Merge branch 'main' into fix/backend-ci-split-tests

Author: nensii21

.github/workflows/ci.yml

@@ -43,6 +43,16 @@ jobs:
           git fetch origin "${{ github.base_ref }}" --depth=1
           git diff --check "origin/${{ github.base_ref }}"...HEAD
 
+  issue-template-label-validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Validate issue template labels
+        run: python scripts/validate_issue_template_labels.py
+
   backend-lint:
     needs: detect-changes
     if: needs.detect-changes.outputs.run_backend == 'true'

.github/workflows/smoke-test.yml

@@ -0,0 +1,213 @@
+name: Onboarding Smoke Test
+
+# Verifies the contributor setup path:
+#   fresh clone → ./setup.sh → ./start.sh → services respond
+# Catches onboarding regressions before they hit contributors.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "setup.sh"
+      - "start.sh"
+      - "backend/**"
+      - "frontend/**"
+      - "backend/requirements.txt"
+      - "backend/requirements-dev.txt"
+      - ".github/workflows/smoke-test.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "setup.sh"
+      - "start.sh"
+      - "backend/**"
+      - "frontend/**"
+      - "backend/requirements.txt"
+      - "backend/requirements-dev.txt"
+      - ".github/workflows/smoke-test.yml"
+  workflow_dispatch:
+
+jobs:
+  smoke-test:
+    name: Fresh-clone smoke test (Ubuntu)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      # ── 1. Checkout ────────────────────────────────────────────────────────
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # ── 2. Set up Python 3.11 ──────────────────────────────────────────────
+      # setup.sh requires Python 3.11+. We pin it explicitly so the runner
+      # never silently falls back to an older system Python.
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      # ── 3. Set up Node.js ──────────────────────────────────────────────────
+      # setup.sh checks for node + npm; frontend uses Vite on port 5173.
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      # ── 4. Make scripts executable ─────────────────────────────────────────
+      # Git on some clients strips execute bits — enforce them explicitly.
+      - name: Make scripts executable
+        run: chmod +x setup.sh start.sh
+
+      # ── 5. Run setup.sh ────────────────────────────────────────────────────
+      # setup.sh: creates venv, pip installs backend/requirements.txt +
+      # httpx[cli], npm installs frontend, writes .env, creates data/logs dirs.
+      # lsof is used by start.sh; install it here so setup.sh can't fail on it.
+      - name: Install system dependencies
+        run: sudo apt-get install -y lsof libcairo2-dev pkg-config python3-dev
+
+      - name: Run setup.sh
+        run: |
+          echo "::group::setup.sh output"
+          bash setup.sh
+          echo "::endgroup::"
+
+      # ── 6. Verify setup produced expected artifacts ────────────────────────
+      # Fails fast with a clear message if setup.sh silently skipped something.
+      - name: Verify setup artifacts
+        run: |
+          echo "Checking venv..."
+          test -f venv/bin/python3        || { echo "FAIL: venv/bin/python3 missing"; exit 1; }
+          test -f venv/bin/activate       || { echo "FAIL: venv/bin/activate missing"; exit 1; }
+
+          echo "Checking backend deps..."
+          source venv/bin/activate
+          python3 -c "import fastapi"     || { echo "FAIL: fastapi not installed"; exit 1; }
+          python3 -c "import uvicorn"     || { echo "FAIL: uvicorn not installed"; exit 1; }
+          python3 -c "import httpx"       || { echo "FAIL: httpx not installed"; exit 1; }
+          deactivate
+
+          echo "Checking frontend node_modules..."
+          test -f frontend/node_modules/.bin/vite \
+            || { echo "FAIL: frontend/node_modules/.bin/vite missing"; exit 1; }
+
+          echo "Checking directories..."
+          for d in data data/raw data/reports logs wordlists; do
+            test -d "$d" || { echo "FAIL: directory '$d' missing"; exit 1; }
+          done
+
+          echo "Checking .env..."
+          test -f .env || { echo "FAIL: .env not created"; exit 1; }
+          grep -q "SECUSCAN_BIND_PORT=8000" .env \
+            || { echo "FAIL: expected port config missing from .env"; exit 1; }
+
+          echo "All artifact checks passed."
+
+      # ── 7. Start services via start.sh ─────────────────────────────────────
+      # start.sh launches uvicorn on 127.0.0.1:8000 and Vite on 127.0.0.1:5173.
+      # We background the whole script and capture its PID for cleanup.
+      - name: Start services via start.sh
+        run: |
+          bash start.sh &
+          echo "START_SH_PID=$!" >> "$GITHUB_ENV"
+
+      # ── 8. Wait for backend (uvicorn on :8000) ─────────────────────────────
+      # start.sh starts uvicorn on 127.0.0.1:8000.
+      # /openapi.json is always present in FastAPI without any auth — safer
+      # than /health which may not exist.
+      - name: Wait for backend to be ready
+        run: |
+          MAX_WAIT=60
+          INTERVAL=3
+          ELAPSED=0
+          URL="http://127.0.0.1:8000/openapi.json"
+
+          echo "Polling $URL ..."
+          until curl --silent --fail --max-time 2 "$URL" > /dev/null 2>&1; do
+            if [ "$ELAPSED" -ge "$MAX_WAIT" ]; then
+              echo "ERROR: Backend did not become ready within ${MAX_WAIT}s"
+              echo "--- Active processes ---"
+              ps aux | grep -E "uvicorn|python" || true
+              echo "--- Port 8000 status ---"
+              lsof -i :8000 || true
+              exit 1
+            fi
+            echo "  Not ready (${ELAPSED}s elapsed) — retrying in ${INTERVAL}s ..."
+            sleep "$INTERVAL"
+            ELAPSED=$((ELAPSED + INTERVAL))
+          done
+          echo "Backend ready after ${ELAPSED}s."
+
+      # ── 9. Wait for frontend (Vite on :5173) ──────────────────────────────
+      - name: Wait for frontend to be ready
+        run: |
+          MAX_WAIT=60
+          INTERVAL=3
+          ELAPSED=0
+          URL="http://127.0.0.1:5173"
+
+          echo "Polling $URL ..."
+          until curl --silent --fail --max-time 2 "$URL" > /dev/null 2>&1; do
+            if [ "$ELAPSED" -ge "$MAX_WAIT" ]; then
+              echo "ERROR: Frontend did not become ready within ${MAX_WAIT}s"
+              echo "--- Active processes ---"
+              ps aux | grep -E "vite|node" || true
+              echo "--- Port 5173 status ---"
+              lsof -i :5173 || true
+              exit 1
+            fi
+            echo "  Not ready (${ELAPSED}s elapsed) — retrying in ${INTERVAL}s ..."
+            sleep "$INTERVAL"
+            ELAPSED=$((ELAPSED + INTERVAL))
+          done
+          echo "Frontend ready after ${ELAPSED}s."
+
+      # ── 10. Smoke-check backend API ────────────────────────────────────────
+      # /openapi.json must contain "openapi" and "SecuScan" (the app title).
+      # /docs must return HTTP 200 (Swagger UI).
+      # These require zero auth and prove the real app stack loaded correctly.
+      - name: Smoke-check backend API
+        run: |
+          echo "--- GET /openapi.json ---"
+          OAS=$(curl --silent --fail --max-time 5 "http://127.0.0.1:8000/openapi.json")
+          echo "$OAS" | python3 -c "import sys, json; d=json.load(sys.stdin); assert 'openapi' in d, 'missing openapi key'" \
+            || { echo "FAIL: /openapi.json invalid JSON or missing openapi key"; exit 1; }
+          echo "openapi.json OK"
+
+          echo "--- GET /docs ---"
+          curl --silent --fail --max-time 5 "http://127.0.0.1:8000/docs" > /dev/null \
+            || { echo "FAIL: /docs did not return 200"; exit 1; }
+          echo "/docs OK"
+
+          echo "Backend smoke checks passed."
+
+      # ── 11. Smoke-check frontend ───────────────────────────────────────────
+      - name: Smoke-check frontend
+        run: |
+          echo "--- GET http://127.0.0.1:5173 ---"
+          BODY=$(curl --silent --fail --max-time 5 "http://127.0.0.1:5173")
+          echo "$BODY" | grep -qi "html" \
+            || { echo "FAIL: frontend did not return an HTML page"; exit 1; }
+          echo "Frontend smoke check passed."
+
+      # ── 12. Teardown ───────────────────────────────────────────────────────
+      - name: Stop services
+        if: always()
+        run: |
+          [ -n "${START_SH_PID:-}" ] && kill "$START_SH_PID" 2>/dev/null || true
+          pkill -f "uvicorn"   2>/dev/null || true
+          pkill -f "vite"      2>/dev/null || true
+          pkill -f "npm"       2>/dev/null || true
+          echo "Teardown complete."
+
+      # ── 13. Upload logs on failure ─────────────────────────────────────────
+      - name: Upload logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-test-logs
+          path: |
+            logs/
+            **/*.log
+            nohup.out
+          if-no-files-found: ignore
+          retention-days: 7

CONTRIBUTING.md

@@ -22,6 +22,24 @@ SecuScan is built for learning, defensive security workflows, and ethical testin
 
 When issue labels are available, look for tags such as `good first issue`, `documentation`, `frontend`, `backend`, `plugin`, `help wanted`, or `gssoc`.
 
+## Issue Template Label Maintenance
+
+Issue templates in `.github/ISSUE_TEMPLATE/` must only reference labels from the active repository taxonomy.
+
+When adding or updating issue template labels:
+
+- Use active label groups such as `type:*`, `area:*`, `priority:*`, and `level:*`.
+- Avoid deprecated labels such as `bug`, `feature`, `documentation`, and `help wanted`.
+- Keep template labels aligned with the labels used by maintainers and CI.
+
+Before opening a pull request that changes issue templates, run:
+
+```bash
+python scripts/validate_issue_template_labels.py
+```
+
+The CI workflow also runs this validation and will fail if an issue template references a label that is not included in the approved label taxonomy.
+
 ## Local Setup
 
 ### Prerequisites

backend/secuscan/config.py

@@ -63,7 +63,7 @@ class Settings(BaseSettings):
     admin_api_key: Optional[str] = None
 
     # Network Policy Configuration
-    network_allowlist: List[str] = []  # IPs/networks to allow (CIDR)
+    network_allowlist: List[str] = []  # IPs/networks to allow (CIDR); empty = deny all egress
     network_denylist: List[str] = [    # IPs/networks to deny (CIDR)
         "169.254.169.254/32",          # AWS metadata
         "169.254.0.0/16",              # Reserved/metadata

backend/secuscan/network_policy.py

@@ -398,11 +398,9 @@ def _init_default_policies(engine: NetworkPolicyEngine) -> None:
         except ValueError:
             logger.warning(f"Skipping invalid allowlist CIDR: {cidr}")
 
-    # Add system defaults (if allowlist is empty, add public internet)
+    # Warn if allowlist is empty ? network policy defaults to deny-all egress
     if not settings.network_allowlist:
         logger.warning(
-            "SECUSCAN_NETWORK_ALLOWLIST is empty. Allowing all public IPs. "
-            "Configure this environment variable to restrict egress."
+            "SECUSCAN_NETWORK_ALLOWLIST is empty. All external network egress is blocked. "
+            "Configure this environment variable with CIDR ranges to allow outbound traffic."
         )
-        engine.add_allow_rule("0.0.0.0/0", reason="Default allow all (configure SECUSCAN_NETWORK_ALLOWLIST)")
-        engine.add_allow_rule("::/0", reason="Default allow all IPv6")

backend/secuscan/validation.py

@@ -70,6 +70,8 @@ def wildcard_to_net(pattern: str) -> ipaddress.IPv4Network | None:
         for pattern in patterns:
             try:
                 allowed_net = ipaddress.ip_network(pattern, strict=False)
+                if net.version != allowed_net.version:
+                    continue
                 if net.subnet_of(allowed_net) or net.overlaps(allowed_net):
                     return True
             except ValueError:

backend/secuscan/workflows.py

@@ -72,6 +72,7 @@ def _should_run(self, now: datetime, last_run_at: str | None, schedule_seconds:
         return elapsed >= schedule_seconds
     async def _run_workflow(self, workflow_id: str, steps: List[Dict[str, Any]]):
         logger.info("Running workflow %s with %d step(s)", workflow_id, len(steps))
+        db = await get_db()
         for step in steps:
             plugin_id = step.get("plugin_id")
             inputs = step.get("inputs") or {}

frontend/testing/unit/components/ThemeToggle.test.tsx

@@ -0,0 +1,102 @@
+import React from 'react'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { describe, it, expect, beforeEach } from 'vitest'
+import ThemeToggle from '../../../src/components/ThemeToggle'
+import { ThemeProvider } from '../../../src/components/ThemeContext'
+
+const STORAGE_KEY = 'secuscan-theme'
+
+function renderWithTheme() {
+  return render(
+    <ThemeProvider>
+      <ThemeToggle />
+    </ThemeProvider>,
+  )
+}
+
+describe('ThemeToggle', () => {
+  beforeEach(() => {
+    localStorage.removeItem(STORAGE_KEY)
+    document.documentElement.classList.remove('dark', 'theme-light')
+  })
+
+  it('renders a button with an accessible label', () => {
+    renderWithTheme()
+    const button = screen.getByRole('button')
+    expect(button).toHaveAttribute('aria-label')
+  })
+
+  it('toggles from dark to light on click and persists to localStorage', async () => {
+    localStorage.setItem(STORAGE_KEY, 'dark')
+    const user = userEvent.setup()
+    renderWithTheme()
+
+    const button = screen.getByRole('button')
+    expect(button).toHaveAttribute('aria-pressed', 'true')
+
+    await user.click(button)
+
+    expect(localStorage.getItem(STORAGE_KEY)).toBe('light')
+    expect(button).toHaveAttribute('aria-pressed', 'false')
+  })
+
+  it('toggles from light to dark on click and persists to localStorage', async () => {
+    localStorage.setItem(STORAGE_KEY, 'light')
+    const user = userEvent.setup()
+    renderWithTheme()
+
+    const button = screen.getByRole('button')
+    expect(button).toHaveAttribute('aria-pressed', 'false')
+
+    await user.click(button)
+
+    expect(localStorage.getItem(STORAGE_KEY)).toBe('dark')
+    expect(button).toHaveAttribute('aria-pressed', 'true')
+  })
+
+  it('aria-label reflects the target theme, not the current one', () => {
+    localStorage.setItem(STORAGE_KEY, 'dark')
+    renderWithTheme()
+    const button = screen.getByRole('button')
+    expect(button).toHaveAttribute('aria-label', 'Toggle to light mode')
+  })
+
+  it('shows dark_mode icon when theme is light', () => {
+    localStorage.setItem(STORAGE_KEY, 'light')
+    renderWithTheme()
+    expect(screen.getByText('dark_mode')).toBeTruthy()
+  })
+
+  it('shows light_mode icon when theme is dark', () => {
+    localStorage.setItem(STORAGE_KEY, 'dark')
+    renderWithTheme()
+    expect(screen.getByText('light_mode')).toBeTruthy()
+  })
+
+  it('stops click propagation', async () => {
+    localStorage.setItem(STORAGE_KEY, 'dark')
+    const user = userEvent.setup()
+    const parentHandler = vi.fn()
+    render(
+      <div onClick={parentHandler}>
+        <ThemeProvider>
+          <ThemeToggle />
+        </ThemeProvider>
+      </div>,
+    )
+    await user.click(screen.getByRole('button'))
+    expect(parentHandler).not.toHaveBeenCalled()
+  })
+
+  it('applies sm size classes when size prop is sm', () => {
+    render(
+      <ThemeProvider>
+        <ThemeToggle size="sm" />
+      </ThemeProvider>,
+    )
+    const button = screen.getByRole('button')
+    expect(button.className).toContain('w-9')
+    expect(button.className).toContain('h-9')
+  })
+})