app.py

from flask import Flask, render_template, request, jsonify, send_file
from werkzeug.utils import secure_filename
from dotenv import load_dotenv
import keyring
import os
from cryptography.fernet import Fernet
import json
from datetime import datetime
import traceback
from typing import List, Dict, Any, Optional

from semgrep_client import SemgrepClient
from project import Project

# Load environment variables
load_dotenv()

app = Flask(__name__)
app.config['SECRET_KEY'] = os.urandom(24)

class Config:
    """Configuration management with secure token storage"""
    KEYRING_SERVICE = 'semgrep_report_builder'
    
    @staticmethod
    def store_api_token(token):
        """Securely store API token using keyring"""
        keyring.set_password(Config.KEYRING_SERVICE, 'api_token', token)
    
    @staticmethod
    def get_api_token():
        """Retrieve stored API token"""
        return keyring.get_password(Config.KEYRING_SERVICE, 'api_token')
    
    @staticmethod
    def store_deployment_info(deployment_slug: str, deployment_id: str):
        """Store deployment information"""
        keyring.set_password(Config.KEYRING_SERVICE, 'deployment_slug', deployment_slug)
        keyring.set_password(Config.KEYRING_SERVICE, 'deployment_id', deployment_id)
    
    @staticmethod
    def get_deployment_info():
        """Retrieve deployment information"""
        return {
            'deployment_slug': keyring.get_password(Config.KEYRING_SERVICE, 'deployment_slug'),
            'deployment_id': keyring.get_password(Config.KEYRING_SERVICE, 'deployment_id')
        }

def get_semgrep_client() -> Optional[SemgrepClient]:
    """Get configured Semgrep client"""
    api_token = Config.get_api_token()
    deployment_info = Config.get_deployment_info()
    
    if not api_token or not deployment_info['deployment_slug'] or not deployment_info['deployment_id']:
        return None
        
    return SemgrepClient(
        api_token=api_token,
        deployment_slug=deployment_info['deployment_slug'],
        deployment_id=deployment_info['deployment_id']
    )

@app.route('/')
def index():
    """Render main page"""
    return render_template('index.html')

@app.route('/store_config', methods=['POST'])
def store_config():
    """Store API configuration securely"""
    try:
        data = request.get_json()
        api_token = data.get('api_token')
        deployment_slug = data.get('deployment_slug')
        deployment_id = data.get('deployment_id')
        
        if not all([api_token, deployment_slug, deployment_id]):
            return jsonify({'error': 'Missing required configuration values'}), 400
        
        # Store configuration securely
        Config.store_api_token(api_token)
        Config.store_deployment_info(deployment_slug, deployment_id)
        
        return jsonify({'message': 'Configuration stored successfully'})
    except Exception as e:
        print(f"Error storing configuration: {str(e)}")
        traceback.print_exc()
        return jsonify({'error': str(e)}), 500

@app.route('/get_projects')
def get_projects():
    """Get list of projects from Semgrep API"""
    try:
        client = get_semgrep_client()
        if not client:
            return jsonify({'error': 'Missing configuration'}), 400
            
        projects_data = client.get_projects()
        projects = [Project(p).to_dict() for p in projects_data]
        return jsonify(projects)
    except Exception as e:
        print(f"Error fetching projects: {str(e)}")
        traceback.print_exc()
        return jsonify({'error': str(e)}), 500

@app.route('/generate_reports', methods=['POST'])
def generate_reports():
    """Generate PDF reports for selected projects"""
    try:
        data = request.get_json()
        project_ids = data.get('projects', [])
        report_types = data.get('reportTypes', {})
        severity_levels = [k for k, v in data.get('severityLevels', {}).items() if v]
        merge_reports = data.get('mergeReports', False)
        
        if not project_ids:
            return jsonify({'error': 'No projects selected'}), 400
            
        if not any(report_types.values()):
            return jsonify({'error': 'No report types selected'}), 400
            
        client = get_semgrep_client()
        if not client:
            return jsonify({'error': 'Missing configuration'}), 400
            
        # Get all projects first
        projects_data = client.get_projects()
        
        # Filter to selected projects and fetch their findings
        selected_projects = []
        for p in projects_data:
            if str(p['id']) in map(str, project_ids):
                project = Project(p)
                findings = client.get_project_findings(project.name, severity_levels)
                project.add_findings(findings)
                selected_projects.append(project)
        
        if not selected_projects:
            return jsonify({'error': 'No valid projects found'}), 400
            
        # Generate reports
        from report_generator import ReportGenerator
        generator = ReportGenerator()
        
        # Phase 1: Handle multiple report types for single/multiple projects
        generated_files = []
        date_str = datetime.now().strftime('%Y%m%d_%H%M%S')
        
        # Sanitize project name for filenames
        def sanitize_filename(name):
            return "".join(c for c in name if c.isalnum() or c in (' ', '-', '_')).rstrip()
        
        # Check if merge reports is enabled
        if merge_reports:
            # Phase 3: Generate merged reports with all selected projects
            print(f"Generating merged reports for {len(selected_projects)} projects")
            
            # Generate each selected report type with merged data
            if report_types.get('executiveSummary'):
                output_path = generator.generate_merged_executive_summary(selected_projects, severity_filter=severity_levels)
                print(f"Generated merged executive summary for {len(selected_projects)} projects")
                filename = f"merged_executive_summary_{date_str}.pdf"
                generated_files.append({'path': output_path, 'filename': filename, 'type': 'merged_executive_summary'})
                
            if report_types.get('auditDetail'):
                output_path = generator.generate_merged_audit_detail(selected_projects, severity_filter=severity_levels)
                print(f"Generated merged audit detail for {len(selected_projects)} projects")
                filename = f"merged_audit_detail_{date_str}.pdf"
                generated_files.append({'path': output_path, 'filename': filename, 'type': 'merged_audit_detail'})
                
            if report_types.get('vulnerabilityDetail'):
                output_path = generator.generate_merged_vulnerability_detail(selected_projects, severity_filter=severity_levels)
                print(f"Generated merged vulnerability detail for {len(selected_projects)} projects")
                filename = f"merged_vulnerability_detail_{date_str}.pdf"
                generated_files.append({'path': output_path, 'filename': filename, 'type': 'merged_vulnerability_detail'})
        else:
            # Phase 2: Generate separate reports for each selected project
            for project in selected_projects:
                safe_project_name = sanitize_filename(project.name)
                
                # Generate each selected report type for this project
                if report_types.get('executiveSummary'):
                    output_path = generator.generate_executive_summary(project, severity_filter=severity_levels)
                    print(f"Generated executive summary for {project.name} with findings: {project.get_findings_count_by_severity()}")
                    filename = f"{safe_project_name}_executive_summary_{date_str}.pdf"
                    generated_files.append({'path': output_path, 'filename': filename, 'type': 'executive_summary', 'project': project.name})
                    
                if report_types.get('auditDetail'):
                    output_path = generator.generate_audit_detail(project, severity_filter=severity_levels)
                    print(f"Generated audit detail for {project.name} with findings: {project.get_findings_count_by_severity()}")
                    filename = f"{safe_project_name}_audit_detail_{date_str}.pdf"
                    generated_files.append({'path': output_path, 'filename': filename, 'type': 'audit_detail', 'project': project.name})
                    
                if report_types.get('vulnerabilityDetail'):
                    output_path = generator.generate_vulnerability_detail(project, severity_filter=severity_levels)
                    print(f"Generated vulnerability detail for {project.name} with findings: {project.get_findings_count_by_severity()}")
                    filename = f"{safe_project_name}_vulnerability_detail_{date_str}.pdf"
                    generated_files.append({'path': output_path, 'filename': filename, 'type': 'vulnerability_detail', 'project': project.name})
        
        if not generated_files:
            return jsonify({'error': 'No valid report type selected'}), 400
            
        # Phase 1: If only one report generated, return it directly
        if len(generated_files) == 1:
            file_info = generated_files[0]
            return send_file(file_info['path'], mimetype='application/pdf', as_attachment=True,
                           download_name=file_info['filename'])
        
        # Phase 2: If multiple reports generated, create a ZIP file
        else:
            import zipfile
            import os
            
            # Create appropriate ZIP filename based on number of projects
            if len(selected_projects) == 1:
                safe_project_name = sanitize_filename(selected_projects[0].name)
                zip_filename = f"{safe_project_name}_reports_{date_str}.zip"
            else:
                zip_filename = f"semgrep_reports_{len(selected_projects)}_projects_{date_str}.zip"
            
            zip_path = zip_filename
            
            # Security: Create a list of validated file paths to break taint chain
            validated_files = []
            for file_info in generated_files:
                original_path = file_info['path']
                
                # Strict validation: only allow files we explicitly created
                # 1. Must be in current working directory
                # 2. Must have .pdf extension
                # 3. Must exist
                # 4. Filename must match our expected patterns
                if (os.path.exists(original_path) and
                    original_path.endswith('.pdf') and
                    os.path.dirname(os.path.abspath(original_path)) == os.getcwd() and
                    (original_path.startswith('executive_summary_') or
                     original_path.startswith('audit_detail_') or
                     original_path.startswith('vulnerability_detail_') or
                     original_path.startswith('merged_'))):
                    validated_files.append({'path': original_path, 'filename': file_info['filename']})
                else:
                    print(f"Warning: Skipping potentially unsafe file path: {original_path}")
            
            with zipfile.ZipFile(zip_path, 'w') as zip_file:
                for validated_file in validated_files:
                    # Use only validated file paths
                    safe_path = validated_file['path']
                    zip_file.write(safe_path, validated_file['filename'])
                    # Clean up individual PDF files
                    os.remove(safe_path)
            
            return send_file(zip_path, mimetype='application/zip', as_attachment=True,
                           download_name=zip_filename)
    except Exception as e:
        print(f"Error generating reports: {str(e)}")
        traceback.print_exc()
        return jsonify({'error': str(e)}), 500

if __name__ == '__main__':
    app.run(host='127.0.0.1', port=5002)