) => (ref === 'nginx:1.14' ? 'sha256:nginx' : null),
+    );
+    const lookup = vi
+      .spyOn(DatabaseService.getInstance(), 'getLatestVulnScanByDigestForNode')
+      .mockImplementation((digest: string) => (digest === 'sha256:nginx' ? makeScan({ critical_count: 31, high_count: 82, highest_severity: 'CRITICAL', scanned_at: 4242 }) : null));
+    // Cache-only: the advisory must never kick off a scan.
+    const runScan = vi.spyOn(TrivyService.getInstance(), 'scanImagePreflight');
+
+    const res = await request(app).get('/api/security/stacks/web/pre-deploy-summary').set('Cookie', adminCookie);
+
+    expect(res.status).toBe(200);
+    expect(res.body.enabled).toBe(true);
+    expect(res.body.images).toEqual([
+      {
+        imageRef: 'nginx:1.14',
+        scan: { criticalCount: 31, highCount: 82, mediumCount: 1, lowCount: 4, highestSeverity: 'CRITICAL', scannedAt: 4242 },
+      },
+      { imageRef: 'redis:7', scan: null },
+    ]);
+    expect(lookup).toHaveBeenCalled();
+    expect(runScan).not.toHaveBeenCalled();
+  });
+
+  it('rejects an invalid stack name with 400 when enabled', async () => {
+    setAdvisory(true);
+    const res = await request(app).get('/api/security/stacks/bad%20name/pre-deploy-summary').set('Cookie', adminCookie);
+    expect(res.status).toBe(400);
+  });
+
+  it('is readable by a non-admin (advisory visibility is not admin-gated)', async () => {
+    setAdvisory(true);
+    vi.spyOn(ComposeService.prototype, 'listStackImages').mockResolvedValue(['nginx:1.14']);
+    vi.spyOn(TrivyService.getInstance(), 'getImageDigest').mockResolvedValue(null);
+
+    const res = await request(app).get('/api/security/stacks/web/pre-deploy-summary').set('Cookie', viewerCookie);
+
+    expect(res.status).toBe(200);
+    expect(res.body.enabled).toBe(true);
+  });
+
+  it('returns a generic 500 (no internal detail) when image enumeration fails', async () => {
+    setAdvisory(true);
+    vi.spyOn(ComposeService.prototype, 'listStackImages').mockRejectedValue(new Error('/secret/path: compose parse boom'));
+
+    const res = await request(app).get('/api/security/stacks/web/pre-deploy-summary').set('Cookie', adminCookie);
+
+    expect(res.status).toBe(500);
+    expect(res.body.error).toBe('Failed to build pre-deploy summary');
+    expect(JSON.stringify(res.body)).not.toContain('/secret/path');
+  });
+});

backend/src/__tests__/settings-routes.test.ts

@@ -69,6 +69,7 @@ describe('GET /api/settings', () => {
         db.updateGlobalSetting(k, '');
       }
       db.updateGlobalSetting('trivy_auto_update', '0');
+      db.updateGlobalSetting('pre_deploy_scan_advisory', '0');
       db.updateGlobalSetting('mesh_auto_recreate', '0');
     });
 
@@ -83,6 +84,9 @@ describe('GET /api/settings', () => {
       db.updateGlobalSetting('cloud_backup_endpoint', 'https://s3.example.com');
       db.updateGlobalSetting('cloud_backup_bucket', 'private-bucket');
       db.updateGlobalSetting('trivy_auto_update', '1');
+      // Scanner toggles live under /api/security/*, never the generic settings
+      // allowlist, so the advisory key must not surface here either.
+      db.updateGlobalSetting('pre_deploy_scan_advisory', '1');
       // A key that is neither allowlisted nor obviously sensitive: the allowlist
       // must still exclude it. This locks the fail-closed contract that is the
       // reason the GET uses an allowlist rather than a denylist.
@@ -97,6 +101,7 @@ describe('GET /api/settings', () => {
       expect(res.body.cloud_backup_endpoint).toBeUndefined();
       expect(res.body.cloud_backup_bucket).toBeUndefined();
       expect(res.body.trivy_auto_update).toBeUndefined();
+      expect(res.body.pre_deploy_scan_advisory).toBeUndefined();
       expect(res.body.some_future_setting).toBeUndefined();
       // Allowlisted keys still come through. Two structurally different keys (a
       // numeric and an enum-shaped one) prove the projection passes the whole

backend/src/__tests__/trivy-installer-version.test.ts

@@ -0,0 +1,89 @@
+/**
+ * Managed Trivy install/update version selection.
+ *
+ * A normal managed install pins to a known-good bundled version for
+ * reproducibility; opting into auto-update tracks the latest release; and an
+ * explicit Update always pulls the latest regardless of the auto-update setting.
+ * The download itself (doInstall) is mocked so these stay offline and fast.
+ */
+import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from 'vitest';
+import { setupTestDb, cleanupTestDb } from './helpers/setupTestDb';
+
+let tmpDir: string;
+let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
+let TrivyInstaller: typeof import('../services/TrivyInstaller').default;
+
+// The pinned default the installer must use when auto-update is off. Kept in
+// sync with PINNED_TRIVY_VERSION in TrivyInstaller.ts.
+const PINNED = '0.70.0';
+
+type InstallerInternals = { doInstall: (version: string) => Promise<{ version: string }> };
+
+beforeAll(async () => {
+  tmpDir = await setupTestDb();
+  ({ DatabaseService } = await import('../services/DatabaseService'));
+  TrivyInstaller = (await import('../services/TrivyInstaller')).default;
+});
+
+afterAll(() => cleanupTestDb(tmpDir));
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '0');
+});
+
+describe('TrivyInstaller managed version selection', () => {
+  it('install() pins to the bundled version by default (auto-update off)', async () => {
+    const installer = TrivyInstaller.getInstance();
+    DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '0');
+    const fetchLatest = vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.99.0');
+    const doInstall = vi
+      .spyOn(installer as unknown as InstallerInternals, 'doInstall')
+      .mockResolvedValue({ version: PINNED });
+
+    await installer.install();
+
+    expect(fetchLatest).not.toHaveBeenCalled();
+    expect(doInstall).toHaveBeenCalledWith(PINNED);
+  });
+
+  it('install() tracks the latest release when auto-update is on', async () => {
+    const installer = TrivyInstaller.getInstance();
+    DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '1');
+    const fetchLatest = vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.99.0');
+    const doInstall = vi
+      .spyOn(installer as unknown as InstallerInternals, 'doInstall')
+      .mockResolvedValue({ version: '0.99.0' });
+
+    await installer.install();
+
+    expect(fetchLatest).toHaveBeenCalled();
+    expect(doInstall).toHaveBeenCalledWith('0.99.0');
+  });
+
+  it('update() always installs the latest release, even with auto-update off', async () => {
+    const installer = TrivyInstaller.getInstance();
+    DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '0');
+    vi.spyOn(installer, 'isManagedInstalled').mockReturnValue(true);
+    const fetchLatest = vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.99.0');
+    const doInstall = vi
+      .spyOn(installer as unknown as InstallerInternals, 'doInstall')
+      .mockResolvedValue({ version: '0.99.0' });
+
+    await installer.update();
+
+    expect(fetchLatest).toHaveBeenCalled();
+    expect(doInstall).toHaveBeenCalledWith('0.99.0');
+  });
+
+  it('rejects a resolved version below the supported minimum (real doInstall guard)', async () => {
+    const installer = TrivyInstaller.getInstance();
+    // Auto-update on so install() takes the fetched-latest path; the fetch returns
+    // a sub-minimum version, which the doInstall guard must reject before any
+    // download happens. doInstall is NOT mocked here so the real guard runs.
+    DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '1');
+    vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.49.0');
+
+    await expect(installer.install()).rejects.toThrow(/below minimum/);
+  });
+});