blockers 2

src/Excititor/StellaOps.Excititor.WebService/Program.cs

@@ -36,6 +36,8 @@ using StellaOps.Excititor.WebService.Contracts;
 using StellaOps.Excititor.WebService.Telemetry;
 using MongoDB.Driver;
 using MongoDB.Bson;
+using Microsoft.Extensions.Caching.Memory;
+using StellaOps.Excititor.WebService.Contracts;
 
 var builder = WebApplication.CreateBuilder(args);
 var configuration = builder.Configuration;
@@ -49,7 +51,11 @@ services.AddCsafNormalizer();
 services.AddCycloneDxNormalizer();
 services.AddOpenVexNormalizer();
 services.AddSingleton<IVexSignatureVerifier, NoopVexSignatureVerifier>();
+// TODO: replace NoopVexSignatureVerifier with hardened verifier once portable bundle signatures are finalized.
 services.AddSingleton<AirgapImportValidator>();
+services.AddSingleton<AirgapSignerTrustService>();
+services.AddSingleton<ConsoleTelemetry>();
+services.AddMemoryCache();
 services.AddScoped<IVexIngestOrchestrator, VexIngestOrchestrator>();
 services.AddOptions<ExcititorObservabilityOptions>()
     .Bind(configuration.GetSection("Excititor:Observability"));
@@ -68,6 +74,7 @@ services.Configure<MirrorDistributionOptions>(configuration.GetSection(MirrorDis
 services.AddSingleton<MirrorRateLimiter>();
 services.TryAddSingleton(TimeProvider.System);
 services.AddSingleton<IVexObservationProjectionService, VexObservationProjectionService>();
+services.AddScoped<IVexObservationQueryService, VexObservationQueryService>();
 
 var rekorSection = configuration.GetSection("Excititor:Attestation:Rekor");
 if (rekorSection.Exists())
@@ -140,6 +147,7 @@ app.MapHealthChecks("/excititor/health");
 
 app.MapPost("/airgap/v1/vex/import", async (
     [FromServices] AirgapImportValidator validator,
+    [FromServices] AirgapSignerTrustService trustService,
     [FromServices] IAirgapImportStore store,
     [FromServices] TimeProvider timeProvider,
     [FromBody] AirgapImportRequest request,
@@ -160,6 +168,18 @@ app.MapPost("/airgap/v1/vex/import", async (
         });
     }
 
+    if (!trustService.Validate(request, out var trustCode, out var trustMessage))
+    {
+        return Results.StatusCode(StatusCodes.Status403Forbidden, new
+        {
+            error = new
+            {
+                code = trustCode,
+                message = trustMessage
+            }
+        });
+    }
+
     var record = new AirgapImportRecord
     {
         Id = $"{request.BundleId}:{request.MirrorGeneration}",
@@ -174,7 +194,21 @@ app.MapPost("/airgap/v1/vex/import", async (
         ImportedAt = nowUtc
     };
 
-    await store.SaveAsync(record, cancellationToken).ConfigureAwait(false);
+    try
+    {
+        await store.SaveAsync(record, cancellationToken).ConfigureAwait(false);
+    }
+    catch (DuplicateAirgapImportException dup)
+    {
+        return Results.Conflict(new
+        {
+            error = new
+            {
+                code = "AIRGAP_IMPORT_DUPLICATE",
+                message = dup.Message
+            }
+        });
+    }
 
     return Results.Accepted($"/airgap/v1/vex/import/{request.BundleId}", new
     {
@@ -296,6 +330,204 @@ app.MapPost("/excititor/admin/backfill-statements", async (
     });
 });
 
+app.MapGet("/console/vex", async (
+    HttpContext context,
+    IOptions<VexMongoStorageOptions> storageOptions,
+    IVexObservationQueryService queryService,
+    ConsoleTelemetry telemetry,
+    IMemoryCache cache,
+    CancellationToken cancellationToken) =>
+{
+    if (!TryResolveTenant(context, storageOptions.Value, requireHeader: true, out var tenant, out var tenantError))
+    {
+        return tenantError;
+    }
+
+    var query = context.Request.Query;
+    var purls = query["purl"].Where(static v => !string.IsNullOrWhiteSpace(v)).Select(static v => v.Trim()).ToArray();
+    var advisories = query["advisoryId"].Where(static v => !string.IsNullOrWhiteSpace(v)).Select(static v => v.Trim()).ToArray();
+    var statuses = new List<VexClaimStatus>();
+    if (query.TryGetValue("status", out var statusValues))
+    {
+        foreach (var statusValue in statusValues)
+        {
+            if (Enum.TryParse<VexClaimStatus>(statusValue, ignoreCase: true, out var parsed))
+            {
+                statuses.Add(parsed);
+            }
+            else
+            {
+                return Results.BadRequest($"Unknown status '{statusValue}'.");
+            }
+        }
+    }
+
+    var limit = query.TryGetValue("pageSize", out var pageSizeValues) && int.TryParse(pageSizeValues.FirstOrDefault(), out var pageSize)
+        ? pageSize
+        : (int?)null;
+    var cursor = query.TryGetValue("cursor", out var cursorValues) ? cursorValues.FirstOrDefault() : null;
+
+    telemetry.Requests.Add(1);
+
+    var cacheKey = $"console-vex:{tenant}:{string.Join(',', purls)}:{string.Join(',', advisories)}:{string.Join(',', statuses)}:{limit}:{cursor}";
+    if (cache.TryGetValue(cacheKey, out VexConsolePage? cachedPage) && cachedPage is not null)
+    {
+        telemetry.CacheHits.Add(1);
+        return Results.Ok(cachedPage);
+    }
+    telemetry.CacheMisses.Add(1);
+
+    var options = new VexObservationQueryOptions(
+        tenant,
+        observationIds: null,
+        vulnerabilityIds: advisories,
+        productKeys: null,
+        purls: purls,
+        cpes: null,
+        providerIds: null,
+        statuses: statuses,
+        cursor: cursor,
+        limit: limit);
+
+    VexObservationQueryResult result;
+    try
+    {
+        result = await queryService.QueryAsync(options, cancellationToken).ConfigureAwait(false);
+    }
+    catch (FormatException ex)
+    {
+        return Results.BadRequest(ex.Message);
+    }
+
+    var statements = result.Observations
+        .SelectMany(obs => obs.Statements.Select(stmt => new VexConsoleStatementDto(
+            AdvisoryId: stmt.VulnerabilityId,
+            ProductKey: stmt.ProductKey,
+            Purl: stmt.Purl ?? obs.Linkset.Purls.FirstOrDefault(),
+            Status: stmt.Status.ToString().ToLowerInvariant(),
+            Justification: stmt.Justification?.ToString(),
+            ProviderId: obs.ProviderId,
+            ObservationId: obs.ObservationId,
+            CreatedAtUtc: obs.CreatedAt,
+            Attributes: obs.Attributes)))
+        .ToList();
+
+    var statusCounts = result.Observations
+        .GroupBy(o => o.Status.ToString().ToLowerInvariant())
+        .ToDictionary(g => g.Key, g => g.Count(), StringComparer.OrdinalIgnoreCase);
+
+    var response = new VexConsolePage(
+        Items: statements,
+        Cursor: result.NextCursor,
+        HasMore: result.HasMore,
+        Returned: statements.Count,
+        Counters: statusCounts);
+
+    cache.Set(cacheKey, response, TimeSpan.FromSeconds(30));
+
+    return Results.Ok(response);
+}).WithName("GetConsoleVex");
+
+// Cartographer linkouts
+app.MapPost("/internal/graph/linkouts", async (
+    GraphLinkoutsRequest request,
+    IVexObservationQueryService queryService,
+    CancellationToken cancellationToken) =>
+{
+    if (request is null || string.IsNullOrWhiteSpace(request.Tenant))
+    {
+        return Results.BadRequest("tenant is required.");
+    }
+
+    if (request.Purls is null || request.Purls.Count == 0 || request.Purls.Count > 500)
+    {
+        return Results.BadRequest("purls are required (1-500).");
+    }
+
+    var normalizedPurls = request.Purls
+        .Where(p => !string.IsNullOrWhiteSpace(p))
+        .Select(p => p.Trim().ToLowerInvariant())
+        .Distinct()
+        .ToArray();
+
+    if (normalizedPurls.Length == 0)
+    {
+        return Results.BadRequest("purls are required (1-500).");
+    }
+
+    var options = new VexObservationQueryOptions(
+        request.Tenant.Trim(),
+        purls: normalizedPurls,
+        includeJustifications: request.IncludeJustifications,
+        includeProvenance: request.IncludeProvenance,
+        limit: 200);
+
+    VexObservationQueryResult result;
+    try
+    {
+        result = await queryService.QueryAsync(options, cancellationToken).ConfigureAwait(false);
+    }
+    catch (FormatException ex)
+    {
+        return Results.BadRequest(ex.Message);
+    }
+
+    var observationsByPurl = result.Observations
+        .SelectMany(obs => obs.Linkset.Purls.Select(purl => (purl, obs)))
+        .GroupBy(tuple => tuple.purl, StringComparer.OrdinalIgnoreCase)
+        .ToDictionary(g => g.Key, g => g.Select(t => t.obs).ToArray(), StringComparer.OrdinalIgnoreCase);
+
+    var items = new List<GraphLinkoutItem>(normalizedPurls.Length);
+    var notFound = new List<string>();
+
+    foreach (var inputPurl in normalizedPurls)
+    {
+        if (!observationsByPurl.TryGetValue(inputPurl, out var obsForPurl))
+        {
+            notFound.Add(inputPurl);
+            continue;
+        }
+
+        var advisories = obsForPurl
+            .SelectMany(obs => obs.Statements.Select(stmt => new GraphLinkoutAdvisory(
+                AdvisoryId: stmt.VulnerabilityId,
+                Source: obs.ProviderId,
+                Status: stmt.Status.ToString().ToLowerInvariant(),
+                Justification: request.IncludeJustifications ? stmt.Justification?.ToString() : null,
+                ModifiedAt: obs.CreatedAt,
+                EvidenceHash: obs.Linkset.ReferenceHash,
+                ConnectorId: obs.ProviderId,
+                DsseEnvelopeHash: request.IncludeProvenance ? obs.Linkset.ReferenceHash : null)))
+            .OrderBy(a => a.AdvisoryId, StringComparer.Ordinal)
+            .ThenBy(a => a.Source, StringComparer.Ordinal)
+            .Take(200)
+            .ToList();
+
+        var conflicts = obsForPurl
+            .Where(obs => obs.Statements.Any(s => s.Status == VexClaimStatus.Conflict))
+            .SelectMany(obs => obs.Statements
+                .Where(s => s.Status == VexClaimStatus.Conflict)
+                .Select(stmt => new GraphLinkoutConflict(
+                    Source: obs.ProviderId,
+                    Status: stmt.Status.ToString().ToLowerInvariant(),
+                    Justification: request.IncludeJustifications ? stmt.Justification?.ToString() : null,
+                    ObservedAt: obs.CreatedAt,
+                    EvidenceHash: obs.Linkset.ReferenceHash)))
+            .OrderBy(c => c.Source, StringComparer.Ordinal)
+            .ToList();
+
+        items.Add(new GraphLinkoutItem(
+            Purl: inputPurl,
+            Advisories: advisories,
+            Conflicts: conflicts,
+            Truncated: advisories.Count >= 200,
+            NextCursor: advisories.Count >= 200 ? $"{advisories[^1].AdvisoryId}:{advisories[^1].Source}" : null));
+    }
+
+    var response = new GraphLinkoutsResponse(items, notFound);
+    return Results.Ok(response);
+}).WithName("PostGraphLinkouts");
+
 app.MapPost("/ingest/vex", async (
     HttpContext context,
     VexIngestRequest request,