feat(advisory): add CSAF 2.0 types, query hook, and ECharts dependency#1063
Draft
CryptoRodeo wants to merge 1 commit into
Draft
feat(advisory): add CSAF 2.0 types, query hook, and ECharts dependency#1063CryptoRodeo wants to merge 1 commit into
CryptoRodeo wants to merge 1 commit into
Conversation
Define TypeScript interfaces for the full CSAF 2.0 VEX document structure (CsafDocument, CsafVulnerability, CsafProductTree, etc.) and add useFetchAdvisoryCsafById query hook that fetches raw CSAF JSON via the downloadAdvisory endpoint and parses the Blob into typed data. Also add echarts and echarts-for-react dependencies for upcoming tree visualization components. Implements TC-4618 Assisted-by: Claude Code
Contributor
Reviewer's GuideAdds strongly-typed CSAF 2.0 VEX document models, a React Query hook to fetch and parse CSAF advisory documents, and new charting dependencies for future visualizations. Sequence diagram for useFetchAdvisoryCsafById hooksequenceDiagram
actor UserComponent
participant useFetchAdvisoryCsafById
participant useQuery
participant downloadAdvisory
UserComponent->>useFetchAdvisoryCsafById: call with id
useFetchAdvisoryCsafById->>useQuery: useQuery<CsafDocument>()
useQuery->>downloadAdvisory: downloadAdvisory({ client, path: { key: id } })
downloadAdvisory-->>useQuery: response.data (Blob)
useQuery->>useQuery: blob.text()
useQuery->>useQuery: JSON.parse(text) as CsafDocument
useQuery-->>useFetchAdvisoryCsafById: data, isLoading, error
useFetchAdvisoryCsafById-->>UserComponent: { csafDocument, isFetching, fetchError }
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- In
useFetchAdvisoryCsafById, consider adding basic error handling/validation aroundJSON.parse(text)(e.g., try/catch and asserting thatdocumentandcsaf_versionexist) so that malformed or non-CSAF responses are surfaced more clearly than a generic runtime parse error. - Several CSAF interfaces (e.g.,
CsafPublisher.category,CsafTracking.status,CsafProductStatuskeys,CsafRemediation.category,CsafThreat.category) are currently plainstrings; tightening these to string-literal unions that reflect the CSAF 2.0 spec will give better type safety and editor assistance when working with these fields.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `useFetchAdvisoryCsafById`, consider adding basic error handling/validation around `JSON.parse(text)` (e.g., try/catch and asserting that `document` and `csaf_version` exist) so that malformed or non-CSAF responses are surfaced more clearly than a generic runtime parse error.
- Several CSAF interfaces (e.g., `CsafPublisher.category`, `CsafTracking.status`, `CsafProductStatus` keys, `CsafRemediation.category`, `CsafThreat.category`) are currently plain `string`s; tightening these to string-literal unions that reflect the CSAF 2.0 spec will give better type safety and editor assistance when working with these fields.
## Individual Comments
### Comment 1
<location path="client/src/app/queries/advisories.ts" line_range="161" />
<code_context>
+ return {
+ csafDocument: data,
+ isFetching: isLoading,
+ fetchError: error as AxiosError | null,
+ };
+};
</code_context>
<issue_to_address>
**issue (bug_risk):** Avoid over-narrowing the error type to AxiosError since JSON.parse can also throw non-Axios errors.
The query can fail for non-Axios reasons (e.g., `blob.text()` / `JSON.parse` throwing `TypeError` or `SyntaxError`), so forcing `error` to `AxiosError | null` can lead to incorrect assumptions at call sites (like always accessing `error.response`). Instead, keep `error` as `unknown`/`Error` and use a type guard (e.g., `isAxiosError(error)`) before treating it as an `AxiosError`.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1063 +/- ##
==========================================
- Coverage 49.17% 49.10% -0.08%
==========================================
Files 253 253
Lines 5499 5507 +8
Branches 1660 1660
==========================================
Hits 2704 2704
- Misses 2519 2528 +9
+ Partials 276 275 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Collaborator
Author
Verification Report for TC-4618 (commit feec631)
Overall: PASSAll acceptance criteria met. Single bot review comment assessed as suggestion (follows existing codebase convention). This comment was AI-generated by sdlc-workflow/verify-pr v0.9.1. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CsafDocument,CsafVulnerability,CsafProductTree,CsafBranch,CsafRelationship, etc.)useFetchAdvisoryCsafByIdquery hook that fetches raw CSAF JSON viadownloadAdvisoryendpoint and parsesBlobinto typedCsafDocumentechartsandecharts-for-reactdependencies to client workspaceTest plan
npm run build -w clientsucceedsImplements TC-4618
Assisted-by: Claude Code
Summary by Sourcery
Introduce CSAF 2.0 VEX document support in the client, including typed models and a query hook for fetching advisory CSAF data.
New Features:
Enhancements:
Build: