Skip to content
Sign in

flagon-io/g1t

public
0

g1t/apps/web/app/routes/repo/security-settings.tsx

159 lines8,561 bytesCodeBlame
1import { Link, useFetcher } from "react-router";
2
3import { CODE_SCANNING_GATES, type CodeScanningGate, type RepoSecuritySettings, type ReviewFailOn } from "@g1t/contracts";
4
5import type { Route } from "./+types/security-settings";
6import { page } from "../../lib/meta";
7import { ActivationPrompt, CARD, SectionHeader } from "../../components/security-suite";
8import { Hint } from "../../components/ui/hint";
9import { Switch } from "../../components/ui/switch";
10import { securitySuite } from "../../lib/services.server";
11import { assertSameOrigin, getViewer, requireUser, roleIn, unwrap } from "../../lib/session.server";
12import { refusal, requireInsider } from "../../lib/access.server";
13import { whyNot } from "../../lib/access";
14import { activationPrice } from "../../lib/security-suite.server";
15
16export function meta({ params, ...args }: Route.MetaArgs) {
17 return page(args, { title: `Security settings · ${params.owner}/${params.repo} · g1t` });
18}
19
20export async function loader({ params, context, request }: Route.LoaderArgs) {
21 const viewer = getViewer(context) ?? requireUser(context, request);
22 const { access } = await requireInsider(context, params, "push");
23 const repo = { namespace: params.owner, name: params.repo };
24 const [view, price] = await Promise.all([securitySuite.settings(repo, viewer), activationPrice(params.owner, viewer)]);
25 return { view: unwrap(view), price, can: access.can, owner: roleIn(viewer, params.owner) === "owner" };
26}
27
28const GATES = new Set(CODE_SCANNING_GATES.map((gate) => gate.gate));
29const FAIL_ON = new Set(["critical", "high", "medium", "low", "none"]);
30
31/** The settings a form posts. */
32export function settingsFrom(form: FormData): RepoSecuritySettings | string {
33 const gate = String(form.get("codeScanningGate") ?? "");
34 const failOn = String(form.get("reviewFailOn") ?? "");
35 if (!GATES.has(gate as CodeScanningGate)) return "Choose when code scanning fails.";
36 if (!FAIL_ON.has(failOn)) return "Choose when dependency review fails.";
37 return {
38 codeScanningGate: gate as CodeScanningGate,
39 dependencyReview: form.get("dependencyReview") === "on",
40 reviewFailOn: failOn as ReviewFailOn,
41 reviewDenyLicenses: String(form.get("reviewDenyLicenses") ?? "")
42 .split(/[\s,]+/)
43 .map((id) => id.trim())
44 .filter(Boolean)
45 .slice(0, 50),
46 reviewComment: form.get("reviewComment") === "on",
47 };
48}
49
50export async function action({ params, context, request }: Route.ActionArgs) {
51 assertSameOrigin(request);
52 const user = requireUser(context, request);
53 const refused = await refusal(context, params, "manage_settings");
54 if (refused) return { ok: false, error: refused };
55 const settings = settingsFrom(await request.formData());
56 if (typeof settings === "string") return { ok: false, error: settings };
57 const saved = await securitySuite.setSettings(user, { namespace: params.owner, name: params.repo }, settings);
58 return saved.ok ? { ok: true } : { ok: false, error: saved.error.message };
59}
60
61const SELECT = "h-9 w-full rounded-md border border-line bg-bg px-2.5 text-sm text-fg outline-none hover:border-line-strong focus:border-accent-dim sm:w-72";
62
63export default function SecuritySettings({ loaderData, params }: Route.ComponentProps) {
64 const { view, price, can, owner } = loaderData;
65 const base = `/${params.owner}/${params.repo}`;
66 const fetcher = useFetcher<{ ok: boolean; error?: string }>();
67 const { settings } = view;
68 const disabled = !can.manage_settings || !view.entitled;
69 return (
70 <div className="max-w-3xl space-y-6">
71 <SectionHeader
72 title="Security settings"
73 about="When the pull request checks this repository's security suite reports fail. Require them in branch protection to block merges on them, for people and agents alike."
74 />
75 {!view.entitled && <ActivationPrompt workspace={params.owner} feature="Code scanning and dependency review" monthlyCents={price} isOwner={owner} />}
76 <fetcher.Form method="post" className="space-y-4">
77 <fieldset disabled={disabled} className={`${CARD} space-y-3 p-4 disabled:opacity-60`}>
78 <legend className="sr-only">Code scanning</legend>
79 <p className="text-sm font-medium">Code scanning results</p>
80 <p className="text-sm text-muted">The Code scanning check fails when a pull request brings new results on the lines it changes at this level.</p>
81 <select name="codeScanningGate" defaultValue={settings.codeScanningGate} className={SELECT} aria-label="When code scanning fails">
82 {CODE_SCANNING_GATES.map((gate) => (
83 <option key={gate.gate} value={gate.gate}>
84 {gate.label}
85 </option>
86 ))}
87 </select>
88 </fieldset>
89 <fieldset disabled={disabled} className={`${CARD} space-y-3 p-4 disabled:opacity-60`}>
90 <legend className="sr-only">Dependency review</legend>
91 <label className="flex items-start justify-between gap-4">
92 <span>
93 <span className="block text-sm font-medium">Dependency review</span>
94 <span className="mt-1 block text-sm text-muted">
95 Pull requests that change a lockfile get the Dependency review check, which fails when they add a package with a
96 known vulnerability or a license you do not allow.
97 </span>
98 </span>
99 <Switch name="dependencyReview" defaultChecked={settings.dependencyReview} className="mt-0.5" />
100 </label>
101 <label className="block">
102 <span className="mb-1.5 block text-xs font-medium text-muted">Fail on vulnerabilities of</span>
103 <select name="reviewFailOn" defaultValue={settings.reviewFailOn} className={SELECT}>
104 <option value="critical">Critical severity</option>
105 <option value="high">High severity or higher</option>
106 <option value="medium">Medium severity or higher</option>
107 <option value="low">Any severity</option>
108 <option value="none">Never fail on vulnerabilities</option>
109 </select>
110 </label>
111 <label className="block">
112 <span className="mb-1.5 block text-xs font-medium text-muted">Licenses not allowed (SPDX ids)</span>
113 <input
114 name="reviewDenyLicenses"
115 defaultValue={settings.reviewDenyLicenses.join(", ")}
116 placeholder="GPL-3.0-only, AGPL-3.0-only"
117 className="h-9 w-full rounded-md border border-line bg-bg px-2.5 font-mono text-sm outline-none hover:border-line-strong focus:border-accent-dim"
118 />
119 </label>
120 <label className="flex items-center justify-between gap-4">
121 <span className="text-sm">Comment the review's summary on the pull request</span>
122 <Switch name="reviewComment" defaultChecked={settings.reviewComment} />
123 </label>
124 </fieldset>
125 <div className="flex flex-wrap items-center gap-3">
126 <Hint label={whyNot(can, "manage_settings")} disabled={!can.manage_settings}>
127 <button
128 type="submit"
129 disabled={disabled || fetcher.state !== "idle"}
130 className="rounded-md bg-fg px-3.5 py-2 text-sm font-medium text-bg hover:bg-white disabled:opacity-50"
131 >
132 {fetcher.state !== "idle" ? "Saving…" : "Save"}
133 </button>
134 </Hint>
135 <Link to={`${base}/settings/branches`} className="text-sm text-muted underline underline-offset-2 hover:text-fg">
136 Require the checks in branch protection
137 </Link>
138 {fetcher.data?.ok && <span className="text-sm text-success">Saved.</span>}
139 {fetcher.data?.error && <span className="text-sm text-danger">{fetcher.data.error}</span>}
140 </div>
141 </fetcher.Form>
142 <p className="text-sm text-muted">
143 Security updates are on the{" "}
144 <Link to={`${base}/security/vulnerabilities`} className="underline underline-offset-2 hover:text-fg">
145 Vulnerabilities
146 </Link>{" "}
147 page, and version updates on{" "}
148 <Link to={`${base}/security/dependency-updates`} className="underline underline-offset-2 hover:text-fg">
149 Dependency updates
150 </Link>
151 . Delegated bypass and validity checks are the workspace's, in{" "}
152 <Link to={`/${params.owner}/-/security/settings`} className="underline underline-offset-2 hover:text-fg">
153 its Security settings
154 </Link>
155 .
156 </p>
157 </div>
158 );
159}