import { Head, router } from '@inertiajs/react'; import { AlertTriangle, CheckCircle2, FileWarning, FolderLock, ScanSearch, ShieldAlert, ShieldCheck, TriangleAlert, } from 'lucide-react'; import { useState } from 'react'; import { Callout, EmptyState, KeyValueGrid, SectionCard, } from '@/components/crm/page-header'; import { StatusPill } from '@/components/crm/status-badge'; import { Button } from '@/components/ui/button'; import { Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle, } from '@/components/ui/dialog'; import { Spinner } from '@/components/ui/spinner'; import { formatDateTime, formatRelative } from '@/lib/format'; import { cn } from '@/lib/utils'; import type { ScanFinding, ScanSeverity, SecurityScanProps } from '@/types'; /** * Settings -> Security scan. * * One screen, one question: is anything on this account sitting where it should * not be? The scan is read-only, so pressing the button costs nothing but the * few seconds it takes to read the files — what it finds is listed here with * the rule that caught it and the line it caught, and the files that are * certainly not supposed to be there can be moved out of the web root from * here, with a way back. * * Nothing on this page deletes. A held file keeps its bytes, so the worst a * wrong button press can do is take a file out of the site until somebody puts * it back. */ const severityTone: Record = { critical: 'danger', high: 'warning', medium: 'slate', }; const severityLabel: Record = { critical: 'Critical', high: 'High', medium: 'Medium', }; function FindingRow({ finding }: { finding: ScanFinding }) { return (

{severityLabel[finding.severity]} {finding.relative} {finding.line !== null ? `:${finding.line}` : ''} {finding.rule}

{finding.reason}

{finding.evidence ? (

                    {finding.evidence}

) : null}

); } export default function SecurityScan({ scan, targets, quarantine, can, }: SecurityScanProps) { const [running, setRunning] = useState(false); const [holding, setHolding] = useState(false); const [confirming, setConfirming] = useState(false); const findings = scan?.findings ?? []; const clean = scan !== null && scan.total === 0; const run = () => { router.post( '/settings/security-scan', {}, { preserveScroll: true, onStart: () => setRunning(true), onFinish: () => setRunning(false), }, ); }; const hold = () => { setConfirming(false); router.post( '/settings/security-scan/quarantine', {}, { preserveScroll: true, onStart: () => setHolding(true), onFinish: () => setHolding(false), }, ); }; return ( <> 0 ? 'danger' : 'warning') as string } icon={ scan === null ? ScanSearch : clean ? ShieldCheck : ShieldAlert } title={ scan === null ? 'Nothing has been scanned yet' : clean ? 'Nothing matched any rule' : `${scan.total} file${scan.total === 1 ? '' : 's'} matched a rule` } > {scan === null ? 'A scan reads scripts, markup and server config for web shells, hidden payloads and scripts where they do not belong. It changes nothing on disk, so it is safe to run on a live site at any time.' : `Last run ${formatRelative(scan.ran_at)}, by ${scan.ran_by}. The findings are listed below with the rule that caught each one; a scan never moves or deletes anything on its own.`} {running ? : } {running ? 'Scanning…' : 'Scan now'} ) : null } > {targets.roots.join(', ') || '—'} ), }, { label: 'Files larger than', value: `${Math.round(targets.max_bytes / 1024 / 1024)} MB are skipped rather than parsed`, }, { label: 'Held automatically', value: `${targets.threshold_label} and above, and never without confirmation`, }, { label: 'Dependencies, build output', value: 'Vendor trees, node_modules, caches and backups are not read', }, ]} /> {running ? (

Reading the account…

Keep this page open until it finishes. Nothing is being changed while it runs.

) : null}

The same scan runs from the command line as{' '} php artisan crm:malware-scan , which is the one to schedule on the server. Whatever either one finds, this page shows the last run.

{scan === null ? ( ) : ( <>

{scan.roots.join(', ')}

{scan.errors.length > 0 ? (

A scan is only clean when it says so. Fix the permissions and run it again.

{error}

) : null} {scan.total === 0 ? ( ) : (

))}

)} {scan.total > 0 ? ( 0 ? ( ) : null } > {quarantine.path} {quarantine.outside_public_root ? '' : ' (inside the public web root — move it)'} ), }, { label: 'Currently held', value: `${quarantine.held} file${quarantine.held === 1 ? '' : 's'}`, }, { label: 'Put one back', value: ( {quarantine.restore_command} ), }, ]} />

Each file is read again immediately before it is moved, so anything that changed since the scan stays where it is. A Medium finding is never moved: it may be the office's own old code, and that is a question for a person.

{quarantine.entries.length > 0 ? (

Held files

{entry.id} {entry.original_path} {entry.rule} ·{' '} {formatRelative( entry.held_at, )}

{quarantine.held > quarantine.entries.length ? (

…and{' '} {quarantine.held - quarantine.entries.length}{' '} more. List them all with{' '} php artisan crm:quarantine --list .

) : null}

) : null} ) : null} )}

Settings → Backup & Restore takes the copy that makes any of this reversible, and it is worth taking one before holding a batch of files.

); } // The settings layout is applied by app.tsx for every page under settings/, so // this supplies only the breadcrumb trail. SecurityScan.layout = { breadcrumbs: [ { title: 'Security scan', href: '/settings/security-scan', }, ], };