coana-fix.mts

import { promises as fs } from 'node:fs'
import os from 'node:os'
import path from 'node:path'

import { joinAnd } from '@socketsecurity/registry/lib/arrays'
import { debugDir, debugFn } from '@socketsecurity/registry/lib/debug'
import { readJsonSync } from '@socketsecurity/registry/lib/fs'
import { logger } from '@socketsecurity/registry/lib/logger'
import { pluralize } from '@socketsecurity/registry/lib/words'

import {
  cleanupErrorBranches,
  cleanupFailedPrBranches,
  cleanupStaleBranch,
  cleanupSuccessfulPrLocalBranch,
} from './branch-cleanup.mts'
import {
  checkCiEnvVars,
  getCiEnvInstructions,
  getFixEnv,
} from './env-helpers.mts'
import { getSocketFixBranchName, getSocketFixCommitMessage } from './git.mts'
import { getSocketFixPrs, openSocketFixPr } from './pull-request.mts'
import {
  DOT_SOCKET_DOT_FACTS_JSON,
  FLAG_DRY_RUN,
  GQL_PR_STATE_OPEN,
} from '../../constants.mts'
import { handleApiCall } from '../../utils/api.mts'
import { spawnCoanaDlx } from '../../utils/dlx.mts'
import { getErrorCause } from '../../utils/errors.mts'
import {
  gitCheckoutBranch,
  gitCommit,
  gitCreateBranch,
  gitDeleteBranch,
  gitPushBranch,
  gitRemoteBranchExists,
  gitResetAndClean,
  gitUnstagedModifiedFiles,
} from '../../utils/git.mts'
import {
  enablePrAutoMerge,
  fetchGhsaDetails,
  setGitRemoteGithubRepoUrl,
} from '../../utils/github.mts'
import { getPackageFilesForScan } from '../../utils/path-resolve.mts'
import { setupSdk } from '../../utils/sdk.mts'
import { fetchSupportedScanFileNames } from '../scan/fetch-supported-scan-file-names.mts'

import type { FixConfig } from './types.mts'
import type { CResult } from '../../types.mts'
import type { PURL_Type } from '../../utils/ecosystem.mts'
import type { Spinner } from '@socketsecurity/registry/lib/spinner'

type DiscoverGhsaIdsOptions = {
  coanaVersion?: string | undefined
  cwd?: string | undefined
  ecosystems?: PURL_Type[] | undefined
  silence?: boolean | undefined
  spinner?: Spinner | undefined
}

/**
 * Discovers GHSA IDs by running coana without applying fixes.
 * Returns a list of GHSA IDs, optionally limited.
 */
async function discoverGhsaIds(
  orgSlug: string,
  tarHash: string,
  options?: DiscoverGhsaIdsOptions | undefined,
): Promise<string[]> {
  const {
    cwd = process.cwd(),
    ecosystems,
    silence = false,
    spinner,
  } = {
    __proto__: null,
    ...options,
  } as DiscoverGhsaIdsOptions

  const foundCResult = await spawnCoanaDlx(
    [
      'find-vulnerabilities',
      cwd,
      '--manifests-tar-hash',
      tarHash,
      ...(ecosystems?.length ? ['--purl-types', ...ecosystems] : []),
    ],
    orgSlug,
    {
      cwd,
      spinner: silence ? undefined : spinner,
      coanaVersion: options?.coanaVersion,
    },
    { stdio: 'pipe' },
  )

  if (foundCResult.ok) {
    try {
      // Coana prints ghsaIds as json-formatted string on the final line of the output.
      const ghsaIdsRaw = foundCResult.data.trim().split('\n').pop()
      if (ghsaIdsRaw) {
        return JSON.parse(ghsaIdsRaw)
      }
    } catch {}
  }
  return []
}

export async function coanaFix(
  fixConfig: FixConfig,
): Promise<CResult<{ fixedAll: boolean; ghsaDetails: unknown[] }>> {
  const {
    all,
    applyFixes,
    autopilot,
    coanaVersion,
    cwd,
    debug,
    disableMajorUpdates,
    ecosystems,
    exclude,
    ghsas,
    include,
    minimumReleaseAge,
    orgSlug,
    outputFile,
    prLimit,
    showAffectedDirectDependencies,
    silence,
    spinner,
  } = fixConfig

  const fixEnv = await getFixEnv()
  debugDir('inspect', { fixEnv })

  if (!silence) {
    spinner?.start()
  }

  const sockSdkCResult = await setupSdk()
  if (!sockSdkCResult.ok) {
    return sockSdkCResult
  }

  const sockSdk = sockSdkCResult.data

  const supportedFilesCResult = await fetchSupportedScanFileNames({
    spinner: silence ? undefined : spinner,
    silence,
  })
  if (!supportedFilesCResult.ok) {
    return supportedFilesCResult
  }

  const supportedFiles = supportedFilesCResult.data
  const scanFilepaths = await getPackageFilesForScan(['.'], supportedFiles, {
    cwd,
  })
  // Exclude any .socket.facts.json files that happen to be in the scan
  // folder before the analysis was run.
  const filepathsToUpload = scanFilepaths.filter(
    p => path.basename(p).toLowerCase() !== DOT_SOCKET_DOT_FACTS_JSON,
  )
  const uploadCResult = await handleApiCall(
    sockSdk.uploadManifestFiles(orgSlug, filepathsToUpload, cwd),
    {
      description: 'upload manifests',
      spinner,
      silence,
    },
  )

  if (!uploadCResult.ok) {
    return uploadCResult
  }

  const tarHash: string = (uploadCResult as any).data.tarHash
  if (!tarHash) {
    if (!silence) {
      spinner?.stop()
    }
    return {
      ok: false,
      message:
        'No tar hash returned from Socket API upload-manifest-files endpoint',
      data: uploadCResult.data,
    }
  }

  const shouldDiscoverGhsaIds = all || !ghsas.length

  const shouldOpenPrs = fixEnv.isCi && fixEnv.repoInfo

  if (!shouldOpenPrs) {
    // In local mode, if neither --all nor --id is provided, show deprecation warning.
    if (!silence && shouldDiscoverGhsaIds && !all) {
      logger.warn(
        'Implicit --all is deprecated in local mode and will be removed in a future release. Please use --all explicitly.',
      )
    }

    // Inform user about local mode when fixes will be applied.
    if (!silence && applyFixes && ghsas.length) {
      const envCheck = checkCiEnvVars()
      if (envCheck.present.length) {
        // Some CI vars are set but not all - show what's missing.
        if (envCheck.missing.length) {
          logger.info(
            'Running in local mode - fixes will be applied directly to your working directory.\n' +
              `Missing environment variables for PR creation: ${joinAnd(envCheck.missing)}`,
          )
        }
      } else {
        // No CI vars are present - show general local mode message.
        logger.info(
          'Running in local mode - fixes will be applied directly to your working directory.\n' +
            getCiEnvInstructions(),
        )
      }
    }

    // In local mode, process all discovered/provided IDs (no limit).
    const ids: string[] = shouldDiscoverGhsaIds
      ? await discoverGhsaIds(orgSlug, tarHash, {
          coanaVersion,
          cwd,
          ecosystems,
          silence,
          spinner,
        })
      : ghsas

    if (ids.length === 0) {
      if (!silence) {
        spinner?.stop()
      }
      return { ok: true, data: { fixedAll: false, ghsaDetails: [] } }
    }

    // Create a temporary file for the output.
    const tmpDir = os.tmpdir()
    const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`)

    try {
      const fixCResult = await spawnCoanaDlx(
        [
          'compute-fixes-and-upgrade-purls',
          cwd,
          '--manifests-tar-hash',
          tarHash,
          '--apply-fixes-to',
          ...ids,
          ...(fixConfig.rangeStyle
            ? ['--range-style', fixConfig.rangeStyle]
            : []),
          ...(minimumReleaseAge
            ? ['--minimum-release-age', minimumReleaseAge]
            : []),
          ...(include.length ? ['--include', ...include] : []),
          ...(exclude.length ? ['--exclude', ...exclude] : []),
          ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []),
          ...(!applyFixes ? [FLAG_DRY_RUN] : []),
          '--output-file',
          tmpFile,
          ...(debug ? ['--debug'] : []),
          ...(disableMajorUpdates ? ['--disable-major-updates'] : []),
          ...(showAffectedDirectDependencies
            ? ['--show-affected-direct-dependencies']
            : []),
          ...fixConfig.unknownFlags,
        ],
        fixConfig.orgSlug,
        {
          coanaVersion,
          cwd,
          spinner: silence ? undefined : spinner,
          stdio: silence ? 'pipe' : 'inherit',
        },
      )

      if (!silence) {
        spinner?.stop()
      }

      if (!fixCResult.ok) {
        return fixCResult
      }

      // Read the temporary file to get the actual fixes result.
      const fixesResultJson = readJsonSync(tmpFile, { throws: false }) as
        | { fixes?: Record<string, unknown> }
        | null
        | undefined

      // Copy to outputFile if provided.
      if (outputFile) {
        if (!silence) {
          logger.info(`Copying fixes result to ${outputFile}`)
        }
        const tmpContent = await fs.readFile(tmpFile, 'utf8')
        await fs.writeFile(outputFile, tmpContent, 'utf8')
      }

      return {
        ok: true,
        data: {
          fixedAll: true,
          ghsaDetails: fixesResultJson ? [fixesResultJson] : [],
        },
      }
    } finally {
      // Clean up the temporary file.
      try {
        await fs.unlink(tmpFile)
      } catch {
        // Ignore cleanup errors.
      }
    }
  }

  // Adjust PR limit based on open Socket Fix PRs.
  let adjustedPrLimit = prLimit
  if (shouldOpenPrs && fixEnv.repoInfo) {
    try {
      const openPrs = await getSocketFixPrs(
        fixEnv.repoInfo.owner,
        fixEnv.repoInfo.repo,
        { states: GQL_PR_STATE_OPEN },
      )
      const openPrCount = openPrs.length
      // Reduce limit by number of open PRs to avoid creating too many.
      adjustedPrLimit = Math.max(0, prLimit - openPrCount)
      if (openPrCount > 0) {
        debugFn(
          'notice',
          `prLimit: adjusted from ${prLimit} to ${adjustedPrLimit} (${openPrCount} open Socket Fix ${pluralize('PR', openPrCount)}`,
        )
      }
    } catch (e) {
      debugFn('warn', 'Failed to count open PRs, using original limit')
      debugDir('error', e)
    }
  }

  const shouldSpawnCoana = adjustedPrLimit > 0

  let ids: string[] | undefined

  if (shouldSpawnCoana) {
    ids = (
      shouldDiscoverGhsaIds
        ? await discoverGhsaIds(orgSlug, tarHash, {
            coanaVersion,
            cwd,
            ecosystems,
            silence,
            spinner,
          })
        : ghsas
    ).slice(0, adjustedPrLimit)
  }

  if (!ids?.length) {
    debugFn('notice', 'miss: no GHSA IDs to process')
  }

  if (!fixEnv.repoInfo) {
    debugFn('notice', 'miss: no repo info detected')
  }

  if (!ids?.length || !fixEnv.repoInfo) {
    if (!silence) {
      spinner?.stop()
    }
    return { ok: true, data: { fixedAll: false, ghsaDetails: [] } }
  }

  debugFn('notice', `fetch: ${ids.length} GHSA details for ${joinAnd(ids)}`)

  const ghsaDetails = await fetchGhsaDetails(ids)
  const scanBaseNames = new Set(scanFilepaths.map(p => path.basename(p)))

  debugFn('notice', `found: ${ghsaDetails.size} GHSA details`)

  let count = 0
  let overallFixed = false
  const ghsaFixResults: unknown[] = []

  // Process each GHSA ID individually.
  ghsaLoop: for (let i = 0, { length } = ids; i < length; i += 1) {
    const ghsaId = ids[i]!
    debugFn('notice', `check: ${ghsaId}`)

    // Create a temporary file for Coana output.
    const tmpDir = os.tmpdir()
    const tmpFile = path.join(tmpDir, `socket-fix-${ghsaId}-${Date.now()}.json`)

    // Apply fix for single GHSA ID.
    // eslint-disable-next-line no-await-in-loop
    const fixCResult = await spawnCoanaDlx(
      [
        'compute-fixes-and-upgrade-purls',
        cwd,
        '--manifests-tar-hash',
        tarHash,
        '--apply-fixes-to',
        ghsaId,
        ...(fixConfig.rangeStyle
          ? ['--range-style', fixConfig.rangeStyle]
          : []),
        ...(minimumReleaseAge
          ? ['--minimum-release-age', minimumReleaseAge]
          : []),
        ...(include.length ? ['--include', ...include] : []),
        ...(exclude.length ? ['--exclude', ...exclude] : []),
        ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []),
        ...(debug ? ['--debug'] : []),
        ...(disableMajorUpdates ? ['--disable-major-updates'] : []),
        ...(showAffectedDirectDependencies
          ? ['--show-affected-direct-dependencies']
          : []),
        '--output-file',
        tmpFile,
        ...fixConfig.unknownFlags,
      ],
      fixConfig.orgSlug,
      {
        coanaVersion,
        cwd,
        spinner: silence ? undefined : spinner,
        stdio: silence ? 'pipe' : 'inherit',
      },
    )

    if (!fixCResult.ok) {
      if (!silence) {
        logger.error(
          `Update failed for ${ghsaId}: ${getErrorCause(fixCResult)}`,
        )
      }
      // Clean up temp file on failure.
      try {
        // eslint-disable-next-line no-await-in-loop
        await fs.unlink(tmpFile)
      } catch {
        // Ignore cleanup errors.
      }
      continue ghsaLoop
    }

    // Check for modified files after applying the fix.
    // eslint-disable-next-line no-await-in-loop
    const unstagedCResult = await gitUnstagedModifiedFiles(cwd)
    const modifiedFiles = unstagedCResult.ok
      ? unstagedCResult.data.filter(relPath =>
          scanBaseNames.has(path.basename(relPath)),
        )
      : []

    if (!modifiedFiles.length) {
      debugFn('notice', `skip: no changes for ${ghsaId}`)
      // Clean up temp file before continuing.
      try {
        // eslint-disable-next-line no-await-in-loop
        await fs.unlink(tmpFile)
      } catch {
        // Ignore cleanup errors.
      }
      continue ghsaLoop
    }

    overallFixed = true

    const branch = getSocketFixBranchName(ghsaId)

    try {
      // Check if an open PR already exists for this GHSA.
      // eslint-disable-next-line no-await-in-loop
      const existingOpenPrs = await getSocketFixPrs(
        fixEnv.repoInfo.owner,
        fixEnv.repoInfo.repo,
        { ghsaId, states: GQL_PR_STATE_OPEN },
      )

      if (existingOpenPrs.length > 0) {
        const prNum = existingOpenPrs[0]!.number
        if (!silence) {
          logger.info(`PR #${prNum} already exists for ${ghsaId}, skipping.`)
        }
        debugFn('notice', `skip: open PR #${prNum} exists for ${ghsaId}`)
        continue ghsaLoop
      }

      // If branch exists but no open PR, delete the stale branch.
      // This handles cases where PR creation failed but branch was pushed.
      // eslint-disable-next-line no-await-in-loop
      if (await gitRemoteBranchExists(branch, cwd)) {
        // eslint-disable-next-line no-await-in-loop
        const shouldContinue = await cleanupStaleBranch(branch, ghsaId, cwd)
        if (!shouldContinue) {
          continue ghsaLoop
        }
      }

      // Check for GitHub token before doing any git operations.
      if (!fixEnv.githubToken) {
        if (!silence) {
          logger.error(
            'Cannot create pull request: SOCKET_CLI_GITHUB_TOKEN environment variable is not set.\n' +
              'Set SOCKET_CLI_GITHUB_TOKEN or GITHUB_TOKEN to enable PR creation.',
          )
        }
        debugFn('error', `skip: missing GitHub token for ${ghsaId}`)
        continue ghsaLoop
      }

      debugFn('notice', `pr: creating for ${ghsaId}`)

      const details = ghsaDetails.get(ghsaId)
      debugFn(
        'notice',
        `ghsa: ${ghsaId} details ${details ? 'found' : 'missing'}`,
      )

      const pushed =
        // eslint-disable-next-line no-await-in-loop
        (await gitCreateBranch(branch, cwd)) &&
        // eslint-disable-next-line no-await-in-loop
        (await gitCheckoutBranch(branch, cwd)) &&
        // eslint-disable-next-line no-await-in-loop
        (await gitCommit(
          getSocketFixCommitMessage(ghsaId, details),
          modifiedFiles,
          {
            cwd,
            email: fixEnv.gitEmail,
            user: fixEnv.gitUser,
          },
        )) &&
        // eslint-disable-next-line no-await-in-loop
        (await gitPushBranch(branch, cwd))

      if (!pushed) {
        if (!silence) {
          logger.warn(`Push failed for ${ghsaId}, skipping PR creation.`)
        }
        // eslint-disable-next-line no-await-in-loop
        await gitResetAndClean(fixEnv.baseBranch, cwd)
        // eslint-disable-next-line no-await-in-loop
        await gitCheckoutBranch(fixEnv.baseBranch, cwd)
        // eslint-disable-next-line no-await-in-loop
        await gitDeleteBranch(branch, cwd)
        continue ghsaLoop
      }

      // Set up git remote.
      // eslint-disable-next-line no-await-in-loop
      await setGitRemoteGithubRepoUrl(
        fixEnv.repoInfo.owner,
        fixEnv.repoInfo.repo,
        fixEnv.githubToken,
        cwd,
      )

      // eslint-disable-next-line no-await-in-loop
      const prResult = await openSocketFixPr(
        fixEnv.repoInfo.owner,
        fixEnv.repoInfo.repo,
        branch,
        // Single GHSA ID.
        [ghsaId],
        {
          baseBranch: fixEnv.baseBranch,
          cwd,
          ghsaDetails,
        },
      )

      if (prResult.ok) {
        const { data } = prResult.pr
        const prRef = `PR #${data.number}`

        // Read the fix result JSON and merge with PR data.
        const fixResultJson = readJsonSync(tmpFile, { throws: false })
        if (fixResultJson && typeof fixResultJson === 'object') {
          ghsaFixResults.push({
            ...(fixResultJson as object),
            pullRequestLink: data.html_url,
            pullRequestNumber: data.number,
          })
        }

        if (!silence) {
          logger.success(`Opened ${prRef} for ${ghsaId}.`)
        }

        if (autopilot) {
          if (!silence) {
            logger.indent()
            spinner?.indent()
          }
          // eslint-disable-next-line no-await-in-loop
          const { details, enabled } = await enablePrAutoMerge(data)
          if (!silence) {
            if (enabled) {
              logger.info(`Auto-merge enabled for ${prRef}.`)
            } else {
              const message = `Failed to enable auto-merge for ${prRef}${
                details ? `:\n${details.map(d => ` - ${d}`).join('\n')}` : '.'
              }`
              logger.error(message)
            }
            logger.dedent()
            spinner?.dedent()
          }
        }

        // Clean up local branch only - keep remote branch for PR merge.
        // eslint-disable-next-line no-await-in-loop
        await cleanupSuccessfulPrLocalBranch(branch, cwd)
      } else {
        // Handle PR creation failures.
        if (prResult.reason === 'already_exists') {
          if (!silence) {
            logger.info(
              `PR already exists for ${ghsaId} (this should not happen due to earlier check).`,
            )
          }
          // Don't delete branch - PR exists and needs it.
        } else if (prResult.reason === 'validation_error') {
          if (!silence) {
            logger.error(
              `Failed to create PR for ${ghsaId}:\n${prResult.details}`,
            )
          }
          // eslint-disable-next-line no-await-in-loop
          await cleanupFailedPrBranches(branch, cwd)
        } else if (prResult.reason === 'permission_denied') {
          if (!silence) {
            logger.error(
              `Failed to create PR for ${ghsaId}: Permission denied. Check SOCKET_CLI_GITHUB_TOKEN permissions.`,
            )
          }
          // eslint-disable-next-line no-await-in-loop
          await cleanupFailedPrBranches(branch, cwd)
        } else if (prResult.reason === 'network_error') {
          if (!silence) {
            logger.error(
              `Failed to create PR for ${ghsaId}: Network error. Please try again.`,
            )
          }
          // eslint-disable-next-line no-await-in-loop
          await cleanupFailedPrBranches(branch, cwd)
        } else {
          if (!silence) {
            logger.error(
              `Failed to create PR for ${ghsaId}: ${prResult.error.message}`,
            )
          }
          // eslint-disable-next-line no-await-in-loop
          await cleanupFailedPrBranches(branch, cwd)
        }
      }

      // Reset back to base branch for next iteration.
      // eslint-disable-next-line no-await-in-loop
      await gitResetAndClean(fixEnv.baseBranch, cwd)
      // eslint-disable-next-line no-await-in-loop
      await gitCheckoutBranch(fixEnv.baseBranch, cwd)
    } catch (e) {
      if (!silence) {
        logger.warn(
          `Unexpected condition: Push failed for ${ghsaId}, skipping PR creation.`,
        )
      }
      debugDir('error', e)
      // Clean up branches (push may have succeeded before error).
      // eslint-disable-next-line no-await-in-loop
      const remoteBranchExists = await gitRemoteBranchExists(branch, cwd)
      // eslint-disable-next-line no-await-in-loop
      await cleanupErrorBranches(branch, cwd, remoteBranchExists)
      // eslint-disable-next-line no-await-in-loop
      await gitResetAndClean(fixEnv.baseBranch, cwd)
      // eslint-disable-next-line no-await-in-loop
      await gitCheckoutBranch(fixEnv.baseBranch, cwd)
    } finally {
      // Clean up temp file.
      try {
        // eslint-disable-next-line no-await-in-loop
        await fs.unlink(tmpFile)
      } catch {
        // Ignore cleanup errors.
      }
    }

    count += 1
    debugFn(
      'notice',
      `increment: count ${count}/${Math.min(adjustedPrLimit, ids.length)}`,
    )
    if (count >= adjustedPrLimit) {
      break ghsaLoop
    }
  }

  if (!silence) {
    spinner?.stop()
  }

  return {
    ok: true,
    data: { fixedAll: overallFixed, ghsaDetails: ghsaFixResults },
  }
}