[dev] [carhartlewis] lewis/aikido-integration (#1942)

* feat(aikido): add Aikido security integration with vulnerability checks

* feat(aikido): enhance OAuth and variable controllers with improved error handling and logging

* feat(aikido): improve repository fetching and error handling in checks

* fix(aikido): improve error handling for code repository scanning

* fix(aikido): improve error handling for code repository scanning

* fix(aikido): enhance error handling and update fetch logic for repositories

* fix(aikido): update OAuth client credential handling and improve error logging

---------

Co-authored-by: Lewis Carhart <lewis@trycomp.ai>
Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>

Author: 3 people

apps/api/src/integration-platform/controllers/oauth.controller.ts

@@ -403,6 +403,8 @@ export class OAuthController {
     };
 
     // Add client credentials based on auth method
+    // Per OAuth 2.0 RFC 6749 Section 2.3.1, when using HTTP Basic auth (header),
+    // client credentials should NOT be included in the request body
     if (config.clientAuthMethod === 'header') {
       const creds = Buffer.from(
         `${credentials.clientId}:${credentials.clientSecret}`,
@@ -422,8 +424,10 @@ export class OAuthController {
     });
 
     if (!response.ok) {
-      await response.text(); // consume body
-      this.logger.error(`Token exchange failed: ${response.status}`);
+      const errorBody = await response.text();
+      this.logger.error(
+        `Token exchange failed: ${response.status} - ${errorBody}`,
+      );
       throw new Error(`Token exchange failed: ${response.status}`);
     }
 

apps/api/src/integration-platform/controllers/variables.controller.ts

@@ -248,11 +248,18 @@ export class VariablesController {
 
       fetch: async <T = unknown>(path: string): Promise<T> => {
         const url = new URL(path, baseUrl);
+
         const response = await fetch(url.toString(), {
           headers: buildHeaders(),
         });
-        if (!response.ok) throw new Error(`HTTP ${response.status}`);
-        return response.json();
+
+        if (!response.ok) {
+          const errorText = await response.text();
+          throw new Error(`HTTP ${response.status}: ${errorText}`);
+        }
+
+        const data = await response.json();
+        return data as T;
       },
 
       fetchAllPages: async <T = unknown>(path: string): Promise<T[]> => {
@@ -268,10 +275,30 @@ export class VariablesController {
           const response = await fetch(url.toString(), {
             headers: buildHeaders(),
           });
-          if (!response.ok) throw new Error(`HTTP ${response.status}`);
 
-          const items: T[] = await response.json();
-          if (!Array.isArray(items) || items.length === 0) break;
+          if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`HTTP ${response.status}: ${errorText}`);
+          }
+
+          const data = await response.json();
+
+          // Handle both direct array responses and wrapped responses
+          // e.g., some APIs return { items: [...] } instead of [...]
+          let items: T[];
+          if (Array.isArray(data)) {
+            items = data;
+          } else if (data && typeof data === 'object') {
+            // Find the first array property in the response
+            const arrayValue = Object.values(data).find((v) =>
+              Array.isArray(v),
+            ) as T[] | undefined;
+            items = arrayValue ?? [];
+          } else {
+            items = [];
+          }
+
+          if (items.length === 0) break;
 
           allItems.push(...items);
           if (items.length < perPage) break;

apps/api/src/integration-platform/services/credential-vault.service.ts

@@ -304,6 +304,8 @@ export class CredentialVaultService {
       };
 
       // Add client credentials based on auth method
+      // Per OAuth 2.0 RFC 6749 Section 2.3.1, when using HTTP Basic auth (header),
+      // client credentials should NOT be included in the request body
       if (config.clientAuthMethod === 'header') {
         const credentials = Buffer.from(
           `${config.clientId}:${config.clientSecret}`,

packages/integration-platform/src/manifests/aikido/checks/code-repository-scanning.ts

@@ -0,0 +1,194 @@
+/**
+ * Code Repository Scanning Check
+ *
+ * Verifies that all code repositories are actively being scanned by Aikido.
+ * Ensures continuous security monitoring of the codebase.
+ */
+
+import { TASK_TEMPLATES } from '../../../task-mappings';
+import type { IntegrationCheck } from '../../../types';
+import type { AikidoCodeRepositoriesResponse, AikidoCodeRepository } from '../types';
+import { targetRepositoriesVariable } from '../variables';
+
+const SCAN_STALE_DAYS = 7; // Consider a scan stale after 7 days
+
+/**
+ * Check if a scan is stale based on unix timestamp or ISO string
+ */
+const isStale = (lastScannedAt: number | string | undefined): boolean => {
+  if (!lastScannedAt) return true;
+
+  // Handle both unix timestamp (number) and ISO string
+  const lastScanMs =
+    typeof lastScannedAt === 'number' ? lastScannedAt * 1000 : new Date(lastScannedAt).getTime();
+
+  const diffDays = (Date.now() - lastScanMs) / (1000 * 60 * 60 * 24);
+  return diffDays > SCAN_STALE_DAYS;
+};
+
+export const codeRepositoryScanningCheck: IntegrationCheck = {
+  id: 'code_repository_scanning',
+  name: 'Code Repositories Actively Scanned',
+  description: 'Verify that all code repositories are being actively scanned for vulnerabilities',
+  taskMapping: TASK_TEMPLATES.secureCode,
+  defaultSeverity: 'medium',
+
+  variables: [targetRepositoriesVariable],
+
+  run: async (ctx) => {
+    const targetRepoIds = ctx.variables.target_repositories as string[] | undefined;
+
+    ctx.log('Fetching code repositories from Aikido');
+
+    // Aikido API: https://apidocs.aikido.dev/reference/listcoderepos
+    // Note: The API returns a direct array without pagination support
+    // Adding page/per_page params causes empty response
+    const response = await ctx.fetch<AikidoCodeRepositoriesResponse | AikidoCodeRepository[]>(
+      'repositories/code',
+    );
+
+    // Handle both array response and wrapped response formats
+    const allRepos = Array.isArray(response) ? response : (response?.repositories ?? []);
+
+    ctx.log(`Found ${allRepos.length} code repositories`);
+
+    // Filter to target repos if specified
+    let repos = allRepos;
+    if (targetRepoIds && targetRepoIds.length > 0) {
+      repos = allRepos.filter((repo) => targetRepoIds.includes(String(repo.id)));
+      ctx.log(`Filtered to ${repos.length} target repositories`);
+    }
+
+    if (repos.length === 0) {
+      // Differentiate between no repos connected vs filter mismatch
+      if (targetRepoIds && targetRepoIds.length > 0 && allRepos.length > 0) {
+        // Repositories exist but none match the target_repositories filter
+        ctx.fail({
+          title: 'No matching repositories found',
+          description: `None of the ${targetRepoIds.length} specified target repository IDs match the ${allRepos.length} connected repositories. This may be due to typos, disconnected repositories, or incorrect IDs in the target_repositories configuration.`,
+          resourceType: 'workspace',
+          resourceId: 'aikido-repos',
+          severity: 'high',
+          remediation: `1. Verify the repository IDs in your target_repositories configuration
+2. Go to Aikido > Repositories to find correct repository IDs
+3. Check if the target repositories are still connected
+4. Update the target_repositories variable with valid IDs
+5. Or remove target_repositories to scan all connected repositories`,
+          evidence: {
+            target_repository_ids: targetRepoIds,
+            connected_repository_count: allRepos.length,
+            connected_repository_ids: allRepos.map((r) => String(r.id)),
+            checked_at: new Date().toISOString(),
+          },
+        });
+      } else {
+        // No repositories connected at all
+        ctx.fail({
+          title: 'No code repositories connected',
+          description:
+            'No code repositories are connected to Aikido. Connect your repositories to enable security scanning.',
+          resourceType: 'workspace',
+          resourceId: 'aikido-repos',
+          severity: 'high',
+          remediation: `1. Go to Aikido > Repositories
+2. Click "Add Repository" or connect your source control provider
+3. Select the repositories you want to scan
+4. Enable scanning for each repository`,
+          evidence: {
+            total_repos: 0,
+            checked_at: new Date().toISOString(),
+          },
+        });
+      }
+      return;
+    }
+
+    for (const repo of repos) {
+      // Use actual API field names: 'active', 'last_scanned_at', 'name'
+      const stale = isStale(repo.last_scanned_at ?? repo.last_scan_at);
+      const inactive = !(repo.active ?? repo.is_active);
+      const failed = repo.scan_status === 'failed';
+      const repoName = repo.name || repo.full_name || String(repo.id);
+
+      if (inactive) {
+        ctx.fail({
+          title: `Repository not active: ${repoName}`,
+          description: `The repository ${repoName} is not activated for scanning in Aikido.`,
+          resourceType: 'repository',
+          resourceId: String(repo.id),
+          severity: 'medium',
+          remediation: `1. Go to Aikido > Repositories
+2. Find ${repoName}
+3. Click "Activate" to enable scanning`,
+          evidence: {
+            repo_id: repo.id,
+            name: repoName,
+            provider: repo.provider,
+            active: repo.active ?? repo.is_active,
+          },
+        });
+      } else if (failed) {
+        ctx.fail({
+          title: `Scan failed: ${repoName}`,
+          description: `The last scan for ${repoName} failed.`,
+          resourceType: 'repository',
+          resourceId: String(repo.id),
+          severity: 'high',
+          remediation: `1. Go to Aikido > Repositories > ${repoName}
+2. Check scan logs for error details
+3. Verify repository access and permissions
+4. Retry the scan`,
+          evidence: {
+            repo_id: repo.id,
+            name: repoName,
+            provider: repo.provider,
+            scan_status: repo.scan_status,
+            last_scanned_at: repo.last_scanned_at,
+          },
+        });
+      } else if (stale) {
+        const lastScanMs = repo.last_scanned_at
+          ? repo.last_scanned_at * 1000
+          : repo.last_scan_at
+            ? new Date(repo.last_scan_at).getTime()
+            : null;
+        const daysSinceScan = lastScanMs
+          ? Math.floor((Date.now() - lastScanMs) / (1000 * 60 * 60 * 24))
+          : 'never';
+
+        ctx.fail({
+          title: `Stale scan: ${repoName}`,
+          description: `Repository ${repoName} hasn't been scanned in over ${SCAN_STALE_DAYS} days.`,
+          resourceType: 'repository',
+          resourceId: String(repo.id),
+          severity: 'low',
+          remediation: `1. Go to Aikido > Repositories > ${repoName}
+2. Click "Scan now" to trigger a new scan
+3. Verify webhook integration for automatic scanning`,
+          evidence: {
+            repo_id: repo.id,
+            name: repoName,
+            provider: repo.provider,
+            last_scanned_at: repo.last_scanned_at,
+            days_since_scan: daysSinceScan,
+          },
+        });
+      } else {
+        ctx.pass({
+          title: `Repository actively scanned: ${repoName}`,
+          description: `Repository ${repoName} is active and has been scanned recently.`,
+          resourceType: 'repository',
+          resourceId: String(repo.id),
+          evidence: {
+            repo_id: repo.id,
+            name: repoName,
+            provider: repo.provider,
+            active: repo.active ?? repo.is_active,
+            last_scanned_at: repo.last_scanned_at,
+            checked_at: new Date().toISOString(),
+          },
+        });
+      }
+    }
+  },
+};

packages/integration-platform/src/manifests/aikido/checks/index.ts

@@ -0,0 +1,9 @@
+/**
+ * Aikido Integration Checks
+ *
+ * Export all checks for use in the manifest.
+ */
+
+export { codeRepositoryScanningCheck } from './code-repository-scanning';
+export { issueCountThresholdCheck } from './issue-count-threshold';
+export { openSecurityIssuesCheck } from './open-security-issues';