gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-19 23:06:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): add triage status and OpenVEX justification parity (#1615)

Browse Source 
* feat(security): add triage status and OpenVEX justification parity

Share triage options across SuppressionsPanel and the scan-sheet suppress dialog, require justification for not_affected and false_positive, and document the fields.

* fix(security): use design-system Select for triage dropdowns

Replace native selects so OpenVEX justification options use themed popover content instead of unreadable OS option lists in dark mode.

* fix(security): keep triage justification Select controlled

Pass an empty string instead of undefined so Radix Select does not flip between uncontrolled and controlled when the placeholder is shown.
This commit is contained in:
Anso
2026-07-11 19:26:26 -04:00
committed by GitHub
parent ce699864c1
commit e7ac496009
10 changed files with 481 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/lib/triage.ts
+43
View File
@@ -0,0 +1,43 @@
import type { TriageJustification, TriageStatus } from '@/types/security';
export const TRIAGE_STATUS_OPTIONS: ReadonlyArray<{ value: TriageStatus; label: string }> = [
{ value: 'accepted', label: 'Accepted risk' },
{ value: 'not_affected', label: 'Not affected' },
{ value: 'false_positive', label: 'False positive' },
{ value: 'affected', label: 'Affected' },
{ value: 'needs_review', label: 'Needs review' },
{ value: 'fixed', label: 'Fixed' },
{ value: 'ignored', label: 'Ignored until expiry' },
];
export const TRIAGE_JUSTIFICATION_OPTIONS: ReadonlyArray<{ value: TriageJustification; label: string }> = [
{ value: 'vulnerable_code_not_present', label: 'Vulnerable code not present' },
{ value: 'vulnerable_code_not_in_execute_path', label: 'Vulnerable code not in execute path' },
{ value: 'component_not_present', label: 'Component not present' },
{ value: 'inline_mitigations_already_exist', label: 'Inline mitigations already exist' },
];
export const TRIAGE_STATUS_HINT =
'How this finding was triaged. Decided states (accepted, not affected, false positive, fixed, ignored) stop driving the posture; needs review and affected stay counted but actionable.';
/** True when OpenVEX export needs a justification code for this triage status. */
export function openVexRequiresJustification(status: TriageStatus): boolean {
return status === 'not_affected' || status === 'false_positive';
}
/** Keep the current justification only when the new status still requires one. */
export function justificationForStatus(status: TriageStatus, justification: string): string {
return openVexRequiresJustification(status) ? justification : '';
}
export function triageStatusLabel(status: TriageStatus | undefined): string {
if (!status) return 'Accepted risk';
return TRIAGE_STATUS_OPTIONS.find((o) => o.value === status)?.label ?? status;
}
export function triageJustificationLabel(
justification: TriageJustification | null | undefined,
): string | null {
if (!justification) return null;
return TRIAGE_JUSTIFICATION_OPTIONS.find((o) => o.value === justification)?.label ?? justification;
}