feat: per-repo issue tracker, Gitea support, PR review pipeline (#10)

compliance-dashboard/src/infrastructure/mod.rs

@@ -7,6 +7,7 @@ pub mod findings;
 pub mod graph;
 pub mod issues;
 pub mod mcp;
+#[allow(clippy::too_many_arguments)]
 pub mod repositories;
 pub mod sbom;
 pub mod scans;

compliance-dashboard/src/infrastructure/repositories.rs

@@ -36,6 +36,10 @@ pub async fn add_repository(
     default_branch: String,
     auth_token: Option<String>,
     auth_username: Option<String>,
+    tracker_type: Option<String>,
+    tracker_owner: Option<String>,
+    tracker_repo: Option<String>,
+    tracker_token: Option<String>,
 ) -> Result<(), ServerFnError> {
     let state: super::server_state::ServerState =
         dioxus_fullstack::FullstackContext::extract().await?;
@@ -52,6 +56,18 @@ pub async fn add_repository(
     if let Some(username) = auth_username.filter(|u| !u.is_empty()) {
         body["auth_username"] = serde_json::Value::String(username);
     }
+    if let Some(tt) = tracker_type.filter(|t| !t.is_empty()) {
+        body["tracker_type"] = serde_json::Value::String(tt);
+    }
+    if let Some(to) = tracker_owner.filter(|t| !t.is_empty()) {
+        body["tracker_owner"] = serde_json::Value::String(to);
+    }
+    if let Some(tr) = tracker_repo.filter(|t| !t.is_empty()) {
+        body["tracker_repo"] = serde_json::Value::String(tr);
+    }
+    if let Some(tk) = tracker_token.filter(|t| !t.is_empty()) {
+        body["tracker_token"] = serde_json::Value::String(tk);
+    }
 
     let client = reqwest::Client::new();
     let resp = client
@@ -71,6 +87,70 @@ pub async fn add_repository(
     Ok(())
 }
 
+#[server]
+pub async fn update_repository(
+    repo_id: String,
+    name: Option<String>,
+    default_branch: Option<String>,
+    auth_token: Option<String>,
+    auth_username: Option<String>,
+    tracker_type: Option<String>,
+    tracker_owner: Option<String>,
+    tracker_repo: Option<String>,
+    tracker_token: Option<String>,
+    scan_schedule: Option<String>,
+) -> Result<(), ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let url = format!("{}/api/v1/repositories/{repo_id}", state.agent_api_url);
+
+    let mut body = serde_json::Map::new();
+    if let Some(v) = name.filter(|s| !s.is_empty()) {
+        body.insert("name".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = default_branch.filter(|s| !s.is_empty()) {
+        body.insert("default_branch".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = auth_token {
+        body.insert("auth_token".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = auth_username {
+        body.insert("auth_username".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_type {
+        body.insert("tracker_type".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_owner {
+        body.insert("tracker_owner".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_repo {
+        body.insert("tracker_repo".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_token {
+        body.insert("tracker_token".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = scan_schedule {
+        body.insert("scan_schedule".into(), serde_json::Value::String(v));
+    }
+
+    let client = reqwest::Client::new();
+    let resp = client
+        .patch(&url)
+        .json(&body)
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    if !resp.status().is_success() {
+        let text = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to update repository: {text}"
+        )));
+    }
+
+    Ok(())
+}
+
 #[server]
 pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
     let state: super::server_state::ServerState =
@@ -136,6 +216,31 @@ pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
     Ok(())
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct WebhookConfigResponse {
+    pub webhook_secret: Option<String>,
+    pub tracker_type: String,
+}
+
+#[server]
+pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigResponse, ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let url = format!(
+        "{}/api/v1/repositories/{repo_id}/webhook-config",
+        state.agent_api_url
+    );
+
+    let resp = reqwest::get(&url)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: WebhookConfigResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
 /// Check if a repository has any running scans
 #[server]
 pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {

compliance-dashboard/src/infrastructure/server.rs

@@ -1,4 +1,4 @@
-use axum::routing::get;
+use axum::routing::{get, post};
 use axum::{middleware, Extension};
 use dioxus::prelude::*;
 use time::Duration;
@@ -63,6 +63,8 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                 .route("/auth", get(auth_login))
                 .route("/auth/callback", get(auth_callback))
                 .route("/logout", get(logout))
+                // Webhook proxy: forward to agent (no auth required)
+                .route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
                 .serve_dioxus_application(ServeConfig::new(), app)
                 .layer(Extension(PendingOAuthStore::default()))
                 .layer(middleware::from_fn(require_auth))
@@ -77,6 +79,53 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
         })
 }
 
+/// Forward incoming webhooks to the agent's webhook server.
+/// The dashboard acts as a public-facing proxy so the agent isn't exposed directly.
+async fn webhook_proxy(
+    Extension(state): Extension<ServerState>,
+    axum::extract::Path((platform, repo_id)): axum::extract::Path<(String, String)>,
+    headers: axum::http::HeaderMap,
+    body: axum::body::Bytes,
+) -> axum::http::StatusCode {
+    // The agent_api_url typically looks like "http://agent:3001" or "http://localhost:3001"
+    // Webhook routes are on the same server, so strip any trailing path
+    let base = state.agent_api_url.trim_end_matches('/');
+    // Remove /api/v1 suffix if present to get base URL
+    let base = base
+        .strip_suffix("/api/v1")
+        .or_else(|| base.strip_suffix("/api"))
+        .unwrap_or(base);
+    let agent_url = format!("{base}/webhook/{platform}/{repo_id}");
+
+    // Forward all relevant headers
+    let client = reqwest::Client::new();
+    let mut req = client.post(&agent_url).body(body.to_vec());
+
+    for (name, value) in &headers {
+        let name_str = name.as_str().to_lowercase();
+        // Forward platform-specific headers
+        if name_str.starts_with("x-gitea-")
+            || name_str.starts_with("x-github-")
+            || name_str.starts_with("x-hub-")
+            || name_str.starts_with("x-gitlab-")
+            || name_str == "content-type"
+        {
+            if let Ok(v) = value.to_str() {
+                req = req.header(name.as_str(), v);
+            }
+        }
+    }
+
+    match req.send().await {
+        Ok(resp) => axum::http::StatusCode::from_u16(resp.status().as_u16())
+            .unwrap_or(axum::http::StatusCode::BAD_GATEWAY),
+        Err(e) => {
+            tracing::error!("Webhook proxy failed: {e}");
+            axum::http::StatusCode::BAD_GATEWAY
+        }
+    }
+}
+
 /// Seed three default MCP server configs (Findings, SBOM, DAST) if they don't already exist.
 async fn seed_default_mcp_servers(db: &Database, mcp_endpoint_url: Option<&str>) {
     let endpoint = mcp_endpoint_url.unwrap_or("http://localhost:8090");

compliance-dashboard/src/pages/repositories.rs

@@ -1,5 +1,7 @@
 use dioxus::prelude::*;
 use dioxus_free_icons::icons::bs_icons::*;
+#[allow(unused_imports)]
+use dioxus_free_icons::icons::bs_icons::{BsGear, BsPencil};
 use dioxus_free_icons::Icon;
 
 use crate::components::page_header::PageHeader;
@@ -29,9 +31,24 @@ pub fn RepositoriesPage() -> Element {
     let mut auth_username = use_signal(String::new);
     let mut show_auth = use_signal(|| false);
     let mut ssh_public_key = use_signal(String::new);
+    let mut show_tracker = use_signal(|| false);
+    let mut tracker_type_val = use_signal(String::new);
+    let mut tracker_owner_val = use_signal(String::new);
+    let mut tracker_repo_val = use_signal(String::new);
+    let mut tracker_token_val = use_signal(String::new);
     let mut adding = use_signal(|| false);
     let mut toasts = use_context::<Toasts>();
     let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
+    let mut edit_repo_id = use_signal(|| Option::<String>::None);
+    let mut edit_name = use_signal(String::new);
+    let mut edit_branch = use_signal(String::new);
+    let mut edit_tracker_type = use_signal(String::new);
+    let mut edit_tracker_owner = use_signal(String::new);
+    let mut edit_tracker_repo = use_signal(String::new);
+    let mut edit_tracker_token = use_signal(String::new);
+    let mut edit_saving = use_signal(|| false);
+    let mut edit_webhook_secret = use_signal(|| Option::<String>::None);
+    let mut edit_webhook_tracker = use_signal(String::new);
     let mut scanning_ids = use_signal(Vec::<String>::new);
     let mut graph_repo_id = use_signal(|| Option::<String>::None);
 
@@ -154,6 +171,63 @@ pub fn RepositoriesPage() -> Element {
                     }
                 }
 
+                // Issue tracker config section
+                div { style: "margin-top: 8px;",
+                    button {
+                        class: "btn btn-ghost",
+                        style: "font-size: 12px; padding: 4px 8px;",
+                        onclick: move |_| show_tracker.toggle(),
+                        if show_tracker() { "Hide tracker options" } else { "Issue tracker?" }
+                    }
+                }
+
+                if show_tracker() {
+                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
+                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "Configure an issue tracker to auto-create issues from findings"
+                        }
+                        div { class: "form-group",
+                            label { "Tracker Type" }
+                            select {
+                                value: "{tracker_type_val}",
+                                onchange: move |e| tracker_type_val.set(e.value()),
+                                option { value: "", "None" }
+                                option { value: "github", "GitHub" }
+                                option { value: "gitlab", "GitLab" }
+                                option { value: "gitea", "Gitea" }
+                                option { value: "jira", "Jira" }
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Owner / Namespace" }
+                            input {
+                                r#type: "text",
+                                placeholder: "org-name",
+                                value: "{tracker_owner_val}",
+                                oninput: move |e| tracker_owner_val.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Repository / Project" }
+                            input {
+                                r#type: "text",
+                                placeholder: "repo-name",
+                                value: "{tracker_repo_val}",
+                                oninput: move |e| tracker_repo_val.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Tracker Token (PAT)" }
+                            input {
+                                r#type: "password",
+                                placeholder: "ghp_xxxx / glpat-xxxx",
+                                value: "{tracker_token_val}",
+                                oninput: move |e| tracker_token_val.set(e.value()),
+                            }
+                        }
+                    }
+                }
+
                 button {
                     class: "btn btn-primary",
                     disabled: adding(),
@@ -169,9 +243,13 @@ pub fn RepositoriesPage() -> Element {
                             let v = auth_username();
                             if v.is_empty() { None } else { Some(v) }
                         };
+                        let tt = { let v = tracker_type_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_owner = { let v = tracker_owner_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_repo = { let v = tracker_repo_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_tok = { let v = tracker_token_val(); if v.is_empty() { None } else { Some(v) } };
                         adding.set(true);
                         spawn(async move {
-                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr).await {
+                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr, tt, t_owner, t_repo, t_tok).await {
                                 Ok(_) => {
                                     toasts.push(ToastType::Success, "Repository added");
                                     repos.restart();
@@ -182,10 +260,15 @@ pub fn RepositoriesPage() -> Element {
                         });
                         show_add_form.set(false);
                         show_auth.set(false);
+                        show_tracker.set(false);
                         name.set(String::new());
                         git_url.set(String::new());
                         auth_token.set(String::new());
                         auth_username.set(String::new());
+                        tracker_type_val.set(String::new());
+                        tracker_owner_val.set(String::new());
+                        tracker_repo_val.set(String::new());
+                        tracker_token_val.set(String::new());
                     },
                     if adding() { "Validating..." } else { "Add" }
                 }
@@ -234,6 +317,139 @@ pub fn RepositoriesPage() -> Element {
             }
         }
 
+        // ── Edit repository dialog ──
+        if let Some(eid) = edit_repo_id() {
+            div { class: "modal-overlay",
+                div { class: "modal-dialog",
+                    h3 { "Edit Repository" }
+                    div { class: "form-group",
+                        label { "Name" }
+                        input {
+                            r#type: "text",
+                            value: "{edit_name}",
+                            oninput: move |e| edit_name.set(e.value()),
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Default Branch" }
+                        input {
+                            r#type: "text",
+                            value: "{edit_branch}",
+                            oninput: move |e| edit_branch.set(e.value()),
+                        }
+                    }
+                    h4 { style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);", "Issue Tracker" }
+                    div { class: "form-group",
+                        label { "Tracker Type" }
+                        select {
+                            value: "{edit_tracker_type}",
+                            onchange: move |e| edit_tracker_type.set(e.value()),
+                            option { value: "", "None" }
+                            option { value: "github", "GitHub" }
+                            option { value: "gitlab", "GitLab" }
+                            option { value: "gitea", "Gitea" }
+                            option { value: "jira", "Jira" }
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Owner / Namespace" }
+                        input {
+                            r#type: "text",
+                            placeholder: "org-name",
+                            value: "{edit_tracker_owner}",
+                            oninput: move |e| edit_tracker_owner.set(e.value()),
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Repository / Project" }
+                        input {
+                            r#type: "text",
+                            placeholder: "repo-name",
+                            value: "{edit_tracker_repo}",
+                            oninput: move |e| edit_tracker_repo.set(e.value()),
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Tracker Token (leave empty to keep existing)" }
+                        input {
+                            r#type: "password",
+                            placeholder: "Enter new token to change",
+                            value: "{edit_tracker_token}",
+                            oninput: move |e| edit_tracker_token.set(e.value()),
+                        }
+                    }
+                    // Webhook configuration section
+                    if let Some(secret) = edit_webhook_secret() {
+                        h4 {
+                            style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);",
+                            "Webhook Configuration"
+                        }
+                        p {
+                            style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "Add this webhook in your repository settings to enable push-triggered scans and PR reviews."
+                        }
+                        div { class: "form-group",
+                            label { "Webhook URL" }
+                            input {
+                                r#type: "text",
+                                readonly: true,
+                                style: "font-family: monospace; font-size: 12px;",
+                                value: format!("/webhook/{}/{eid}", edit_webhook_tracker()),
+                            }
+                            p {
+                                style: "font-size: 11px; color: var(--text-secondary); margin-top: 4px;",
+                                "Use the full dashboard URL as the base, e.g. https://your-domain.com/webhook/..."
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Webhook Secret" }
+                            input {
+                                r#type: "text",
+                                readonly: true,
+                                style: "font-family: monospace; font-size: 12px;",
+                                value: "{secret}",
+                            }
+                        }
+                    }
+                    div { class: "modal-actions",
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| edit_repo_id.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-primary",
+                            disabled: edit_saving(),
+                            onclick: move |_| {
+                                let id = eid.clone();
+                                let nm = { let v = edit_name(); if v.is_empty() { None } else { Some(v) } };
+                                let br = { let v = edit_branch(); if v.is_empty() { None } else { Some(v) } };
+                                let tt = { let v = edit_tracker_type(); if v.is_empty() { None } else { Some(v) } };
+                                let t_owner = { let v = edit_tracker_owner(); if v.is_empty() { None } else { Some(v) } };
+                                let t_repo = { let v = edit_tracker_repo(); if v.is_empty() { None } else { Some(v) } };
+                                let t_tok = { let v = edit_tracker_token(); if v.is_empty() { None } else { Some(v) } };
+                                edit_saving.set(true);
+                                spawn(async move {
+                                    match crate::infrastructure::repositories::update_repository(
+                                        id, nm, br, None, None, tt, t_owner, t_repo, t_tok, None,
+                                    ).await {
+                                        Ok(_) => {
+                                            toasts.push(ToastType::Success, "Repository updated");
+                                            repos.restart();
+                                        }
+                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                    }
+                                    edit_saving.set(false);
+                                    edit_repo_id.set(None);
+                                });
+                            },
+                            if edit_saving() { "Saving..." } else { "Save" }
+                        }
+                    }
+                }
+            }
+        }
+
         match &*repos.read() {
             Some(Some(resp)) => {
                 let total_pages = resp.total.unwrap_or(0).div_ceil(20).max(1);
@@ -257,7 +473,9 @@ pub fn RepositoriesPage() -> Element {
                                             let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
                                             let repo_id_scan = repo_id.clone();
                                             let repo_id_del = repo_id.clone();
+                                            let repo_id_edit = repo_id.clone();
                                             let repo_name_del = repo.name.clone();
+                                            let edit_repo_data = repo.clone();
                                             let is_scanning = scanning_ids().contains(&repo_id);
                                             rsx! {
                                                 tr {
@@ -302,6 +520,32 @@ pub fn RepositoriesPage() -> Element {
                                                             },
                                                             Icon { icon: BsDiagram3, width: 16, height: 16 }
                                                         }
+                                                        button {
+                                                            class: "btn btn-ghost",
+                                                            title: "Edit repository",
+                                                            onclick: move |_| {
+                                                                edit_name.set(edit_repo_data.name.clone());
+                                                                edit_branch.set(edit_repo_data.default_branch.clone());
+                                                                edit_tracker_type.set(
+                                                                    edit_repo_data.tracker_type.as_ref().map(|t| t.to_string()).unwrap_or_default()
+                                                                );
+                                                                edit_tracker_owner.set(edit_repo_data.tracker_owner.clone().unwrap_or_default());
+                                                                edit_tracker_repo.set(edit_repo_data.tracker_repo.clone().unwrap_or_default());
+                                                                edit_tracker_token.set(String::new());
+                                                                edit_webhook_secret.set(None);
+                                                                edit_webhook_tracker.set(String::new());
+                                                                edit_repo_id.set(Some(repo_id_edit.clone()));
+                                                                // Fetch webhook config in background
+                                                                let rid = repo_id_edit.clone();
+                                                                spawn(async move {
+                                                                    if let Ok(cfg) = crate::infrastructure::repositories::fetch_webhook_config(rid).await {
+                                                                        edit_webhook_secret.set(cfg.webhook_secret);
+                                                                        edit_webhook_tracker.set(cfg.tracker_type);
+                                                                    }
+                                                                });
+                                                            },
+                                                            Icon { icon: BsPencil, width: 16, height: 16 }
+                                                        }
                                                         button {
                                                             class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
                                                             title: "Trigger scan",

compliance-dashboard/src/pages/sbom.rs

@@ -677,23 +677,32 @@ fn license_type_class(is_copyleft: bool) -> &'static str {
 #[cfg(feature = "web")]
 fn trigger_download(content: &str, filename: &str) {
     use wasm_bindgen::JsCast;
-    let window = web_sys::window().expect("no window");
-    let document = window.document().expect("no document");
+    let Some(window) = web_sys::window() else {
+        return;
+    };
+    let Some(document) = window.document() else {
+        return;
+    };
 
     let blob_parts = js_sys::Array::new();
     blob_parts.push(&wasm_bindgen::JsValue::from_str(content));
 
-    let mut opts = web_sys::BlobPropertyBag::new();
-    opts.type_("application/json");
-    let blob = web_sys::Blob::new_with_str_sequence_and_options(&blob_parts, &opts).expect("blob");
+    let opts = web_sys::BlobPropertyBag::new();
+    opts.set_type("application/json");
+    let Ok(blob) = web_sys::Blob::new_with_str_sequence_and_options(&blob_parts, &opts) else {
+        return;
+    };
 
-    let url = web_sys::Url::create_object_url_with_blob(&blob).expect("object url");
+    let Ok(url) = web_sys::Url::create_object_url_with_blob(&blob) else {
+        return;
+    };
 
-    let a: web_sys::HtmlAnchorElement = document
-        .create_element("a")
-        .expect("create a")
-        .dyn_into()
-        .expect("cast");
+    let Ok(el) = document.create_element("a") else {
+        return;
+    };
+    let Ok(a) = el.dyn_into::<web_sys::HtmlAnchorElement>() else {
+        return;
+    };
     a.set_href(&url);
     a.set_download(filename);
     a.click();