mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-08 18:05:10 +00:00
Anso
2a4955f56d
* feat: add dedicated Security page and policy-pack foundation Bring vulnerability scanning, scan history, suppressions, Compose risks, secrets, policy packs, and scanner setup into one node-scoped Security command center instead of scattering them across Resources and Settings. - New top-level Security view with Overview, Images, Compose risks, Secrets, Policies, Suppressions, History, and Scanner setup tabs (status masthead + signal rail; controlled tabs with deep-link support). - Backend: GET /security/overview rollup and GET /security/policy-packs static catalog (auth-only, Community). DatabaseService gains an uncapped scan-status count and a node-eligible block-policy count, and getImageScanSummaries now projects secret and misconfig counts. - Reuse existing surfaces: the scan-history sheet, the control-governed suppression and acknowledgement panels, and the scan-detail sheet (now with an initial-tab prop so it opens on the matching finding type). - Extract a shared SeverityBadge (from Resources) and a TrivyManager (from Settings) so both surfaces render identical controls. - Resources "Scan history" now links into the Security page History tab. - Docs for the new Security surface and tests for the new endpoints, helpers, nav wiring, and tabs. * refactor: consolidate scanner and policy management onto the Security page Remove the Settings "Vulnerability Scanning" section now that the Security page covers the same ground, with every option preserved: - Scanner install / update / uninstall / auto-update live on the Scanner setup tab (TrivyManager). - Scan policies, the honor-suppressions toggle, and the replica managed-by-control / demote controls move into a new ScanPolicyManager on the Policies tab (paid; Community sees only the policy-pack catalog). - CVE suppressions and acknowledgements remain on the Suppressions tab. Wiring removed: the registry section and the now-empty Security settings group, the SectionId, the SettingsSectionContent case and the isPaid prop it was the sole consumer of, and SecuritySection itself. The dashboard configuration-status "Vulnerability scanning" row now navigates to the Security page Policies tab. Docs that pointed at "Settings -> Security -> Vulnerability Scanning" are swept to the relevant Security page tabs. * fix: harden Security page scanner refresh, policy-load errors, and secret-only badges Address independent-review findings on the Security page: - Scanner setup now refreshes Trivy state when the active node changes, so the displayed scanner status matches the node TrivyManager's actions target (both follow x-node-id). Previously, switching nodes on the tab left stale state. - ScanPolicyManager surfaces an explicit error state on a failed policy fetch instead of falling through to a false "No scan policies configured". - The shared SeverityBadge and the Images findings column no longer label a scan "clean" when it has secrets or misconfigurations but no CVE severity (highest_severity is derived from vulnerabilities only); they show a "Findings" state and the secret/misconfig counts instead. - The Overview enforcement note points to the Policies tab, not the removed Settings section. - The History tab auto-opens the scan-history sheet only on a deep-link (mount with the History tab active), not on every manual tab selection. Adds tests for the badge secret/misconfig state and the policy-load error state.
73 lines
3.3 KiB
TypeScript
73 lines
3.3 KiB
TypeScript
/**
|
|
* ScanPolicyManager is the paid deploy-enforcement surface on the Security
|
|
* Policies tab. Key guards: it renders nothing for Community, and a failed
|
|
* policy fetch surfaces an error state instead of a false "No scan policies
|
|
* configured".
|
|
*/
|
|
import { it, expect, vi, beforeEach } from 'vitest';
|
|
import { render, screen, waitFor } from '@testing-library/react';
|
|
|
|
vi.mock('@/lib/api', () => ({ apiFetch: vi.fn() }));
|
|
vi.mock('@/context/LicenseContext');
|
|
vi.mock('@/context/AuthContext');
|
|
vi.mock('@/context/NodeContext');
|
|
vi.mock('@/hooks/useTrivyStatus');
|
|
vi.mock('@/components/ui/toast-store', () => ({
|
|
toast: { error: vi.fn(), success: vi.fn(), info: vi.fn(), warning: vi.fn(), loading: vi.fn(() => 'id'), dismiss: vi.fn() },
|
|
}));
|
|
|
|
import { apiFetch } from '@/lib/api';
|
|
import * as LicenseContext from '@/context/LicenseContext';
|
|
import * as AuthContext from '@/context/AuthContext';
|
|
import * as NodeContext from '@/context/NodeContext';
|
|
import * as TrivyStatus from '@/hooks/useTrivyStatus';
|
|
import { ScanPolicyManager } from '../ScanPolicyManager';
|
|
|
|
const mockedFetch = apiFetch as unknown as ReturnType<typeof vi.fn>;
|
|
|
|
function jsonResponse(status: number, body: unknown): Response {
|
|
return { ok: status >= 200 && status < 300, status, json: async () => body } as unknown as Response;
|
|
}
|
|
|
|
function setup({ isPaid }: { isPaid: boolean }) {
|
|
vi.mocked(LicenseContext.useLicense).mockReturnValue({ isPaid } as unknown as ReturnType<typeof LicenseContext.useLicense>);
|
|
vi.mocked(AuthContext.useAuth).mockReturnValue({ isAdmin: true } as unknown as ReturnType<typeof AuthContext.useAuth>);
|
|
vi.mocked(NodeContext.useNodes).mockReturnValue({ activeNode: { type: 'local', id: 1, name: 'local' } } as unknown as ReturnType<typeof NodeContext.useNodes>);
|
|
vi.mocked(TrivyStatus.useTrivyStatus).mockReturnValue({
|
|
status: { available: true, version: '1', source: 'managed', autoUpdate: false, honorSuppressionsOnDeploy: false, busy: false },
|
|
updateCheck: null,
|
|
refresh: vi.fn().mockResolvedValue(undefined),
|
|
refreshUpdateCheck: vi.fn().mockResolvedValue(undefined),
|
|
});
|
|
}
|
|
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
// Fleet-role probe resolves to control by default; per-test override for policies.
|
|
mockedFetch.mockImplementation((url: string) =>
|
|
Promise.resolve(url.startsWith('/fleet/role') ? jsonResponse(200, { role: 'control' }) : jsonResponse(200, [])),
|
|
);
|
|
});
|
|
|
|
it('renders nothing for a Community operator (paid surface)', () => {
|
|
setup({ isPaid: false });
|
|
const { container } = render(<ScanPolicyManager />);
|
|
expect(container).toBeEmptyDOMElement();
|
|
});
|
|
|
|
it('surfaces an error state when the policies fetch fails (no false "no policies")', async () => {
|
|
setup({ isPaid: true });
|
|
mockedFetch.mockImplementation((url: string) =>
|
|
Promise.resolve(url.startsWith('/fleet/role') ? jsonResponse(200, { role: 'control' }) : jsonResponse(500, {})),
|
|
);
|
|
render(<ScanPolicyManager />);
|
|
await waitFor(() => expect(screen.getByText("Couldn't load scan policies")).toBeInTheDocument());
|
|
expect(screen.queryByText('No scan policies configured')).not.toBeInTheDocument();
|
|
});
|
|
|
|
it('shows the empty state when there are genuinely no policies', async () => {
|
|
setup({ isPaid: true });
|
|
render(<ScanPolicyManager />);
|
|
await waitFor(() => expect(screen.getByText('No scan policies configured')).toBeInTheDocument());
|
|
});
|