CyberStrikeAI/internal/handler/vulnerability_workspace.go

package handler

import (
	"cyberstrike-ai/internal/database"
	"cyberstrike-ai/internal/security"
	"github.com/gin-gonic/gin"
	"net/http"
)

func (h *VulnerabilityHandler) VulnerabilityContext(c *gin.Context) {
	v, err := h.db.GetVulnerability(c.Param("id"))
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "漏洞不存在"})
		return
	}
	history, err := h.db.VulnerabilityHistory(v.ID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
		return
	}
	members := []*database.Vulnerability{}
	if v.CaseID != "" {
		members, err = h.db.ListVulnerabilitiesForAccess(100, 0, database.VulnerabilityListFilter{CaseID: v.CaseID, SummaryOnly: true}, vulnerabilityAccessFromContext(c))
		if err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
			return
		}
	}
	assets := []database.VulnerabilityLinkedAsset{}
	if session, ok := security.CurrentSession(c); ok && security.SessionHasPermission(c, "asset:read") {
		assets, err = h.db.VulnerabilityLinkedAssets(v, database.RBACListAccess{UserID: session.UserID, Scope: session.ScopeFor("asset:read")})
		if err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
			return
		}
	}
	c.JSON(http.StatusOK, gin.H{"vulnerability": v, "history": history, "members": members, "assets": assets})
}

func (h *VulnerabilityHandler) MergeVulnerabilities(c *gin.Context) {
	var req struct {
		IDs    []string `json:"ids" binding:"required"`
		Title  string   `json:"title" binding:"required"`
		Reason string   `json:"reason" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil || len(req.Title) > 500 || len(req.Reason) > 4000 {
		c.JSON(http.StatusBadRequest, gin.H{"error": "请提供选中记录、名称和归并理由"})
		return
	}
	access := vulnerabilityAccessFromContext(c)
	id, err := h.db.MergeVulnerabilities(req.IDs, req.Title, req.Reason, access.UserID, access)
	if err != nil {
		c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
		return
	}
	if h.audit != nil {
		h.audit.RecordOK(c, "vulnerability", "merge", "归并漏洞上报", "vulnerability_case", id, map[string]interface{}{"ids": req.IDs})
	}
	c.JSON(http.StatusOK, gin.H{"id": id})
}

func (h *VulnerabilityHandler) DissolveVulnerabilityCase(c *gin.Context) {
	var req struct {
		Reason string `json:"reason" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil || len(req.Reason) > 4000 {
		c.JSON(http.StatusBadRequest, gin.H{"error": "请填写拆分理由"})
		return
	}
	access := vulnerabilityAccessFromContext(c)
	if err := h.db.DissolveVulnerabilityCase(c.Param("caseID"), req.Reason, access.UserID, access); err != nil {
		c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
		return
	}
	if h.audit != nil {
		h.audit.RecordOK(c, "vulnerability", "split", "拆分漏洞归并组", "vulnerability_case", c.Param("caseID"), nil)
	}
	c.JSON(http.StatusOK, gin.H{"ok": true})
}