feat(onboarding): input validation + editable targets #160

Merged

sharang merged 1 commits from feat/onboarding-validation-edit into main 2026-07-13 17:57:49 +00:00

Conversation 0 Commits 1 Files Changed 6

+374 -6

sharang commented 2026-07-13 17:51:48 +00:00

Owner

Copy Link

Copy Source

Two fixes for gaps hit during firmware testing (a pasted label in a git URL, a slash in the target name) — both were only caught at scan time, and targets couldn't be edited.

Validation (shared by wizard + editor)

• validate_target_name — non-empty, no stray spaces, no slashes (the name is the clone directory).
• validate_artifact_ref — per kind: git-URL shape, http(s) for live URLs, image-ref/path otherwise. Wizard shows the error inline and disables Next / + Add until clean.

Editable targets

• PATCH /api/v1/targets/{id} now accepts an artifacts replacement.
• New update_target server fn + an Edit modal on the Targets page: rename, change type, add/remove artifacts (same validation), Save.

Robustness

• GitOps::clone_or_fetch sanitizes the repo name to one filesystem-safe segment — a slash can never nest/break the clone path again (this was the could not find repository at /tmp/.../ChristianRinn/bare_metal_stm32f411xe failure). Unit test included.
• Drive-by clippy: sbom summary sort_by_key(Reverse(..)).

Local: agent clippy + git test pass; dashboard server + web cargo check clean. (Dashboard lint is CI's job — local clippy is 1.97 and flags pre-existing 1.94-clean code.)

Two fixes for gaps hit during firmware testing (a pasted label in a git URL, a slash in the target name) — both were only caught at scan time, and targets couldn't be edited. ## Validation (shared by wizard + editor) - **`validate_target_name`** — non-empty, no stray spaces, **no slashes** (the name is the clone directory). - **`validate_artifact_ref`** — per kind: git-URL shape, http(s) for live URLs, image-ref/path otherwise. Wizard shows the error inline and disables **Next** / **+ Add** until clean. ## Editable targets - **`PATCH /api/v1/targets/{id}`** now accepts an `artifacts` replacement. - New `update_target` server fn + an **Edit modal** on the Targets page: rename, change type, add/remove artifacts (same validation), Save. ## Robustness - **`GitOps::clone_or_fetch` sanitizes the repo name** to one filesystem-safe segment — a slash can never nest/break the clone path again (this was the `could not find repository at /tmp/.../ChristianRinn/bare_metal_stm32f411xe` failure). Unit test included. - Drive-by clippy: `sbom` summary `sort_by_key(Reverse(..))`. Local: agent clippy + git test pass; dashboard server + web `cargo check` clean. (Dashboard lint is CI's job — local clippy is 1.97 and flags pre-existing 1.94-clean code.)

sharang added 1 commit 2026-07-13 17:51:49 +00:00

feat(onboarding): input validation + editable targets ... 96763b7fe9

Two gaps surfaced while testing: bad input (a pasted label in a git URL, a
slash in the name) was only discovered at scan time, and there was no way to
fix a target once created.

Validation (client-side, shared by the wizard and the editor):
- `validate_target_name` — non-empty, no stray spaces, no slashes (the name is
  used as the clone directory).
- `validate_artifact_ref` — per-kind checks (git URL shape, http(s) for live
  URLs, image-ref/path for the rest). The wizard shows the error inline and
  disables Next / + Add until it's clean.

Editing:
- `PATCH /api/v1/targets/{id}` now accepts an `artifacts` replacement.
- New `update_target` server fn + an Edit modal on the Targets page: change
  name, type, and add/remove artifacts (same validation), then Save.

Robustness:
- `GitOps::clone_or_fetch` sanitizes the repo name into one filesystem-safe
  directory segment, so a slash (or other path-hostile char) in a name can
  never nest or break the clone path again (+ unit test).
- Drive-by: `sbom` license summary uses `sort_by_key(Reverse(..))`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sharang merged commit 87f240b26f into main 2026-07-13 17:57:49 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0-demo

CERTifAI P0 demo build tickets (CS-*)

bug

critical

enhancement

epic

Tracking issue spanning multiple sub-issues

high

infrastructure

onboarding

Multi-target onboarding wizard redesign

performance

security

v0.3.0

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#160