Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
256 linesCodeBlameRaw
1import { ArrowLeft, RefreshCw } from "lucide-react";
2import { Link, useFetcher } from "react-router";
3
4import { SECRET_DISMISS_REASONS, dismissLabel, type DismissReason } from "@g1t/contracts";
5
6import type { Route } from "./+types/security-secret";
7import { page } from "../../lib/meta";
8import { DismissDialog, ReopenButton } from "../../components/security";
9import { BypassForm, CARD } from "../../components/security-suite";
10import { TimeAgo } from "../../components/ui";
11import { Badge } from "../../components/ui/badge";
12import { Button } from "../../components/ui/button";
13import { security, securitySuite } from "../../lib/services.server";
14import { assertSameOrigin, getViewer, requireUser, unwrap } from "../../lib/session.server";
15import { refusal, requireInsider } from "../../lib/access.server";
16import { Unavailable } from "../../components/boundary";
17import { isFailed, part } from "../../lib/partial";
18
19export function meta({ params, ...args }: Route.MetaArgs) {
20 return page(args, { title: `Secret alert · ${params.owner}/${params.repo} · g1t` });
21}
22
23export async function loader({ params, context, request }: Route.LoaderArgs) {
24 // Git's refusal links here; someone signed out signs in first.
25 const viewer = getViewer(context) ?? requireUser(context, request);
26 const { access } = await requireInsider(context, params, "security_alerts");
27 const repo = { namespace: params.owner, name: params.repo };
28 // The settings only say whether its validity can be asked: when they
29 // cannot be read, that says so, rather than that checks are off.
30 const [detail, settings] = await Promise.all([
31 securitySuite.secretAlert(repo, params.id, viewer),
32 part(securitySuite.settings(repo, viewer), "Whether validity checks are on"),
33 ]);
34 return { detail: unwrap(detail), settings: isFailed(settings) ? settings : settings.ok ? settings.value : null, can: access.can };
35}
36
37const REASONS = new Set(["false_positive", "used_in_tests", "revoked", "wont_fix"]);
38const BYPASS = new Set(["false_positive", "used_in_tests", "will_fix_later"]);
39
40export async function action({ params, context, request }: Route.ActionArgs) {
41 assertSameOrigin(request);
42 const user = requireUser(context, request);
43 const repo = { namespace: params.owner, name: params.repo };
44 const form = await request.formData();
45 const intent = String(form.get("intent") ?? "");
46 const id = params.id;
47 const comment = String(form.get("comment") ?? "")
48 .trim()
49 .slice(0, 500);
50 const refused = await refusal(context, params, "security_alerts");
51 if (refused) return { ok: false, error: refused };
52 if (intent === "dismiss") {
53 const reason = String(form.get("reason") ?? "");
54 if (!REASONS.has(reason)) return { ok: false, error: "Choose a reason." };
55 const done = await security.dismiss(user, repo, id, reason as DismissReason, comment);
56 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
57 }
58 if (intent === "reopen") {
59 const done = await security.reopen(user, repo, id);
60 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
61 }
62 if (intent === "bypass") {
63 const reason = String(form.get("reason") ?? "");
64 if (!BYPASS.has(reason)) return { ok: false, error: "Choose a reason." };
65 const done = await securitySuite.bypass(user, repo, id, reason as "false_positive", comment);
66 return done.ok ? { ok: true, requested: Boolean(done.value.request) } : { ok: false, error: done.error.message };
67 }
68 if (intent === "validity") {
69 const done = await securitySuite.checkValidity(user, repo, id);
70 return done.ok ? { ok: true } : { ok: false, error: done.error.message };
71 }
72 return { ok: false, error: "Unknown action." };
73}
74
75const VALIDITY: Record<string, { label: string; tone: "danger" | "neutral" | "info"; about: string }> = {
76 active: { label: "Active", tone: "danger", about: "Its issuer says it still works: rotate it." },
77 inactive: { label: "Inactive", tone: "neutral", about: "Its issuer refused it: revoked, expired or never real." },
78 unknown: { label: "Unknown", tone: "info", about: "Its issuer could not say, or it never landed and cannot be read again." },
79 unsupported: { label: "No check", tone: "neutral", about: "There is no safe way to ask this kind of secret's issuer." },
80};
81
82function ValidityCheck({ action, checkable, enabled }: { action: string; checkable: boolean; enabled: boolean }) {
83 const fetcher = useFetcher<{ ok: boolean; error?: string }>();
84 if (!checkable) return <p className="text-xs text-muted">This kind of secret has no safe check with its issuer.</p>;
85 if (!enabled) return <p className="text-xs text-muted">Validity checks are off for this workspace. An owner can turn them on in its Security settings.</p>;
86 return (
87 <span className="flex flex-col gap-1">
88 <Button
89 type="button"
90 disabled={fetcher.state !== "idle"}
91 onClick={() => fetcher.submit({ intent: "validity" }, { method: "post", action })}
92 variant="outline"
93 size="inline"
94 className="w-fit px-2.5 py-1 text-xs text-muted"
95 >
96 <RefreshCw size={12} className={fetcher.state !== "idle" ? "animate-spin" : ""} />
97 {fetcher.state !== "idle" ? "Asking…" : "Check with its issuer"}
98 </Button>
99 {fetcher.data?.error && <span className="text-xs text-danger">{fetcher.data.error}</span>}
100 </span>
101 );
102}
103
104export default function SecretAlert({ loaderData, params }: Route.ComponentProps) {
105 const { detail, settings, can } = loaderData;
106 const { secret } = detail;
107 const base = `/${params.owner}/${params.repo}`;
108 const action = `${base}/security/secret-scanning/${secret.id}`;
109 const landed = secret.status !== "blocked";
110 const validity = VALIDITY[secret.validity ?? "unknown"];
111 const pending = detail.requests.find((request) => request.state === "pending");
112 return (
113 <div className="max-w-4xl space-y-6">
114 <Link to={`${base}/security/secret-scanning`} className="inline-flex items-center gap-1.5 text-sm text-muted hover:text-fg">
115 <ArrowLeft size={14} /> Secret scanning
116 </Link>
117 <div className="flex flex-wrap items-start justify-between gap-4">
118 <div className="min-w-0">
119 <h2 className="text-xl font-semibold tracking-tight first-letter:uppercase">{secret.label}</h2>
120 <p className="mt-1 flex flex-wrap items-center gap-2 text-sm text-muted">
121 <Badge tone={secret.state === "open" ? (secret.status === "blocked" ? "warn" : "danger") : "neutral"}>
122 {secret.status === "blocked" ? "Blocked at a push" : secret.state === "open" ? "Open" : secret.state === "fixed" ? "Revoked" : "Dismissed"}
123 </Badge>
124 {secret.dismissedReason && <Badge>{dismissLabel(secret.dismissedReason)}</Badge>}
125 {secret.bypass && <Badge tone="warn">Bypassed</Badge>}
126 <span className="font-mono text-xs">{secret.preview}</span>
127 </p>
128 </div>
129 {can.manage_integrations && (
130 <div className="flex items-center gap-2">
131 {secret.state === "open" ? (
132 <DismissDialog
133 id={secret.id}
134 title={`Dismiss ${secret.label}`}
135 detail={`${secret.path}:${secret.line} · ${secret.preview}`}
136 reasons={SECRET_DISMISS_REASONS}
137 action={action}
138 />
139 ) : (
140 <ReopenButton id={secret.id} action={action} />
141 )}
142 </div>
143 )}
144 </div>
145
146 {secret.status === "blocked" && !secret.bypass && (detail.canBypass || detail.canRequestBypass) && (
147 <section className={`${CARD} p-4`}>
148 <h3 className="text-sm font-semibold">{detail.canRequestBypass ? "Ask to push it anyway" : "Push it anyway"}</h3>
149 <p className="mt-1 mb-3 text-sm text-muted">
150 {detail.canRequestBypass
151 ? "This workspace asks an owner or the repository's admins to approve each bypass. They are told in their notifications."
152 : "Take it out of the commit and push again if you can. If it has to go through, say why."}
153 </p>
154 {pending ? (
155 <p className="text-sm text-muted">
156 {pending.requester} asked <TimeAgo at={pending.createdAt} /> ({pending.reason.replaceAll("_", " ")}). Waiting for a review.
157 </p>
158 ) : (
159 <BypassForm id={secret.id} action={action} request={detail.canRequestBypass} />
160 )}
161 </section>
162 )}
163
164 <section className={`${CARD} grid gap-4 p-4 sm:grid-cols-2`}>
165 <div>
166 <h3 className="text-xs font-medium text-muted">Validity</h3>
167 <p className="mt-1 flex items-center gap-2 text-sm">
168 <Badge tone={validity.tone}>{validity.label}</Badge>
169 {secret.validityCheckedAt && (
170 <span className="text-xs text-faint">
171 asked <TimeAgo at={secret.validityCheckedAt} />
172 </span>
173 )}
174 </p>
175 <p className="mt-1 text-xs text-muted">{validity.about}</p>
176 <div className="mt-2">
177 {isFailed(settings) ? (
178 <Unavailable what={settings.what} compact />
179 ) : (
180 <ValidityCheck
181 action={action}
182 checkable={detail.checkable && landed}
183 enabled={Boolean(settings?.workspace.validityChecks && settings.entitled)}
184 />
185 )}
186 </div>
187 </div>
188 <div>
189 <h3 className="text-xs font-medium text-muted">Found</h3>
190 <p className="mt-1 text-sm">
191 {secret.source === "push" ? "In a push" : "In the history"}
192 {secret.foundBy && <> by {secret.foundBy}</>}, <TimeAgo at={secret.foundAt} />
193 </p>
194 {secret.bypass && (
195 <p className="mt-2 text-sm text-muted">
196 Bypassed by {secret.bypass.by} <TimeAgo at={secret.bypass.at} />: {secret.bypass.reason.replaceAll("_", " ")}
197 {secret.bypass.approvedBy && <>, approved by {secret.bypass.approvedBy}</>}
198 {secret.bypass.comment && <> · “{secret.bypass.comment}”</>}
199 </p>
200 )}
201 </div>
202 </section>
203
204 <section>
205 <h3 className="text-base font-semibold tracking-tight">Locations</h3>
206 <ul className={`${CARD} mt-2 divide-y divide-line`}>
207 {(detail.locations.length
208 ? detail.locations
209 : [{ path: secret.path, line: secret.line, commit: secret.commit, source: secret.source, foundAt: secret.foundAt }]
210 ).map((location) => (
211 <li key={`${location.commit}:${location.path}:${location.line}`} className="flex flex-wrap items-center gap-x-3 gap-y-1 px-4 py-2.5 text-sm">
212 {landed ? (
213 <Link to={`${base}/blob/${location.commit}/${location.path}#L${location.line}`} className="font-mono text-xs hover:underline">
214 {location.path}:{location.line}
215 </Link>
216 ) : (
217 <span className="font-mono text-xs">
218 {location.path}:{location.line}
219 </span>
220 )}
221 <span className="font-mono text-xs text-faint">{location.commit.slice(0, 7)}</span>
222 <span className="text-xs text-faint">{location.source === "push" ? "push" : "history"}</span>
223 </li>
224 ))}
225 </ul>
226 </section>
227
228 {(detail.activity.length > 0 || detail.requests.length > 0) && (
229 <section>
230 <h3 className="text-base font-semibold tracking-tight">Activity</h3>
231 <ul className="mt-2 space-y-1.5 text-sm text-muted">
232 {detail.requests.map((request) => (
233 <li key={request.id}>
234 {request.requester} asked to bypass ({request.reason.replaceAll("_", " ")}) <TimeAgo at={request.createdAt} />
235 {request.state !== "pending" && (
236 <>
237 {" "}
238 · {request.state}
239 {request.reviewer && <> by {request.reviewer}</>}
240 </>
241 )}
242 </li>
243 ))}
244 {detail.activity.map((entry) => (
245 <li key={entry.id}>
246 {entry.actor ?? "g1t"} {entry.action.replaceAll("_", " ")}
247 {entry.reason && <> ({dismissLabel(entry.reason)})</>}
248 {entry.comment && <> · “{entry.comment}”</>} <TimeAgo at={entry.at} />
249 </li>
250 ))}
251 </ul>
252 </section>
253 )}
254 </div>
255 );
256}