Skip to content
Sign in

flagon-io/g1t

public
0

g1t/apps/web/app/routes/repo/security-secret.tsx

232 lines12,409 bytesCodeBlame

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar1import { ArrowLeft, RefreshCw } from "lucide-react";
2import { Link, useFetcher } from "react-router";
3
4import { SECRET_DISMISS_REASONS, dismissLabel, type DismissReason } from "@g1t/contracts";
5
6import type { Route } from "./+types/security-secret";
7import { page } from "../../lib/meta";
8import { DismissDialog, ReopenButton } from "../../components/security";
9import { BypassForm, CARD, FixWithG1t } from "../../components/security-suite";
10import { TimeAgo } from "../../components/ui";
11import { Badge } from "../../components/ui/badge";
12import { security, securitySuite } from "../../lib/services.server";
13import { assertSameOrigin, getViewer, requireUser, unwrap } from "../../lib/session.server";
14import { refusal, requireInsider } from "../../lib/access.server";
15
16export function meta({ params, ...args }: Route.MetaArgs) {
17 return page(args, { title: `Secret alert · ${params.owner}/${params.repo} · g1t` });
18}
19
20export async function loader({ params, context, request }: Route.LoaderArgs) {
21 // Git's refusal links here; someone signed out signs in first.
22 const viewer = getViewer(context) ?? requireUser(context, request);
Merge membership: owners, org roles, GitHub's repo roles, privileges, 2FA23 const { access } = await requireInsider(context, params, "security_alerts");
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar24 const repo = { namespace: params.owner, name: params.repo };
25 const [detail, settings] = await Promise.all([securitySuite.secretAlert(repo, params.id, viewer), securitySuite.settings(repo, viewer)]);
26 return { detail: unwrap(detail), settings: settings.ok ? settings.value : null, can: access.can };
27}
28
29const REASONS = new Set(["false_positive", "used_in_tests", "revoked", "wont_fix"]);
30const BYPASS = new Set(["false_positive", "used_in_tests", "will_fix_later"]);
31
32export async function action({ params, context, request }: Route.ActionArgs) {
33 assertSameOrigin(request);
34 const user = requireUser(context, request);
35 const repo = { namespace: params.owner, name: params.repo };
36 const form = await request.formData();
37 const intent = String(form.get("intent") ?? "");
38 const id = params.id;
39 const comment = String(form.get("comment") ?? "").trim().slice(0, 500);
Merge membership: owners, org roles, GitHub's repo roles, privileges, 2FA40 const capability = intent === "dismiss" || intent === "reopen" ? "security_alerts" : intent === "fix" ? "run" : "security_alerts";
Teams and CODEOWNERS, labels and milestones, dependency updates, the security suite, and a clearer top bar41 const refused = await refusal(context, params, capability);
42 if (refused) return { ok: false, error: refused };
43 if (intent === "dismiss") {
44 const reason = String(form.get("reason") ?? "");
45 if (!REASONS.has(reason)) return { ok: false, error: "Choose a reason." };
46 const done = await security.dismiss(user, repo, id, reason as DismissReason, comment);
47 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
48 }
49 if (intent === "reopen") {
50 const done = await security.reopen(user, repo, id);
51 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
52 }
53 if (intent === "bypass") {
54 const reason = String(form.get("reason") ?? "");
55 if (!BYPASS.has(reason)) return { ok: false, error: "Choose a reason." };
56 const done = await securitySuite.bypass(user, repo, id, reason as "false_positive", comment);
57 return done.ok ? { ok: true, requested: Boolean(done.value.request) } : { ok: false, error: done.error.message };
58 }
59 if (intent === "validity") {
60 const done = await securitySuite.checkValidity(user, repo, id);
61 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
62 }
63 if (intent === "fix") {
64 const done = await securitySuite.fixAlert(user, repo, id);
65 return done.ok ? { ok: true, issue: done.value.issue, message: done.value.message } : { ok: false, error: done.error.message };
66 }
67 return { ok: false, error: "Unknown action." };
68}
69
70const VALIDITY: Record<string, { label: string; tone: "danger" | "neutral" | "info"; about: string }> = {
71 active: { label: "Active", tone: "danger", about: "Its issuer says it still works: rotate it." },
72 inactive: { label: "Inactive", tone: "neutral", about: "Its issuer refused it: revoked, expired or never real." },
73 unknown: { label: "Unknown", tone: "info", about: "Its issuer could not say, or it never landed and cannot be read again." },
74 unsupported: { label: "No check", tone: "neutral", about: "There is no safe way to ask this kind of secret's issuer." },
75};
76
77function ValidityCheck({ action, checkable, enabled }: { action: string; checkable: boolean; enabled: boolean }) {
78 const fetcher = useFetcher<{ ok: boolean; error?: string }>();
79 if (!checkable) return <p className="text-xs text-muted">This kind of secret has no safe check with its issuer.</p>;
80 if (!enabled) return <p className="text-xs text-muted">Validity checks are off for this workspace. An owner can turn them on in its Security settings.</p>;
81 return (
82 <span className="flex flex-col gap-1">
83 <button
84 type="button"
85 disabled={fetcher.state !== "idle"}
86 onClick={() => fetcher.submit({ intent: "validity" }, { method: "post", action })}
87 className="inline-flex w-fit items-center gap-1.5 rounded-md border border-line px-2.5 py-1 text-xs font-medium text-muted hover:border-line-strong hover:text-fg disabled:opacity-50"
88 >
89 <RefreshCw size={12} className={fetcher.state !== "idle" ? "animate-spin" : ""} />
90 {fetcher.state !== "idle" ? "Asking…" : "Check with its issuer"}
91 </button>
92 {fetcher.data?.error && <span className="text-xs text-danger">{fetcher.data.error}</span>}
93 </span>
94 );
95}
96
97export default function SecretAlert({ loaderData, params }: Route.ComponentProps) {
98 const { detail, settings, can } = loaderData;
99 const { secret } = detail;
100 const base = `/${params.owner}/${params.repo}`;
101 const action = `${base}/security/secret-scanning/${secret.id}`;
102 const landed = secret.status !== "blocked";
103 const validity = VALIDITY[secret.validity ?? "unknown"];
104 const pending = detail.requests.find((request) => request.state === "pending");
105 return (
106 <div className="max-w-4xl space-y-6">
107 <Link to={`${base}/security/secret-scanning`} className="inline-flex items-center gap-1.5 text-sm text-muted hover:text-fg">
108 <ArrowLeft size={14} /> Secret scanning
109 </Link>
110 <div className="flex flex-wrap items-start justify-between gap-4">
111 <div className="min-w-0">
112 <h2 className="text-xl font-semibold tracking-tight first-letter:uppercase">{secret.label}</h2>
113 <p className="mt-1 flex flex-wrap items-center gap-2 text-sm text-muted">
114 <Badge tone={secret.state === "open" ? (secret.status === "blocked" ? "warn" : "danger") : "neutral"}>
115 {secret.status === "blocked" ? "Blocked at a push" : secret.state === "open" ? "Open" : secret.state === "fixed" ? "Revoked" : "Dismissed"}
116 </Badge>
117 {secret.dismissedReason && <Badge>{dismissLabel(secret.dismissedReason)}</Badge>}
118 {secret.bypass && <Badge tone="warn">Bypassed</Badge>}
119 <span className="font-mono text-xs">{secret.preview}</span>
120 </p>
121 </div>
122 {can.manage_integrations && (
123 <div className="flex items-center gap-2">
124 {landed && secret.state === "open" && can.run && <FixWithG1t id={secret.id} action={action} issue={null} base={base} />}
125 {secret.state === "open" ? (
126 <DismissDialog id={secret.id} title={`Dismiss ${secret.label}`} detail={`${secret.path}:${secret.line} · ${secret.preview}`} reasons={SECRET_DISMISS_REASONS} action={action} />
127 ) : (
128 <ReopenButton id={secret.id} action={action} />
129 )}
130 </div>
131 )}
132 </div>
133
134 {secret.status === "blocked" && !secret.bypass && (detail.canBypass || detail.canRequestBypass) && (
135 <section className={`${CARD} p-4`}>
136 <h3 className="text-sm font-semibold">{detail.canRequestBypass ? "Ask to push it anyway" : "Push it anyway"}</h3>
137 <p className="mt-1 mb-3 text-sm text-muted">
138 {detail.canRequestBypass
139 ? "This workspace asks an owner or the repository's admins to approve each bypass. They are told in their inbox."
140 : "Take it out of the commit and push again if you can. If it has to go through, say why."}
141 </p>
142 {pending ? (
143 <p className="text-sm text-muted">
144 {pending.requester} asked <TimeAgo at={pending.createdAt} /> ({pending.reason.replaceAll("_", " ")}). Waiting for a review.
145 </p>
146 ) : (
147 <BypassForm id={secret.id} action={action} request={detail.canRequestBypass} />
148 )}
149 </section>
150 )}
151
152 <section className={`${CARD} grid gap-4 p-4 sm:grid-cols-2`}>
153 <div>
154 <h3 className="text-xs font-medium text-muted">Validity</h3>
155 <p className="mt-1 flex items-center gap-2 text-sm">
156 <Badge tone={validity.tone}>{validity.label}</Badge>
157 {secret.validityCheckedAt && (
158 <span className="text-xs text-faint">
159 asked <TimeAgo at={secret.validityCheckedAt} />
160 </span>
161 )}
162 </p>
163 <p className="mt-1 text-xs text-muted">{validity.about}</p>
164 <div className="mt-2">
165 <ValidityCheck action={action} checkable={detail.checkable && landed} enabled={Boolean(settings?.workspace.validityChecks && settings.entitled)} />
166 </div>
167 </div>
168 <div>
169 <h3 className="text-xs font-medium text-muted">Found</h3>
170 <p className="mt-1 text-sm">
171 {secret.source === "push" ? "In a push" : "In the history"}
172 {secret.foundBy && <> by {secret.foundBy}</>}, <TimeAgo at={secret.foundAt} />
173 </p>
174 {secret.bypass && (
175 <p className="mt-2 text-sm text-muted">
176 Bypassed by {secret.bypass.by} <TimeAgo at={secret.bypass.at} />: {secret.bypass.reason.replaceAll("_", " ")}
177 {secret.bypass.approvedBy && <>, approved by {secret.bypass.approvedBy}</>}
178 {secret.bypass.comment && <> · “{secret.bypass.comment}”</>}
179 </p>
180 )}
181 </div>
182 </section>
183
184 <section>
185 <h3 className="text-base font-semibold tracking-tight">Locations</h3>
186 <ul className={`${CARD} mt-2 divide-y divide-line`}>
187 {(detail.locations.length ? detail.locations : [{ path: secret.path, line: secret.line, commit: secret.commit, source: secret.source, foundAt: secret.foundAt }]).map((location) => (
188 <li key={`${location.commit}:${location.path}:${location.line}`} className="flex flex-wrap items-center gap-x-3 gap-y-1 px-4 py-2.5 text-sm">
189 {landed ? (
190 <Link to={`${base}/blob/${location.commit}/${location.path}#L${location.line}`} className="font-mono text-xs hover:underline">
191 {location.path}:{location.line}
192 </Link>
193 ) : (
194 <span className="font-mono text-xs">
195 {location.path}:{location.line}
196 </span>
197 )}
198 <span className="font-mono text-xs text-faint">{location.commit.slice(0, 7)}</span>
199 <span className="text-xs text-faint">{location.source === "push" ? "push" : "history"}</span>
200 </li>
201 ))}
202 </ul>
203 </section>
204
205 {(detail.activity.length > 0 || detail.requests.length > 0) && (
206 <section>
207 <h3 className="text-base font-semibold tracking-tight">Activity</h3>
208 <ul className="mt-2 space-y-1.5 text-sm text-muted">
209 {detail.requests.map((request) => (
210 <li key={request.id}>
211 {request.requester} asked to bypass ({request.reason.replaceAll("_", " ")}) <TimeAgo at={request.createdAt} />
212 {request.state !== "pending" && (
213 <>
214 {" "}· {request.state}
215 {request.reviewer && <> by {request.reviewer}</>}
216 </>
217 )}
218 </li>
219 ))}
220 {detail.activity.map((entry) => (
221 <li key={entry.id}>
222 {entry.actor ?? "g1t"} {entry.action.replaceAll("_", " ")}
223 {entry.reason && <> ({dismissLabel(entry.reason)})</>}
224 {entry.comment && <> · “{entry.comment}”</>} <TimeAgo at={entry.at} />
225 </li>
226 ))}
227 </ul>
228 </section>
229 )}
230 </div>
231 );
232}

This file's history is long; its oldest lines are credited to the oldest commit read.