package services import javax.inject.Inject import com.google.inject.name.Named import com.ysoft.odc.{Absolutizer, AtlassianAuthentication, SetDiff} import controllers.{ReportInfo, Vulnerability, friendlyProjectNameString, routes} import models.{ExportedVulnerability, StandardVulnerabilityOverview, VulnerabilityOverview} import play.api.Logger import play.api.libs.json.Json.JsValueWrapper import play.api.libs.json._ import play.api.libs.json.Json.obj import play.api.libs.ws.{WS, WSClient, WSResponse} import services.JiraIssueTrackerService.Fields import scala.concurrent.{ExecutionContext, Future} private case class JiraNewIssueResponse(id: String, key: String, self: String) private case class Transition(id: String/* heh, id is a numeric String */, name: String/*to: …*/) private case class Transitions(expand: String, transitions: Seq[Transition]) object JiraIssueTrackerService { final case class Fields( cweId: Option[String], linkId: Option[String], severityId: Option[String], projectsId: Option[String], /* teamsId: Option[String], librariesId: Option[String], */ constantFields: Option[JsObject] ) val NoFields = Fields(cweId = None, linkId = None, severityId = None, projectsId = None, constantFields = None) } /** * status: WIP * It basically works, but there is much to be discussed and implemented. */ class JiraIssueTrackerService @Inject()(absolutizer: Absolutizer, @Named("jira-server") server: String, noRelevantProjectAffectedTransitionNameOption: Option[String], newProjectAddedTransitionNameOption: Option[String], fields: Fields, @Named("jira-project-id") projectId: Int, @Named("jira-vulnerability-issue-type") vulnerabilityIssueType: Int, ticketFormatVersion: Int, @Named("jira-authentication") atlassianAuthentication: AtlassianAuthentication)(implicit executionContext: ExecutionContext, wSClient: WSClient) extends IssueTrackerService{ private def jiraUrl(url: String) = atlassianAuthentication.addAuth(WS.clientUrl(url)) private def api(endpoint: String) = jiraUrl(server+"/rest/api/2/"+endpoint) private val throttler = new SingleFutureExecutionThrottler() private implicit val TransitionFormats = Json.format[Transition] private implicit val TransitionsFormats = Json.format[Transitions] override def reportVulnerability(vulnerability: Vulnerability, projects: Set[ReportInfo]): Future[ExportedVulnerability[String]] = throttler.throttle(api("issue").post(Json.obj( "fields" -> (extractInitialFields(vulnerability) ++ extractManagedFields(new StandardVulnerabilityOverview(vulnerability), projects, requiresDescription = true)) ))).map(response => // returns responses like {"id":"1234","key":"PROJ-6","self":"https://…/rest/api/2/issue/1234"} try{ val issueInfo = Json.reads[JiraNewIssueResponse].reads(response.json).get ExportedVulnerability(vulnerabilityName = vulnerability.name, ticket = issueInfo.key, ticketFormatVersion = ticketFormatVersion, done = false) }catch{ case e:Throwable=>sys.error("bad data: "+response.body) } ) private implicit class RichFutureResponse(r: Future[WSResponse]){ def requireSuccess: Future[WSResponse] = { r.map{ resp => if(resp.status != 200){ sys.error(s"Request expected to end with success, but it has failed with ${resp.status} / ${resp.statusText}.") } resp } } def requireStatus(expectedStatus: Int): Future[WSResponse] = { r.map{ resp => if(resp.status != expectedStatus){ sys.error(s"Request expected to end with status $expectedStatus, but it has failed with ${resp.status} / ${resp.statusText}. Response:\n"+resp.body) } resp } } } override def updateVulnerability(vuln: VulnerabilityOverview, diff: SetDiff[ReportInfo], ticket: String): Future[Unit] = { val requiredTransitionOption = diff.whichNonEmpty match { case SetDiff.Selection.Old => noRelevantProjectAffectedTransitionNameOption case SetDiff.Selection.New | SetDiff.Selection.Both => newProjectAddedTransitionNameOption case SetDiff.Selection.None => sys.error("this should not happpen") } val transitionOptionFuture = requiredTransitionOption.map{ requiredTransition => throttler.throttle(api(s"issue/$ticket/transitions").get()).requireSuccess.map{resp => resp.json.validate[Transitions].recover{case e => sys.error(s"Bad JSON: "+e+"\n\n"+resp.json)}.get.transitions.filter(_.name == requiredTransition) match { case Seq() => None case Seq(i) => Some(i) } } }.getOrElse(Future.successful(None)) val fieldsUpdateResult = throttler.throttle(api(s"issue/$ticket").put(obj( "fields" -> extractManagedFields(vuln, diff.newSet, requiresDescription = false) ))).requireStatus(204).map{ resp => () } fieldsUpdateResult.flatMap { (_: Unit) => transitionOptionFuture flatMap { case Some(transition) => throttler.throttle(api(s"issue/$ticket/transitions").post(obj("transition" -> obj("id" -> transition.id)))).requireStatus(204).map{resp =>()} case None => Future.successful(()) } } } private def extractInitialFields(vulnerability: Vulnerability): JsObject = Json.obj( "project" -> Json.obj( "id" -> projectId.toString ), "summary" -> s"${vulnerability.name} – ${vulnerability.description.take(50).takeWhile(c => c != '\n' && c != '\r')}…" ) private def extractManagedFields(vulnerability: VulnerabilityOverview, projects: Set[ReportInfo], requiresDescription: Boolean): JsObject = { val base = Json.obj( "issuetype" -> Json.obj( "id" -> vulnerabilityIssueType.toString ) ) val descriptionObj = if(requiresDescription || vulnerability.isSureAboutDescription) Json.obj("description" -> extractDescription(vulnerability)) else Json.obj() val additionalFields = Seq[Option[(String, JsValueWrapper)]]( //fields.cweId.map(id => id -> vulnerability.cweOption.fold("")(_.brief)), fields.linkId.map(id => id -> link(vulnerability)), fields.severityId.map(id => id -> vulnerability.cvssScore), fields.projectsId.map(id => id -> projects.map(friendlyProjectNameString).toSeq.sortBy( x => (x.toLowerCase(), x)).mkString("\n")) // TODO: add affected releases ) val additionalObj = Json.obj(additionalFields.flatten : _*) val constantObj = fields.constantFields.getOrElse(Json.obj()) base ++ descriptionObj ++ additionalObj ++ constantObj } /*override def migrateOldIssues(): Future[Unit] = { }*/ private def extractDescription(vulnerability: VulnerabilityOverview): String = vulnerability.descriptionAttempt + "\n\n" + s"Details: ${link(vulnerability)}" private def link(vulnerability: VulnerabilityOverview): String = { absolutizer.absolutize(routes.Statistics.vulnerability(vulnerability.name, None)) } override def ticketLink(ticket: String): String = s"$server/browse/$ticket" }