Skip to content

Commit 71faa0e

Browse files
Hubtrick-GitHubtrick-Git
committed
first code review
1 parent d94d473 commit 71faa0e

6 files changed

Lines changed: 33 additions & 33 deletions

File tree

‎cmd/devguard/api/api.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -682,7 +682,7 @@ func BuildRouter(db core.DB) *echo.Echo {
682682
licenseRiskRouter.GET("/:licenseRiskID/", licenseRiskController.Read)
683683
licenseRiskRouter.POST("/:licenseRiskID/", licenseRiskController.CreateEvent, neededScope([]string{"manage"}), projectScopedRBAC(core.ObjectAsset, core.ActionUpdate))
684684
licenseRiskRouter.POST("/:licenseRiskID/mitigate", licenseRiskController.Mitigate, neededScope([]string{"manage"}), projectScopedRBAC(core.ObjectAsset, core.ActionUpdate))
685-
685+
licenseRiskRouter.POST("/:licenseRiskID/finalLicenseDecision", licenseRiskController.MakeFinalLicenseDecision, neededScope([]string{"manage"}), projectScopedRBAC(core.ObjectAsset, core.ActionUpdate))
686686
routes := server.Routes()
687687
sort.Slice(routes, func(i, j int) bool {
688688
return routes[i].Path < routes[j].Path

‎internal/core/component/component_controller.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,16 @@ import (
55
)
66

77
type httpController struct {
8-
componentRepository core.ComponentRepository
9-
assetVersionRepository core.AssetVersionRepository
10-
licenseOverwriteRepository core.LicenseRiskRepository
8+
componentRepository core.ComponentRepository
9+
assetVersionRepository core.AssetVersionRepository
10+
licenseRiskRepository core.LicenseRiskRepository
1111
}
1212

1313
func NewHTTPController(componentRepository core.ComponentRepository, assetVersionRepository core.AssetVersionRepository, licenseOverwriteRepository core.LicenseRiskRepository) *httpController {
1414
return &httpController{
15-
componentRepository: componentRepository,
16-
assetVersionRepository: assetVersionRepository,
17-
licenseOverwriteRepository: licenseOverwriteRepository,
15+
componentRepository: componentRepository,
16+
assetVersionRepository: assetVersionRepository,
17+
licenseRiskRepository: licenseOverwriteRepository,
1818
}
1919
}
2020

@@ -74,7 +74,7 @@ func (httpController httpController) ListPaged(ctx core.Context) error {
7474
search := ctx.QueryParam("search")
7575
sort := core.GetSortQuery(ctx)
7676

77-
overwrittenLicense, err := httpController.licenseOverwriteRepository.GetAllOverwrittenLicensesForAssetVersion(assetVersion.AssetID, assetVersion.Name)
77+
overwrittenLicense, err := httpController.licenseRiskRepository.GetAllOverwrittenLicensesForAssetVersion(assetVersion.AssetID, assetVersion.Name)
7878
if err != nil {
7979
return err
8080
}

‎internal/core/component/component_service.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -178,27 +178,27 @@ func (s *service) GetAndSaveLicenseInformation(assetVersion models.AssetVersion,
178178
})
179179
}
180180

181-
// wait for all updatedComponents to be processed
182-
updatedComponents, err := errGroup.WaitAndCollect()
181+
// wait for all components to be processed
182+
components, err := errGroup.WaitAndCollect()
183183
if err != nil {
184184
return nil, err
185185
}
186186

187187
// save the components
188-
if err := s.componentRepository.SaveBatch(nil, updatedComponents); err != nil {
188+
if err := s.componentRepository.SaveBatch(nil, components); err != nil {
189189
return nil, err
190190
}
191191

192192
// find potential license risks for the components which had no prior license
193-
if len(updatedComponents) > 0 {
194-
err = s.licenseRiskService.FindLicenseRisksInComponents(assetVersion, updatedComponents, scannerID)
193+
if len(components) > 0 {
194+
err = s.licenseRiskService.FindLicenseRisksInComponents(assetVersion, components, scannerID)
195195
if err != nil {
196196
return nil, err
197197
}
198198
}
199199

200200
// now return all components - each one should have the best license information available
201-
allComponents := updatedComponents
201+
allComponents := components
202202
for _, componentDependency := range componentDependencies {
203203
allComponents = append(allComponents, componentDependency.Dependency)
204204
}

‎internal/core/integrations/githubint/github_integration.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ type GithubIntegration struct {
6767
assetRepository core.AssetRepository
6868
assetVersionRepository core.AssetVersionRepository
6969
componentRepository core.ComponentRepository
70+
licenseRiskRepository core.LicenseRiskRepository
7071

7172
orgRepository core.OrganizationRepository
7273
projectRepository core.ProjectRepository
@@ -87,6 +88,7 @@ func NewGithubIntegration(db core.DB) *GithubIntegration {
8788
projectRepository := repositories.NewProjectRepository(db)
8889
orgRepository := repositories.NewOrgRepository(db)
8990
firstPartyVulnRepository := repositories.NewFirstPartyVulnerabilityRepository(db)
91+
licenseRiskRepository := repositories.NewLicenseRiskRepository(db)
9092

9193
frontendURL := os.Getenv("FRONTEND_URL")
9294
if frontendURL == "" {
@@ -106,6 +108,7 @@ func NewGithubIntegration(db core.DB) *GithubIntegration {
106108
componentRepository: componentRepository,
107109
projectRepository: projectRepository,
108110
orgRepository: orgRepository,
111+
licenseRiskRepository: licenseRiskRepository,
109112

110113
githubClientFactory: func(repoID string) (githubClientFacade, error) {
111114
return NewGithubClient(installationIDFromRepositoryID(repoID))
@@ -574,6 +577,12 @@ func (githubIntegration *GithubIntegration) HandleEvent(event any) error {
574577
return err
575578
}
576579
vuln = &v
580+
case models.VulnTypeLicenseRisk:
581+
v, err := githubIntegration.licenseRiskRepository.Read(vulnID)
582+
if err != nil {
583+
return err
584+
}
585+
vuln = &v
577586
}
578587

579588
orgSlug, err := core.GetOrgSlug(event.Ctx)
@@ -604,6 +613,12 @@ func (githubIntegration *GithubIntegration) HandleEvent(event any) error {
604613
return err
605614
}
606615
vuln = &v
616+
case models.VulnTypeLicenseRisk:
617+
v, err := githubIntegration.licenseRiskRepository.Read(ev.VulnID)
618+
if err != nil {
619+
return err
620+
}
621+
vuln = &v
607622
}
608623

609624
if vuln.GetTicketID() == nil {

‎internal/database/models/vulnevent_model.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,6 @@ const (
3939

4040
EventTypeAddedScanner VulnEventType = "addedScanner"
4141
EventTypeRemovedScanner VulnEventType = "removedScanner"
42-
43-
EventTypeFinalLicenseDecision VulnEventType = "finalLicenseDecision"
4442
)
4543

4644
type MechanicalJustificationType string
@@ -150,8 +148,6 @@ func (event VulnEvent) Apply(vuln Vuln) {
150148
}
151149
vuln.SetRawRiskAssessment(f)
152150
vuln.SetRiskRecalculatedAt(time.Now())
153-
case EventTypeFinalLicenseDecision:
154-
vuln.SetState(VulnStateFixed)
155151
}
156152

157153
}
@@ -297,17 +293,6 @@ func NewRemovedScannerEvent(vulnID string, vulnType VulnType, userID string, sca
297293
return ev
298294
}
299295

300-
func NewFinalLicenseDecisionEvent(vulnID string, vulnType VulnType, userID string, scannerID string) VulnEvent {
301-
ev := VulnEvent{
302-
Type: EventTypeFinalLicenseDecision,
303-
VulnID: vulnID,
304-
VulnType: vulnType,
305-
UserID: userID,
306-
}
307-
ev.SetArbitraryJSONData(map[string]any{"scannerIds": scannerID})
308-
return ev
309-
}
310-
311296
func (event VulnEvent) IsScanUnreleatedEvent() bool {
312297
switch event.Type {
313298
case EventTypeAddedScanner, EventTypeRemovedScanner, EventTypeDetectedOnAnotherBranch, EventTypeRawRiskAssessmentUpdated:

‎internal/database/repositories/component_repository.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -179,22 +179,22 @@ func (c *componentRepository) GetLicenseDistribution(tx core.DB, assetVersionNam
179179
RIGHT JOIN component_dependencies as cd
180180
ON c.purl = cd.dependency_purl
181181
WHERE EXISTS
182-
(SELECT final_license_decision FROM license_risks as lr WHERE lr.component_purl = c.purl)
182+
(SELECT final_license_decision FROM license_risks as lr WHERE lr.component_purl = c.purl AND lr.state = ?)
183183
AND asset_version_name = ?
184184
AND asset_id = ?
185185
GROUP BY c.license`,
186-
assetVersionName, assetID)
186+
models.VulnStateFixed, assetVersionName, assetID)
187187
//Components WITHOUT an overwrite
188188
otherLicensesQuery := c.GetDB(tx).Raw(`SELECT c.license , COUNT(c.license) as count
189189
FROM components as c
190190
RIGHT JOIN component_dependencies as cd
191191
ON c.purl = cd.dependency_purl
192192
WHERE NOT EXISTS
193-
(SELECT final_license_decision FROM license_risks as lr WHERE lr.component_purl = c.purl)
193+
(SELECT final_license_decision FROM license_risks as lr WHERE lr.component_purl = c.purl AND lr.state = ?)
194194
AND asset_version_name = ?
195195
AND asset_id = ?
196196
GROUP BY c.license`,
197-
assetVersionName, assetID)
197+
models.VulnStateFixed, assetVersionName, assetID)
198198

199199
//We then still need to filter for the right scanner
200200
if scannerID != "" {

0 commit comments

Comments
 (0)