Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
229 linesCodeBlameRaw
1import { ArrowLeft, RefreshCw } from "lucide-react";
2import { Link, useFetcher } from "react-router";
3
4import { SECRET_DISMISS_REASONS, dismissLabel, type DismissReason } from "@g1t/contracts";
5
6import type { Route } from "./+types/security-secret";
7import { page } from "../../lib/meta";
8import { DismissDialog, ReopenButton } from "../../components/security";
9import { BypassForm, CARD } from "../../components/security-suite";
10import { TimeAgo } from "../../components/ui";
11import { Badge } from "../../components/ui/badge";
12import { Button } from "../../components/ui/button";
13import { security, securitySuite } from "../../lib/services.server";
14import { assertSameOrigin, getViewer, requireUser, unwrap } from "../../lib/session.server";
15import { refusal, requireInsider } from "../../lib/access.server";
16
17export function meta({ params, ...args }: Route.MetaArgs) {
18 return page(args, { title: `Secret alert · ${params.owner}/${params.repo} · g1t` });
19}
20
21export async function loader({ params, context, request }: Route.LoaderArgs) {
22 // Git's refusal links here; someone signed out signs in first.
23 const viewer = getViewer(context) ?? requireUser(context, request);
24 const { access } = await requireInsider(context, params, "security_alerts");
25 const repo = { namespace: params.owner, name: params.repo };
26 const [detail, settings] = await Promise.all([securitySuite.secretAlert(repo, params.id, viewer), securitySuite.settings(repo, viewer)]);
27 return { detail: unwrap(detail), settings: settings.ok ? settings.value : null, can: access.can };
28}
29
30const REASONS = new Set(["false_positive", "used_in_tests", "revoked", "wont_fix"]);
31const BYPASS = new Set(["false_positive", "used_in_tests", "will_fix_later"]);
32
33export async function action({ params, context, request }: Route.ActionArgs) {
34 assertSameOrigin(request);
35 const user = requireUser(context, request);
36 const repo = { namespace: params.owner, name: params.repo };
37 const form = await request.formData();
38 const intent = String(form.get("intent") ?? "");
39 const id = params.id;
40 const comment = String(form.get("comment") ?? "").trim().slice(0, 500);
41 const refused = await refusal(context, params, "security_alerts");
42 if (refused) return { ok: false, error: refused };
43 if (intent === "dismiss") {
44 const reason = String(form.get("reason") ?? "");
45 if (!REASONS.has(reason)) return { ok: false, error: "Choose a reason." };
46 const done = await security.dismiss(user, repo, id, reason as DismissReason, comment);
47 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
48 }
49 if (intent === "reopen") {
50 const done = await security.reopen(user, repo, id);
51 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
52 }
53 if (intent === "bypass") {
54 const reason = String(form.get("reason") ?? "");
55 if (!BYPASS.has(reason)) return { ok: false, error: "Choose a reason." };
56 const done = await securitySuite.bypass(user, repo, id, reason as "false_positive", comment);
57 return done.ok ? { ok: true, requested: Boolean(done.value.request) } : { ok: false, error: done.error.message };
58 }
59 if (intent === "validity") {
60 const done = await securitySuite.checkValidity(user, repo, id);
61 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
62 }
63 return { ok: false, error: "Unknown action." };
64}
65
66const VALIDITY: Record<string, { label: string; tone: "danger" | "neutral" | "info"; about: string }> = {
67 active: { label: "Active", tone: "danger", about: "Its issuer says it still works: rotate it." },
68 inactive: { label: "Inactive", tone: "neutral", about: "Its issuer refused it: revoked, expired or never real." },
69 unknown: { label: "Unknown", tone: "info", about: "Its issuer could not say, or it never landed and cannot be read again." },
70 unsupported: { label: "No check", tone: "neutral", about: "There is no safe way to ask this kind of secret's issuer." },
71};
72
73function ValidityCheck({ action, checkable, enabled }: { action: string; checkable: boolean; enabled: boolean }) {
74 const fetcher = useFetcher<{ ok: boolean; error?: string }>();
75 if (!checkable) return <p className="text-xs text-muted">This kind of secret has no safe check with its issuer.</p>;
76 if (!enabled) return <p className="text-xs text-muted">Validity checks are off for this workspace. An owner can turn them on in its Security settings.</p>;
77 return (
78 <span className="flex flex-col gap-1">
79 <Button
80 type="button"
81 disabled={fetcher.state !== "idle"}
82 onClick={() => fetcher.submit({ intent: "validity" }, { method: "post", action })}
83 variant="outline"
84 size="inline"
85 className="w-fit px-2.5 py-1 text-xs text-muted"
86 >
87 <RefreshCw size={12} className={fetcher.state !== "idle" ? "animate-spin" : ""} />
88 {fetcher.state !== "idle" ? "Asking…" : "Check with its issuer"}
89 </Button>
90 {fetcher.data?.error && <span className="text-xs text-danger">{fetcher.data.error}</span>}
91 </span>
92 );
93}
94
95export default function SecretAlert({ loaderData, params }: Route.ComponentProps) {
96 const { detail, settings, can } = loaderData;
97 const { secret } = detail;
98 const base = `/${params.owner}/${params.repo}`;
99 const action = `${base}/security/secret-scanning/${secret.id}`;
100 const landed = secret.status !== "blocked";
101 const validity = VALIDITY[secret.validity ?? "unknown"];
102 const pending = detail.requests.find((request) => request.state === "pending");
103 return (
104 <div className="max-w-4xl space-y-6">
105 <Link to={`${base}/security/secret-scanning`} className="inline-flex items-center gap-1.5 text-sm text-muted hover:text-fg">
106 <ArrowLeft size={14} /> Secret scanning
107 </Link>
108 <div className="flex flex-wrap items-start justify-between gap-4">
109 <div className="min-w-0">
110 <h2 className="text-xl font-semibold tracking-tight first-letter:uppercase">{secret.label}</h2>
111 <p className="mt-1 flex flex-wrap items-center gap-2 text-sm text-muted">
112 <Badge tone={secret.state === "open" ? (secret.status === "blocked" ? "warn" : "danger") : "neutral"}>
113 {secret.status === "blocked" ? "Blocked at a push" : secret.state === "open" ? "Open" : secret.state === "fixed" ? "Revoked" : "Dismissed"}
114 </Badge>
115 {secret.dismissedReason && <Badge>{dismissLabel(secret.dismissedReason)}</Badge>}
116 {secret.bypass && <Badge tone="warn">Bypassed</Badge>}
117 <span className="font-mono text-xs">{secret.preview}</span>
118 </p>
119 </div>
120 {can.manage_integrations && (
121 <div className="flex items-center gap-2">
122 {secret.state === "open" ? (
123 <DismissDialog id={secret.id} title={`Dismiss ${secret.label}`} detail={`${secret.path}:${secret.line} · ${secret.preview}`} reasons={SECRET_DISMISS_REASONS} action={action} />
124 ) : (
125 <ReopenButton id={secret.id} action={action} />
126 )}
127 </div>
128 )}
129 </div>
130
131 {secret.status === "blocked" && !secret.bypass && (detail.canBypass || detail.canRequestBypass) && (
132 <section className={`${CARD} p-4`}>
133 <h3 className="text-sm font-semibold">{detail.canRequestBypass ? "Ask to push it anyway" : "Push it anyway"}</h3>
134 <p className="mt-1 mb-3 text-sm text-muted">
135 {detail.canRequestBypass
136 ? "This workspace asks an owner or the repository's admins to approve each bypass. They are told in their notifications."
137 : "Take it out of the commit and push again if you can. If it has to go through, say why."}
138 </p>
139 {pending ? (
140 <p className="text-sm text-muted">
141 {pending.requester} asked <TimeAgo at={pending.createdAt} /> ({pending.reason.replaceAll("_", " ")}). Waiting for a review.
142 </p>
143 ) : (
144 <BypassForm id={secret.id} action={action} request={detail.canRequestBypass} />
145 )}
146 </section>
147 )}
148
149 <section className={`${CARD} grid gap-4 p-4 sm:grid-cols-2`}>
150 <div>
151 <h3 className="text-xs font-medium text-muted">Validity</h3>
152 <p className="mt-1 flex items-center gap-2 text-sm">
153 <Badge tone={validity.tone}>{validity.label}</Badge>
154 {secret.validityCheckedAt && (
155 <span className="text-xs text-faint">
156 asked <TimeAgo at={secret.validityCheckedAt} />
157 </span>
158 )}
159 </p>
160 <p className="mt-1 text-xs text-muted">{validity.about}</p>
161 <div className="mt-2">
162 <ValidityCheck action={action} checkable={detail.checkable && landed} enabled={Boolean(settings?.workspace.validityChecks && settings.entitled)} />
163 </div>
164 </div>
165 <div>
166 <h3 className="text-xs font-medium text-muted">Found</h3>
167 <p className="mt-1 text-sm">
168 {secret.source === "push" ? "In a push" : "In the history"}
169 {secret.foundBy && <> by {secret.foundBy}</>}, <TimeAgo at={secret.foundAt} />
170 </p>
171 {secret.bypass && (
172 <p className="mt-2 text-sm text-muted">
173 Bypassed by {secret.bypass.by} <TimeAgo at={secret.bypass.at} />: {secret.bypass.reason.replaceAll("_", " ")}
174 {secret.bypass.approvedBy && <>, approved by {secret.bypass.approvedBy}</>}
175 {secret.bypass.comment && <> · “{secret.bypass.comment}”</>}
176 </p>
177 )}
178 </div>
179 </section>
180
181 <section>
182 <h3 className="text-base font-semibold tracking-tight">Locations</h3>
183 <ul className={`${CARD} mt-2 divide-y divide-line`}>
184 {(detail.locations.length ? detail.locations : [{ path: secret.path, line: secret.line, commit: secret.commit, source: secret.source, foundAt: secret.foundAt }]).map((location) => (
185 <li key={`${location.commit}:${location.path}:${location.line}`} className="flex flex-wrap items-center gap-x-3 gap-y-1 px-4 py-2.5 text-sm">
186 {landed ? (
187 <Link to={`${base}/blob/${location.commit}/${location.path}#L${location.line}`} className="font-mono text-xs hover:underline">
188 {location.path}:{location.line}
189 </Link>
190 ) : (
191 <span className="font-mono text-xs">
192 {location.path}:{location.line}
193 </span>
194 )}
195 <span className="font-mono text-xs text-faint">{location.commit.slice(0, 7)}</span>
196 <span className="text-xs text-faint">{location.source === "push" ? "push" : "history"}</span>
197 </li>
198 ))}
199 </ul>
200 </section>
201
202 {(detail.activity.length > 0 || detail.requests.length > 0) && (
203 <section>
204 <h3 className="text-base font-semibold tracking-tight">Activity</h3>
205 <ul className="mt-2 space-y-1.5 text-sm text-muted">
206 {detail.requests.map((request) => (
207 <li key={request.id}>
208 {request.requester} asked to bypass ({request.reason.replaceAll("_", " ")}) <TimeAgo at={request.createdAt} />
209 {request.state !== "pending" && (
210 <>
211 {" "}· {request.state}
212 {request.reviewer && <> by {request.reviewer}</>}
213 </>
214 )}
215 </li>
216 ))}
217 {detail.activity.map((entry) => (
218 <li key={entry.id}>
219 {entry.actor ?? "g1t"} {entry.action.replaceAll("_", " ")}
220 {entry.reason && <> ({dismissLabel(entry.reason)})</>}
221 {entry.comment && <> · “{entry.comment}”</>} <TimeAgo at={entry.at} />
222 </li>
223 ))}
224 </ul>
225 </section>
226 )}
227 </div>
228 );
229}