mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-19 23:06:49 +00:00
Anso
7ce045accb
* feat: pre-deploy scan visibility and pinned scanner version Pin managed Trivy installs and add an opt-in pre-deploy scan advisory so a manual deploy can surface each image's latest scan before it runs. - Managed Trivy now installs a pinned, known-good version by default for reproducible installs. Auto-update still tracks the latest release, and an explicit update always pulls the latest. - Add an opt-in pre-deploy scan advisory: when enabled, deploying a stack from the editor first shows each image's latest cached scan severity for review. It is visibility only and never blocks; deploy enforcement is unchanged. - Backend: pre_deploy_scan_advisory setting, PUT /security/pre-deploy-scan-advisory, a cache-only GET /security/stacks/:name/pre-deploy-summary, and a node-scoped getLatestVulnScanByDigestForNode lookup. - Frontend: advisory toggle on the Security page scanner setup, and a PreDeployScanDialog wired into the editor deploy flow that fails open when the summary is unavailable. - Docs: scanner configuration, version pinning, and the advisory. * fix: harden pre-deploy advisory guard, toggle visibility, and installer busy state Addresses review findings on the pre-deploy advisory. - Block a second editor deploy during the async advisory window with a synchronous pending ref, cleared on cancel and in the deploy's finally, so a double-click can no longer start two deploys. - Keep the pre-deploy advisory toggle visible to admins whenever the setting is on, so it can still be turned off after the scanner becomes unavailable. - Resolve the managed Trivy version inside the install lock so the busy state and serialization cover the latest-version fetch and the managed-install check.
90 lines
3.4 KiB
TypeScript
90 lines
3.4 KiB
TypeScript
/**
|
|
* getLatestVulnScanByDigestForNode: the node-scoped, vulnerability-bearing
|
|
* latest-scan lookup that powers the pre-deploy advisory. It must (a) only ever
|
|
* return a scan for the requested node, and (b) only consider scanner sets that
|
|
* actually ran the vulnerability scanner, so a secret-only or config scan is
|
|
* never mistaken for a clean vuln scan.
|
|
*/
|
|
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
|
import { setupTestDb, cleanupTestDb } from './helpers/setupTestDb';
|
|
import type { DatabaseService as DatabaseServiceType, VulnerabilityScan } from '../services/DatabaseService';
|
|
|
|
let tmpDir: string;
|
|
let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
|
|
|
|
function insertScan(
|
|
db: DatabaseServiceType,
|
|
over: Partial<Omit<VulnerabilityScan, 'id'>>,
|
|
): number {
|
|
return db.createVulnerabilityScan({
|
|
node_id: 1,
|
|
image_ref: 'img',
|
|
image_digest: 'sha256:default',
|
|
scanned_at: 1000,
|
|
total_vulnerabilities: 0,
|
|
critical_count: 0,
|
|
high_count: 0,
|
|
medium_count: 0,
|
|
low_count: 0,
|
|
unknown_count: 0,
|
|
fixable_count: 0,
|
|
secret_count: 0,
|
|
misconfig_count: 0,
|
|
scanners_used: 'vuln',
|
|
highest_severity: null,
|
|
os_info: null,
|
|
trivy_version: null,
|
|
scan_duration_ms: null,
|
|
triggered_by: 'manual',
|
|
status: 'completed',
|
|
error: null,
|
|
stack_context: null,
|
|
...over,
|
|
});
|
|
}
|
|
|
|
beforeAll(async () => {
|
|
tmpDir = await setupTestDb();
|
|
({ DatabaseService } = await import('../services/DatabaseService'));
|
|
});
|
|
|
|
afterAll(() => cleanupTestDb(tmpDir));
|
|
|
|
describe('getLatestVulnScanByDigestForNode', () => {
|
|
it('includes vuln and vuln,secret rows but excludes secret-only and config scans', () => {
|
|
const db = DatabaseService.getInstance();
|
|
const digest = 'sha256:setfilter';
|
|
// Newer rows that did NOT run the vuln scanner must be ignored even though
|
|
// they are more recent than the vuln-bearing rows.
|
|
insertScan(db, { image_digest: digest, scanners_used: 'secret', scanned_at: 5000, critical_count: 99 });
|
|
insertScan(db, { image_digest: digest, scanners_used: 'config', scanned_at: 4000, critical_count: 88 });
|
|
insertScan(db, { image_digest: digest, scanners_used: 'vuln', scanned_at: 1000, critical_count: 1 });
|
|
insertScan(db, { image_digest: digest, scanners_used: 'vuln,secret', scanned_at: 2000, critical_count: 2 });
|
|
|
|
const found = db.getLatestVulnScanByDigestForNode(digest, 1);
|
|
expect(found).not.toBeNull();
|
|
expect(found?.scanners_used).toBe('vuln,secret');
|
|
expect(found?.critical_count).toBe(2);
|
|
});
|
|
|
|
it('is node-scoped: a scan from another node is not returned', () => {
|
|
const db = DatabaseService.getInstance();
|
|
const digest = 'sha256:nodescope';
|
|
insertScan(db, { node_id: 2, image_digest: digest, scanners_used: 'vuln', scanned_at: 9000, critical_count: 7 });
|
|
|
|
expect(db.getLatestVulnScanByDigestForNode(digest, 1)).toBeNull();
|
|
expect(db.getLatestVulnScanByDigestForNode(digest, 2)?.critical_count).toBe(7);
|
|
});
|
|
|
|
it('ignores non-completed scans', () => {
|
|
const db = DatabaseService.getInstance();
|
|
const digest = 'sha256:status';
|
|
insertScan(db, { image_digest: digest, scanners_used: 'vuln', status: 'in_progress', scanned_at: 8000 });
|
|
expect(db.getLatestVulnScanByDigestForNode(digest, 1)).toBeNull();
|
|
});
|
|
|
|
it('returns null for an empty digest', () => {
|
|
expect(DatabaseService.getInstance().getLatestVulnScanByDigestForNode('', 1)).toBeNull();
|
|
});
|
|
});
|