update risk status and update email notifications

backend/src/controllers/v1/secretScanningController.ts

@@ -5,7 +5,7 @@ import { Types } from "mongoose";
 import { UnauthorizedRequestError } from "../../utils/errors";
 import GitAppOrganizationInstallation from "../../models/gitAppOrganizationInstallation";
 import { MembershipOrg } from "../../models";
-import GitRisks, { STATUS_UNRESOLVED } from "../../models/gitRisks";
+import GitRisks, { STATUS_RESOLVED_FALSE_POSITIVE, STATUS_RESOLVED_NOT_REVOKED, STATUS_RESOLVED_REVOKED } from "../../models/gitRisks";
 
 export const createInstallationSession = async (req: Request, res: Response) => {
   const sessionId = crypto.randomBytes(16).toString("hex");
@@ -72,7 +72,7 @@ export const getCurrentOrganizationInstallationStatus = async (req: Request, res
 
 export const getRisksForOrganization = async (req: Request, res: Response) => {
   const { organizationId } = req.params
-  const risks = await GitRisks.find({ organization: organizationId, status: STATUS_UNRESOLVED }).sort({ createdAt: -1 }).lean()
+  const risks = await GitRisks.find({ organization: organizationId }).sort({ createdAt: -1 }).lean()
   res.json({
     risks: risks
   })
@@ -81,9 +81,11 @@ export const getRisksForOrganization = async (req: Request, res: Response) => {
 export const updateRisksStatus = async (req: Request, res: Response) => {
   const { riskId } = req.params
   const { status } = req.body
-  const risks = await GitRisks.findByIdAndUpdate(riskId, {
-    sttaus: status
+  const isRiskResolved = status == STATUS_RESOLVED_FALSE_POSITIVE || status == STATUS_RESOLVED_REVOKED || status == STATUS_RESOLVED_NOT_REVOKED ? true : false
+  const risk = await GitRisks.findByIdAndUpdate(riskId, {
+    status: status,
+    isResolved: isRiskResolved
   }).lean()
 
-  res.json(risks)
+  res.json(risk)
 }

backend/src/routes/v1/secretScanning.ts

@@ -69,6 +69,7 @@ router.post(
   }),
   param("organizationId").exists().trim(),
   param("riskId").exists().trim(),
+  body("status").exists(),
   requireOrganizationAuth({
     acceptedRoles: [OWNER, ADMIN, MEMBER],
     acceptedStatuses: [ACCEPTED],

backend/src/services/GithubSecretScanningService.ts

@@ -3,7 +3,7 @@ import { exec } from "child_process";
 import { mkdir, readFile, rm, writeFile } from "fs";
 import { tmpdir } from "os";
 import { join } from "path"
-import GitRisks, { STATUS_RESOLVED_FALSE_POSITIVE } from "../models/gitRisks";
+import GitRisks from "../models/gitRisks";
 import GitAppOrganizationInstallation from "../models/gitAppOrganizationInstallation";
 import MembershipOrg from "../models/membershipOrg";
 import { ADMIN, OWNER } from "../variables";
@@ -98,8 +98,6 @@ export default async (app: Probot) => {
     }
 
     // change to update
-    const noneFalsePositiveFindings: { [key: string]: SecretMatch; } = {}
-
     for (const key in allFindingsByFingerprint) {
       const risk = await GitRisks.findOneAndUpdate({ fingerprint: allFindingsByFingerprint[key].Fingerprint },
         {
@@ -111,11 +109,6 @@ export default async (app: Probot) => {
         }, {
         upsert: true
       }).lean()
-
-      if (risk?.status == STATUS_RESOLVED_FALSE_POSITIVE) {
-        noneFalsePositiveFindings[key] = { ...convertKeysToLowercase(allFindingsByFingerprint[key]) }
-      }
-
     }
     // get emails of admins
     const adminsOfWork = await MembershipOrg.find({

backend/src/templates/secretLeakIncident.handlebars

@@ -11,9 +11,14 @@
   <h3>Infisical has uncovered {{numberOfSecrets}} secret(s) from your recent push</h3>
   <p><a href="https://app.infisical.com/secret-scanning"><strong>View leaked secrets</strong></a></p>
   <p>One or more secret leaks have been detected in a recent commit pushed by {{pusher_name}} ({{pusher_email}}). If
-    the secrets are test secrets, please mark them as false positives in the <a
-      href="https://app.infisical.com/">Infisical dashboard</a>.
-    Otherwise, please rotate the secrets immediately.</p>
+    these are test secrets, please add `infisical-scan:ignore` at the end of the line containing the secret as comment
+    in the given programming. This will prevent future notifications from being sent out for the given secret(s).</p>
+
+  <p>If these are production secrets, please rotate them immediately.</p>
+
+  <p>Once you have taken action, be sure to update the status of the risk in your<a
+      href="https://app.infisical.com/">Infisical
+      dashboard</a>.</p>
 </body>
 
 </html>