feat: comprehensive audit + Tier 3 wiring (security/correctness/features)

Multi-agent audit + fix pass covering bugs, security, dead config wiring, and missing features. All quality gates green: build/vet/test -race/govulncheck/ golangci-lint. Frontend tests 47/47. SECURITY & CORRECTNESS - Scanner pipeline fail-closed: cache.go scan timeout now 503 (was goto servePkg); scanner.go all-scanners-fail saves ScanStatusError; CheckVulnerabilities blocks on missing/error result instead of allowing. - Scanner argv corrections: govulncheck source-mode + go.mod discovery; npm-audit generates lockfile via npm install --package-lock-only --ignore-scripts; pip-audit per-extension dispatch (wheel direct / sdist extract+pyproject). - GHSA version-range filtering implemented (was always-include); url.QueryEscape on package name. - pypi SSRF closed via host allowlist on original_url; url.QueryEscape on rewriteURL output. - Path traversal: cache temp file uses os.CreateTemp; smb keyToPath sanitized; filesystem keyToPath returns error + filepath.Abs prefix-verify. - Goroutine leaks plugged: cache.cleanupWorker stop channel; auth.ValidationCache Stop() with sync.Once; ws.unregister buffered with non-blocking send. - WebSocket double-close panic fixed via sync.Once Client.closeSend(). - Race conditions: gormstore.registryCache sync.RWMutex (was concurrent map panic); auth.LastUsedAt no longer mutated under RLock; analytics strict lock-ordering invariant (statsMu before downloadsMu). - Auth validator fails CLOSED on transport/unknown-status errors (was returning true,err 'allow cache fallback'). - Credential cache hash full SHA256 (was 8-byte truncate; eliminates 2^32 collision risk). - filesystem.fs.used incremented after successful rename (no quota inflation race). - gormstore aggregation events deleted in same tx as insert (no double-counting). - gormstore.SavePackage uses Updates(map) so zero-value security flags (RequiresAuth=false) can be cleared. - partition_manager validates partition name regex before DROP TABLE. - vcs/git: version regex validation rejects --option-injection; checkout uses --detach -- separator; removed TrimPrefix(repo,'v') that corrupted vault/ vitess/vim-go. - WebSocket CheckOrigin allowlist (was return true; CSWSH closed); same-origin default + ServerConfig.AllowedOrigins. - fiber CVE GO-2026-4543 patched (v2.52.10 -> v2.52.12). FUNCTIONAL FEATURES - API key DB persistence: APIKeyModel + migration 202604280002, full CRUD, async LastUsedAt updates with WaitGroup-tracked goroutines drained on Close. - Admin bootstrap via GOHOARDER_BOOTSTRAP_ADMIN_KEY env var; idempotent (skipped when non-revoked admin already exists). - Auth middleware factory in pkg/app: RequireAuth, RequireRole, RequirePermission, OptionalAuth. Mounted on proxy + read APIs when Auth.Enabled=true. DELETE /api/packages/* requires admin role. /health public for k8s probes. - NFS storage backend: pkg/storage/nfs wraps filesystem with /proc/mounts detection (Linux), post-write fsync, read-after-write health probe. - WebSocket real-time pipeline: pkg/events Broadcaster interface; cache + scanner managers emit EventPackageCached / EventPackageDownloaded / EventScanComplete; app.go runs 30s EventStatsUpdate ticker. Frontend has full WS client (reconnect with exponential backoff 1s->30s, 25s heartbeat, subscriber pattern), Pinia realtime store, Dashboard live indicator + activity feed + reactive stats override. - TLS termination: fiber.ListenTLS when Server.TLS.Enabled. - Pre-warming: Prewarming.Enabled flag wired (was hardcoded false); Interval, MaxConcurrent, TopPackages plumbed. - NetworkConfig wired (timeouts, retry, rate-limit, circuit-breaker). - AuthConfig.BcryptCost wired. - Security.Scanners.Static.MaxPackageSize plumbed to cache.io.LimitReader. - Handlers.{Go,NPM,PyPI}.Enabled gates route mounting. - Graceful shutdown: authManager.Close drains async writes. LINT/HYGIENE - 80 golangci-lint issues resolved: errcheck (Close/Write/RemoveAll wrapped), gofmt, gosec G104/G306, govet shadow renames + fieldalignment reorders, staticcheck ST1000 pkg comments + QF1003 tagged switches + QF1008 embedded field selectors + QF1001 De Morgan's law. BEHAVIOR CHANGES - Scanner now fail-closed: deployments without scanner binaries (trivy/govulncheck/npm-audit/pip-audit/grype) BLOCK packages instead of serving unscanned. Add binaries or plan a future allow-on-scan-error flag. - WS origin defaults to same-origin; cross-origin dashboards must set server.allowed_origins. - Validator no longer fails open; private packages won't serve from cache when validation can't be performed. - download_events retention dropped from 24h to ~5min (deleted in agg tx). Migration 202604280001 purges pre-upgrade events. - DELETE /api/packages/* requires admin role when auth enabled. NEW PACKAGES - pkg/events - Broadcaster interface - pkg/storage/nfs - NFS-aware filesystem wrapper DEFERRED (out of scope this pass) - Static scanner implementation (config defines AllowedLicenses/MaxPackageSize/ BlockSuspicious but pkg/scanner/static/ does not exist). - AuthConfig.AuditLog wiring (no audit log infra yet). - CacheConfig.TTLOverrides passthrough (would touch cache.Config beyond integrator scope).
2026-10-14 00:57:40 +00:00 · 2026-07-10 09:37:55 +01:00
parent 3c8b3eb46c
commit e39d6a0f0d
80 changed files with 6383 additions and 661 deletions
@@ -3,10 +3,12 @@ import { mount } from '@vue/test-utils'
 import { createPinia, setActivePinia } from 'pinia'
 import Dashboard from './Dashboard.vue'
 import { usePackageStore } from '../stores/packages'
+import { useRealtimeStore, __resetRealtimeSingleton } from '../stores/realtime'

 describe('Dashboard.vue', () => {
  beforeEach(() => {
    setActivePinia(createPinia())
+    __resetRealtimeSingleton()
    // Mock the fetch functions to prevent actual API calls
    const store = usePackageStore()
    vi.spyOn(store, 'fetchStats').mockResolvedValue()
@@ -213,4 +215,33 @@ describe('Dashboard.vue', () => {
    expect(wrapper.text()).toContain('0')
    expect(wrapper.text()).toContain('0 B')
  })
+
+  it('renders realtime lastStats over polled stats when present', async () => {
+    const wrapper = mount(Dashboard)
+    const store = usePackageStore()
+    const rt = useRealtimeStore()
+
+    store.loading = false
+    store.stats = {
+      registry: '',
+      total_packages: 10,
+      total_size: 1024,
+      max_cache_size: 10737418240,
+      total_downloads: 5,
+      scanned_packages: 0,
+      vulnerable_packages: 0,
+      blocked_packages: 0,
+    }
+    rt.lastStats = {
+      total_packages: 999,
+      total_size: 2048,
+      total_downloads: 777,
+      scanned_packages: 0,
+    }
+    await wrapper.vm.$nextTick()
+
+    // Realtime values should be visible (override polled values).
+    expect(wrapper.text()).toContain('999')
+    expect(wrapper.text()).toContain('777')
+  })
 })
@@ -1,6 +1,23 @@
 <template>
  <div>
-    <h2 class="text-3xl font-bold text-gray-900 mb-8">Dashboard</h2>
+    <div class="flex items-center justify-between mb-8">
+      <h2 class="text-3xl font-bold text-gray-900">Dashboard</h2>
+      <div
+        class="flex items-center gap-2 px-3 py-1 rounded-full border text-xs font-medium"
+        :class="
+          rt.connected
+            ? 'bg-emerald-50 border-emerald-200 text-emerald-700'
+            : 'bg-gray-100 border-gray-200 text-gray-500'
+        "
+        data-testid="ws-live-indicator"
+      >
+        <span
+          class="w-2 h-2 rounded-full"
+          :class="rt.connected ? 'bg-emerald-500 animate-pulse' : 'bg-gray-400'"
+        ></span>
+        {{ rt.connected ? 'Live' : 'Offline' }}
+      </div>
+    </div>

    <!-- Error Alert -->
    <Alert v-if="error" variant="destructive" class="mb-4">
@@ -22,7 +39,7 @@
            <div class="space-y-2">
              <p class="text-sm font-medium text-muted-foreground">Total Packages</p>
              <p class="text-3xl font-bold text-foreground tracking-tight">
-                {{ formatNumber(stats?.total_packages || 0) }}
+                {{ formatNumber(displayStats?.total_packages || 0) }}
              </p>
            </div>
            <div class="w-12 h-12 bg-slate-100 rounded-xl flex items-center justify-center">
@@ -38,7 +55,7 @@
            <div class="space-y-2">
              <p class="text-sm font-medium text-muted-foreground">Total Size</p>
              <p class="text-3xl font-bold text-foreground tracking-tight">
-                {{ formatBytes(stats?.total_size || 0) }}
+                {{ formatBytes(displayStats?.total_size || 0) }}
              </p>
            </div>
            <div class="w-12 h-12 bg-sky-50 rounded-xl flex items-center justify-center">
@@ -54,7 +71,7 @@
            <div class="space-y-2">
              <p class="text-sm font-medium text-muted-foreground">Total Downloads</p>
              <p class="text-3xl font-bold text-foreground tracking-tight">
-                {{ formatNumber(stats?.total_downloads || 0) }}
+                {{ formatNumber(displayStats?.total_downloads || 0) }}
              </p>
            </div>
            <div class="w-12 h-12 bg-emerald-50 rounded-xl flex items-center justify-center">
@@ -70,7 +87,7 @@
            <div class="space-y-2">
              <p class="text-sm font-medium text-muted-foreground">Scanned Packages</p>
              <p class="text-3xl font-bold text-foreground tracking-tight">
-                {{ formatNumber(stats?.scanned_packages || 0) }}
+                {{ formatNumber(displayStats?.scanned_packages || 0) }}
              </p>
            </div>
            <div class="w-12 h-12 bg-violet-50 rounded-xl flex items-center justify-center">
@@ -81,6 +98,31 @@
      </Card>
    </div>

+    <!-- Realtime Feed -->
+    <Card v-if="recentRealtimeEvents.length > 0" class="border-0 shadow-lg mb-10" data-testid="ws-event-feed">
+      <CardContent class="p-6">
+        <h3 class="text-xl font-semibold text-foreground mb-4">
+          <i class="fas fa-bolt mr-2 text-amber-500"></i>Live Activity
+        </h3>
+        <ul class="space-y-2">
+          <li
+            v-for="(evt, idx) in recentRealtimeEvents"
+            :key="`${evt.timestamp}-${idx}`"
+            class="flex items-center gap-3 text-sm"
+          >
+            <component :is="iconForEvent(evt.type)" class="w-4 h-4 text-muted-foreground" />
+            <span class="font-medium">{{ labelForEvent(evt.type) }}</span>
+            <span class="text-muted-foreground truncate">
+              {{ describeEvent(evt) }}
+            </span>
+            <span class="ml-auto text-xs text-muted-foreground">
+              {{ formatTimestamp(evt.timestamp) }}
+            </span>
+          </li>
+        </ul>
+      </CardContent>
+    </Card>
+
    <!-- Downloads Chart -->
    <Card class="border-0 shadow-lg mb-10">
      <CardContent class="p-6">
@@ -178,10 +220,19 @@
 </template>

 <script setup lang="ts">
-import { computed, onMounted, ref, watch } from 'vue'
+import { computed, onMounted, ref, watch, type Component } from 'vue'
 import { storeToRefs } from 'pinia'
 import axios from 'axios'
+import {
+  Package as PackageIcon,
+  Download as DownloadIcon,
+  Trash2 as TrashIcon,
+  ShieldCheck as ShieldIcon,
+  Activity as ActivityIcon,
+} from 'lucide-vue-next'
 import { usePackageStore } from '../stores/packages'
+import { useRealtimeStore } from '../stores/realtime'
+import type { EventType, RealtimeEvent } from '@/lib/ws'
 import { Alert, AlertDescription } from '@/components/ui/alert'
 import { Card, CardContent } from '@/components/ui/card'
 import { Badge } from '@/components/ui/badge'
@@ -191,6 +242,56 @@ import { getRegistryBadgeClass } from '@/composables/useBadgeStyles'
 const store = usePackageStore()
 const { packages, stats, loading, error } = storeToRefs(store)

+const rt = useRealtimeStore()
+const { lastStats, events: rtEvents } = storeToRefs(rt)
+
+// Realtime stats override polled stats when available; otherwise fall back.
+const displayStats = computed(() => lastStats.value ?? stats.value)
+
+const recentRealtimeEvents = computed<RealtimeEvent[]>(() => {
+  const list = rtEvents.value
+  return list.slice(Math.max(list.length - 5, 0)).reverse()
+})
+
+const EVENT_LABELS: Record<EventType, string> = {
+  package_cached: 'Cached',
+  package_deleted: 'Deleted',
+  package_downloaded: 'Downloaded',
+  scan_complete: 'Scan complete',
+  stats_update: 'Stats update',
+}
+
+const EVENT_ICONS: Record<EventType, Component> = {
+  package_cached: PackageIcon,
+  package_deleted: TrashIcon,
+  package_downloaded: DownloadIcon,
+  scan_complete: ShieldIcon,
+  stats_update: ActivityIcon,
+}
+
+function iconForEvent(type: EventType): Component {
+  return EVENT_ICONS[type] ?? ActivityIcon
+}
+
+function labelForEvent(type: EventType): string {
+  return EVENT_LABELS[type] ?? type
+}
+
+function describeEvent(evt: RealtimeEvent): string {
+  const p = evt.payload
+  const name = typeof p.name === 'string' ? p.name : ''
+  const version = typeof p.version === 'string' ? `@${p.version}` : ''
+  const registry = typeof p.registry === 'string' ? `[${p.registry}] ` : ''
+  if (evt.type === 'stats_update') return ''
+  if (name) return `${registry}${name}${version}`
+  return ''
+}
+
+function formatTimestamp(ts: number): string {
+  if (!ts) return ''
+  return new Date(ts).toLocaleTimeString()
+}
+
 // Chart periods and data
 const selectedPeriod = ref<string>('1day')
 const chartPeriods = [
@@ -286,6 +387,10 @@ watch(selectedPeriod, () => {
 })

 onMounted(async () => {
+  // Connect to realtime stream first so we can pick up live events while
+  // initial polling resolves. Singleton survives navigation, so we
+  // intentionally do not disconnect on unmount.
+  rt.connect()
  await store.fetchStats()
  await store.fetchPackages()
  await fetchTimeSeriesData()
@@ -1,22 +1,56 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
 import { mount } from '@vue/test-utils'
 import { createPinia, setActivePinia } from 'pinia'
+import { createRouter, createMemoryHistory, type Router } from 'vue-router'
+import { defineComponent, h } from 'vue'
 import PackageList from './PackageList.vue'
 import { usePackageStore } from '../stores/packages'

+const Stub = defineComponent({ render: () => h('div') })
+
+function createTestRouter(): Router {
+  return createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      { path: '/', name: 'dashboard', component: Stub },
+      { path: '/packages/:registry?', name: 'packages', component: Stub, props: true },
+      {
+        path: '/package/:registry/:name+/:version',
+        name: 'package-details',
+        component: Stub,
+        props: true,
+      },
+    ],
+  })
+}
+
+async function mountWithRouter() {
+  const router = createTestRouter()
+  router.push('/packages')
+  await router.isReady()
+  return mount(PackageList, {
+    global: {
+      plugins: [router],
+    },
+  })
+}
+
 describe('PackageList.vue', () => {
  beforeEach(() => {
    // Create a fresh pinia instance before each test
    setActivePinia(createPinia())
+    // Prevent real network calls from store actions on mount
+    const store = usePackageStore()
+    vi.spyOn(store, 'fetchPackages').mockResolvedValue()
  })

-  it('renders package list component', () => {
-    const wrapper = mount(PackageList)
+  it('renders package list component', async () => {
+    const wrapper = await mountWithRouter()
    expect(wrapper.find('h2').text()).toBe('Packages')
  })

  it('displays loading state when loading', async () => {
-    const wrapper = mount(PackageList)
+    const wrapper = await mountWithRouter()
    const store = usePackageStore()

    store.loading = true
@@ -26,7 +60,7 @@ describe('PackageList.vue', () => {
  })

  it('displays error message when error occurs', async () => {
-    const wrapper = mount(PackageList)
+    const wrapper = await mountWithRouter()
    const store = usePackageStore()

    store.error = 'Failed to fetch packages'
@@ -36,7 +70,7 @@ describe('PackageList.vue', () => {
  })

  it('displays empty state when no packages', async () => {
-    const wrapper = mount(PackageList)
+    const wrapper = await mountWithRouter()
    const store = usePackageStore()

    store.loading = false
@@ -47,7 +81,7 @@ describe('PackageList.vue', () => {
  })

  it('displays package accordion when packages exist', async () => {
-    const wrapper = mount(PackageList)
+    const wrapper = await mountWithRouter()
    const store = usePackageStore()

    store.loading = false
@@ -69,17 +103,19 @@ describe('PackageList.vue', () => {
    expect(wrapper.text()).toContain('1 version')
  })

-  it('calls fetchPackages on mount', () => {
+  it('calls fetchPackages on mount', async () => {
    const store = usePackageStore()
-    const fetchSpy = vi.spyOn(store, 'fetchPackages')
+    // beforeEach already spied with mockResolvedValue; reuse that spy
+    const fetchSpy = store.fetchPackages as ReturnType<typeof vi.spyOn>
+    fetchSpy.mockClear()

-    mount(PackageList)
+    await mountWithRouter()

    expect(fetchSpy).toHaveBeenCalled()
  })

  it('groups packages and displays version counts', async () => {
-    const wrapper = mount(PackageList)
+    const wrapper = await mountWithRouter()
    const store = usePackageStore()

    store.loading = false
@@ -112,7 +148,7 @@ describe('PackageList.vue', () => {
  })

  it('formats bytes correctly', async () => {
-    const wrapper = mount(PackageList)
+    const wrapper = await mountWithRouter()
    const store = usePackageStore()

    store.loading = false
@@ -134,7 +170,7 @@ describe('PackageList.vue', () => {
  })

  it('applies correct registry badge classes', async () => {
-    const wrapper = mount(PackageList)
+    const wrapper = await mountWithRouter()
    const store = usePackageStore()

    store.loading = false
@@ -179,9 +215,10 @@ describe('PackageList.vue', () => {
    expect(wrapper.text()).toContain('go')

    // Verify badge component is used with correct classes
+    // (matches getRegistryBadgeClass in src/composables/useBadgeStyles.ts)
    const html = wrapper.html()
-    expect(html).toContain('bg-blue-100') // npm badge
-    expect(html).toContain('bg-green-100') // pypi badge
-    expect(html).toContain('bg-yellow-100') // go badge
+    expect(html).toContain('bg-red-100') // npm badge
+    expect(html).toContain('bg-blue-100') // pypi badge
+    expect(html).toContain('bg-cyan-100') // go badge
  })
 })
@@ -172,7 +172,10 @@ describe('Stats.vue', () => {
    }
    await wrapper.vm.$nextTick()

-    const containers = wrapper.findAll('.rounded-full')
+    // Scope to the registry icon containers (w-12 h-12 rounded-full),
+    // excluding the storage progress bar which also uses rounded-full.
+    const containers = wrapper.findAll('.w-12.h-12.rounded-full')
+    expect(containers).toHaveLength(3)
    expect(containers[0].classes()).toContain('bg-red-100') // npm
    expect(containers[1].classes()).toContain('bg-blue-100') // pypi
    expect(containers[2].classes()).toContain('bg-cyan-100') // go