improvements: address feedback and setup queue worker profiles

backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-factory.ts

@@ -1,5 +1,6 @@
 import { join } from "path";
 import { ProbotOctokit } from "probot";
+import RE2 from "re2";
 
 import { scanContentAndGetFindings } from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns";
 import { SecretMatch } from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-queue-types";
@@ -28,6 +29,8 @@ import { listGitHubRadarRepositories, TGitHubRadarConnection } from "@app/servic
 
 import { TGitHubDataSourceWithConnection, TQueueGitHubResourceDiffScan } from "./github-secret-scanning-types";
 
+const GitHubRepositoryRegex = new RE2(/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/);
+
 export const GitHubSecretScanningFactory = () => {
   const initialize: TSecretScanningFactoryInitialize<TGitHubRadarConnection> = async (
     { connection, secretScanningV2DAL },
@@ -104,6 +107,10 @@ export const GitHubSecretScanningFactory = () => {
 
     const repoPath = join(tempFolder, "repo.git");
 
+    if (!GitHubRepositoryRegex.test(resourceName)) {
+      throw new Error("Invalid GitHub repository name");
+    }
+
     await cloneRepository({
       cloneUrl: `https://x-access-token:${token}@github.com/${resourceName}.git`,
       repoPath

backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-service.ts

@@ -13,7 +13,8 @@ export const githubSecretScanningService = (
 ) => {
   const handleInstallationDeletedEvent = async (installationId: number) => {
     const dataSource = await secretScanningV2DAL.dataSources.findOne({
-      externalId: String(installationId)
+      externalId: String(installationId),
+      type: SecretScanningDataSource.GitHub
     });
 
     if (!dataSource) {

backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-fns.ts

@@ -1,5 +1,6 @@
 import { AxiosError } from "axios";
 import { exec } from "child_process";
+import RE2 from "re2";
 
 import { readFindingsFile } from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns";
 import { SecretMatch } from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-queue-types";
@@ -83,6 +84,8 @@ export const replaceNonChangesWithNewlines = (patch: string) => {
     .join("\n");
 };
 
+const HunkHeaderRegex = new RE2(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+
 export const convertPatchLineToFileLineNumber = (patch: string, patchLineNumber: number) => {
   const lines = patch.split("\n");
   let currentPatchLine = 0;
@@ -92,7 +95,7 @@ export const convertPatchLineToFileLineNumber = (patch: string, patchLineNumber:
     currentPatchLine += 1;
 
     // Hunk header: @@ -a,b +c,d @@
-    const hunkHeaderMatch = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+    const hunkHeaderMatch = line.match(HunkHeaderRegex);
     if (hunkHeaderMatch) {
       const startLine = parseInt(hunkHeaderMatch[1], 10);
       currentNewLine = startLine;

backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-queue.ts

@@ -28,7 +28,6 @@ import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { TSecretScanningV2DALFactory } from "./secret-scanning-v2-dal";
 import {
   SecretScanningDataSource,
-  SecretScanningFindingStatus,
   SecretScanningResource,
   SecretScanningScanStatus,
   SecretScanningScanType
@@ -217,12 +216,11 @@ export const secretScanningV2QueueServiceFactory = async ({
                 dataSourceType: dataSource.type,
                 resourceName: resource.name,
                 resourceType: resource.type,
-                scanId,
-                status: SecretScanningFindingStatus.Unresolved
+                scanId
               })),
               ["projectId", "fingerprint"],
               tx,
-              ["resourceName", "dataSourceName", "status"]
+              ["resourceName", "dataSourceName"]
             );
           }
 
@@ -441,12 +439,11 @@ export const secretScanningV2QueueServiceFactory = async ({
                 dataSourceType: dataSource.type,
                 resourceName: resource.name,
                 resourceType: resource.type,
-                scanId,
-                status: SecretScanningFindingStatus.Unresolved
+                scanId
               })),
               ["projectId", "fingerprint"],
               tx,
-              ["resourceName", "dataSourceName", "status"]
+              ["resourceName", "dataSourceName"]
             );
           }
 

backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-service.ts

@@ -1,4 +1,5 @@
 import { ForbiddenError } from "@casl/ability";
+import { join } from "path";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
@@ -9,6 +10,12 @@ import {
   ProjectPermissionSecretScanningFindingActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
+import {
+  createTempFolder,
+  deleteTempFolder,
+  scanContentAndGetFindings,
+  writeTextToFile
+} from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-fns";
 import { githubSecretScanningService } from "@app/ee/services/secret-scanning-v2/github/github-secret-scanning-service";
 import { SecretScanningFindingStatus } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-enums";
 import { SECRET_SCANNING_FACTORY_MAP } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-factory";
@@ -810,10 +817,26 @@ export const secretScanningV2ServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretScanningConfigActions.Read,
+      ProjectPermissionSecretScanningConfigActions.Update,
       ProjectPermissionSub.SecretScanningConfigs
     );
 
+    if (content) {
+      const tempFolder = await createTempFolder();
+      try {
+        const configPath = join(tempFolder, "infisical-scan.toml");
+        await writeTextToFile(configPath, content);
+
+        await scanContentAndGetFindings("", configPath);
+      } catch (e) {
+        throw new BadRequestError({
+          message: "Unable to parse configuration: Check syntax and formatting."
+        });
+      } finally {
+        await deleteTempFolder(tempFolder);
+      }
+    }
+
     const [config] = await secretScanningV2DAL.configs.upsert(
       [
         {