Skip to content

feat: add plugin dependency health check on startup (#1979) - #2245

Closed
aarushlohit wants to merge 940 commits into
utksh1:mainfrom
aarushlohit:feat/plugin-dependency-health-check
Closed

feat: add plugin dependency health check on startup (#1979)#2245
aarushlohit wants to merge 940 commits into
utksh1:mainfrom
aarushlohit:feat/plugin-dependency-health-check

Conversation

@aarushlohit

Copy link
Copy Markdown
Contributor

Description

Proactively checks for required CLI dependencies when the SecuScan backend starts and surfaces warnings before the user tries to run a scan. Previously, a task would fail
abruptly at runtime if a required binary (e.g., nmap, gobuster) was missing from the system PATH.

Related Issues

Closes #1979

Type of Change

  • New feature (non-breaking change which adds functionality)

How Has This Been Tested?

  • All 27 existing unit tests in testing/backend/unit/test_plugins.py pass
  • Added assertions in test_plugin_list_exposes_runtime_capabilities verifying is_available mirrors the runtime runnable state
  • Added new test test_plugin_schema_includes_availability validating get_plugin_schema() returns a complete availability block
  • At startup, plugins with missing binaries emit a WARNING log (e.g. Plugin Nmap (nmap) is unavailable — missing dependency binaries: nmap) and a summary line is logged
    (Plugin dependency health: 50 available, 9 unavailable)

What Changed

Backend (backend/secuscan/plugins.py)

  • list_plugins() now returns is_available: bool alongside the existing availability block

  • load_plugins() loops through each successfully loaded plugin at startup, calls _get_missing_binaries(), logs a WARNING per plugin missing dependencies, and logs a
    summary count of available/unavailable plugins

  • get_plugin_schema() now includes the full availability dict so the /api/v1/plugin/{id}/schema endpoint also exposes dependency health

Frontend

  • frontend/src/api.ts — added is_available: boolean to PluginListItem; added optional availability?: PluginAvailability to PluginSchemaResponse

  • frontend/src/pages/ToolConfig.tsx — INITIATE_SCAN button is disabled when any dependency binary is missing; button label changes to MISSING_DEPENDENCIES; a tooltip line
    renders below the button listing missing binaries (e.g. Missing dependency: nmap)

  • frontend/src/pages/Toolkit.tsx — plugin catalog cards are marked disabled when !plugin.availability.runnable, showing in reduced opacity/grayscale with the existing
    lock overlay

Checklist

  • My code follows the code style of this project.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have made corresponding changes to the documentation.
  • My changes generate no new warnings.
  • I have added tests that verify my changes.
  • New and existing unit tests pass locally.

Rakshak05 and others added 30 commits June 30, 2026 08:45
utksh1#1398

# Please enter a commit message to explain why this merge is necessary,
# especially if it merges an updated upstream into a topic branch.
#
# Lines starting with '#' will be ignored, and an empty message aborts
# the commit.
- New reportTemplates.ts service with ReportTemplate type, three built-in
  templates (executive, technical, compliance), and render/preview/export.
- ReportTemplatePicker.tsx slide-over component with type filtering, inline
  preview, and .md export.
- Integrate Templates button into Reports.tsx report cards.
- 21 unit tests covering template lifecycle, edge cases, and output.
…1546)

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
…h1#1542)

Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Co-authored-by: tmdeveloper007 <tmdeveloper007@users.noreply.github.com>
Rakshak05 and others added 23 commits July 20, 2026 11:52
…-parser-validation

fix(plugins): enforce strict validation and integrity checks for missing custom parser utksh1#1812
…to ID generation

Addresses Bandit HIGH severity findings:
- finding_intelligence.py:75 - stable ID generation
- platform_resources.py:29 - asset ID generation

These SHA1 usages are for deterministic hashing to create stable IDs,
not for cryptographic security purposes. Adding usedforsecurity=False
clarifies the intent and resolves the security linter warnings.
The debug default was changed from True to False in the security fix.
Update the test to match the new secure default.
The saved_views_router now has require_api_key dependency.
Override it in tests to bypass authentication for unit testing.
Add shared time_utils helpers and use timezone-aware UTC with an
explicit offset for generated_at and discovered_at across reports,
findings API responses, and report generation.

Closes utksh1#1882
Default to_utc_iso to timespec=auto so finding intelligence tests can
compare against datetime.now(UTC). Update TLS verification mocks for
crawler client.stream() and stub crawl_target in API scanner tests.
…idable

_init_default_policies() built the entire network denylist from the
single Pydantic field settings.network_denylist. Pydantic replaces
(rather than merges) a list field's default when SECUSCAN_NETWORK_DENYLIST
is set via env var, so any operator adding even one custom denylist
entry silently dropped the built-in protection for cloud metadata
(169.254.169.254), loopback, RFC1918/CGNAT ranges, and IPv6
link-local/ULA space -- reopening SSRF to the metadata endpoint despite
the code comment claiming the denylist was 'always enforced'.

Fix: move those ranges into a new MANDATORY_DENYLIST module constant
that is not read from settings and is applied unconditionally in
_init_default_policies before any operator-configured entries. The
operator-facing network_denylist setting is now purely additive.

Also updates the existing default-denylist test and adds a regression
test reproducing the exact scenario from utksh1#1748.
…ne-standardize-9bb6

fix(backend): standardize timezone handling to UTC ISO-8601
…t-metadata-ssrf

Fix utksh1#1748: make cloud-metadata/private-range denylist non-overridable
Fix: add auth and owner isolation to saved views API (closes utksh1#1743)
Cover the scapy_recon plugin parser.py with targeted behavioural tests:

- Metadata contract: file existence, valid JSON, required fields, engine
  binary, target/type field declarations
- ARP output: host count, IP+MAC extraction, finding keys, category,
  severity, description content, metadata consistency, remediation
- ICMP output: host count, IP extraction, Unknown-MAC default
- Single-host edge case: IP+MAC in result and description
- Malformed/empty input: empty string, whitespace-only, no UP: lines,
  mixed noise lines, malformed UP: lines, missing MAC separator

No changes to backend source; test file only.
@aarushlohit

Copy link
Copy Markdown
Contributor Author

@utksh1

@utksh1 utksh1 added area:backend Backend API, database, or service work area:plugins Scanner plugin metadata, schemas, or plugin runtime work level:intermediate 35 pts difficulty label for moderate contributor PRs type:feature Feature work category bonus label labels Jul 30, 2026 — with ChatGPT Codex Connector
@utksh1 utksh1 closed this Aug 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:backend Backend API, database, or service work area:plugins Scanner plugin metadata, schemas, or plugin runtime work level:intermediate 35 pts difficulty label for moderate contributor PRs type:feature Feature work category bonus label

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature: Plugin Dependency Health Check on Startup