cve-dashboard/backend/routes/ivantiTodoQueue.js

// routes/ivantiTodoQueue.js
const express = require('express');
const { requireGroup } = require('../middleware/auth');
const logAudit = require('../helpers/auditLog');

const VALID_WORKFLOW_TYPES = ['FP', 'Archer', 'CARD'];
const VALID_STATUSES       = ['pending', 'complete'];

function isValidVendor(vendor) {
    if (typeof vendor !== 'string') return false;
    const trimmed = vendor.trim();
    return trimmed.length > 0 && trimmed.length <= 200;
}

function createIvantiTodoQueueRouter(db, requireAuth) {
    const router = express.Router();

    /**
     * GET /api/ivanti/todo-queue
     *
     * Fetch the current user's queue items, ordered by vendor then created_at.
     *
     * @returns {Array<Object>} 200 - Array of queue items, each with:
     *   id, user_id, finding_id, finding_title, cves_json, ip_address,
     *   vendor, workflow_type, status, created_at, updated_at, cves (parsed array)
     * @returns {Object} 500 - { error: string } on database error
     */
    router.get('/', requireAuth(db), (req, res) => {
        db.all(
            `SELECT q.*,
                    o.value AS override_hostname
             FROM ivanti_todo_queue q
             LEFT JOIN ivanti_finding_overrides o
                    ON o.finding_id = q.finding_id AND o.field = 'hostName'
             WHERE q.user_id = ?
             ORDER BY q.vendor ASC, q.created_at ASC`,
            [req.user.id],
            (err, rows) => {
                if (err) {
                    console.error('Error fetching todo queue:', err);
                    return res.status(500).json({ error: 'Internal server error.' });
                }
                // Parse cves_json back to array; prefer overridden hostname
                const parsed = rows.map((r) => ({
                    ...r,
                    hostname: r.override_hostname || r.hostname,
                    cves: r.cves_json ? JSON.parse(r.cves_json) : [],
                }));
                // Clean up the extra column from the response
                parsed.forEach((r) => delete r.override_hostname);
                res.json(parsed);
            }
        );
    });

    /**
     * POST /api/ivanti/todo-queue/batch
     *
     * Add multiple findings to the current user's queue in a single transaction.
     *
     * @body {Object[]} findings        - Required array of 1–200 finding objects
     * @body {string} findings[].finding_id    - Required, non-empty finding identifier
     * @body {string} [findings[].finding_title] - Optional finding title (max 500 chars)
     * @body {string[]} [findings[].cves]        - Optional array of CVE identifiers
     * @body {string} [findings[].ip_address]    - Optional IP address (max 64 chars)
     * @body {string} [findings[].hostname]      - Optional hostname (max 255 chars)
     * @body {string} workflow_type     - One of 'FP', 'Archer', 'CARD'
     * @body {string} vendor            - Required for FP/Archer (max 200 chars); optional for CARD
     *
     * @returns {Object} 201 - { items: Array<Object> } array of created queue items,
     *   each with: id, user_id, finding_id, finding_title, cves_json, ip_address,
     *   vendor, workflow_type, status, created_at, updated_at, cves (parsed array)
     * @returns {Object} 400 - { error: string } on validation failure
     * @returns {Object} 500 - { error: string } on database/transaction error (all inserts rolled back)
     */
    router.post('/batch', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
        const { findings, workflow_type, vendor } = req.body;

        // --- Validation ---
        if (!Array.isArray(findings) || findings.length < 1 || findings.length > 200) {
            return res.status(400).json({ error: 'findings array must contain 1-200 items.' });
        }

        for (let i = 0; i < findings.length; i++) {
            const f = findings[i];
            if (!f || typeof f.finding_id !== 'string' || f.finding_id.trim().length === 0) {
                return res.status(400).json({ error: 'Each finding must have a non-empty finding_id string.' });
            }
        }

        if (!VALID_WORKFLOW_TYPES.includes(workflow_type)) {
            return res.status(400).json({ error: 'workflow_type must be FP, Archer, or CARD.' });
        }

        if (workflow_type !== 'CARD') {
            if (!isValidVendor(vendor)) {
                return res.status(400).json({ error: 'vendor is required for FP and Archer workflows.' });
            }
        }

        if (vendor !== undefined && vendor !== '' && typeof vendor === 'string' && vendor.trim().length > 200) {
            return res.status(400).json({ error: 'vendor must be under 200 chars.' });
        }

        const vendorVal = workflow_type === 'CARD' ? '' : vendor.trim();
        const userId = req.user.id;

        // --- Transactional batch insert ---
        // Prepare all row values upfront
        const rows = findings.map((f) => {
            const findingId = f.finding_id.trim();
            const title = f.finding_title && typeof f.finding_title === 'string'
                ? f.finding_title.slice(0, 500)
                : null;
            const cvesJson = Array.isArray(f.cves) ? JSON.stringify(f.cves) : null;
            const ipVal = f.ip_address && typeof f.ip_address === 'string'
                ? f.ip_address.trim().slice(0, 64)
                : null;
            const hostVal = f.hostname && typeof f.hostname === 'string'
                ? f.hostname.trim().slice(0, 255)
                : null;
            return [userId, findingId, title, cvesJson, ipVal, hostVal, vendorVal, workflow_type];
        });

        const insertedIds = [];
        let insertError = null;
        let remaining = rows.length;

        db.serialize(() => {
            db.run('BEGIN TRANSACTION');

            rows.forEach((params) => {
                db.run(
                    `INSERT INTO ivanti_todo_queue
                         (user_id, finding_id, finding_title, cves_json, ip_address, hostname, vendor, workflow_type)
                     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
                    params,
                    function (err) {
                        if (err && !insertError) {
                            insertError = err;
                        } else if (!err) {
                            insertedIds.push(this.lastID);
                        }
                        remaining--;

                        // After all insert callbacks have fired, commit or rollback
                        if (remaining === 0) {
                            if (insertError) {
                                db.run('ROLLBACK', () => {
                                    console.error('Batch insert error:', insertError);
                                    return res.status(500).json({ error: 'Internal server error.' });
                                });
                            } else {
                                db.run('COMMIT', (commitErr) => {
                                    if (commitErr) {
                                        console.error('Batch commit error:', commitErr);
                                        db.run('ROLLBACK', () => {});
                                        return res.status(500).json({ error: 'Internal server error.' });
                                    }

                                    // Fetch all inserted rows
                                    const placeholders = insertedIds.map(() => '?').join(',');
                                    db.all(
                                        `SELECT * FROM ivanti_todo_queue WHERE id IN (${placeholders})`,
                                        insertedIds,
                                        (fetchErr, fetchedRows) => {
                                            if (fetchErr) {
                                                console.error('Error fetching inserted batch rows:', fetchErr);
                                                return res.status(500).json({ error: 'Internal server error.' });
                                            }

                                            const items = (fetchedRows || []).map((r) => ({
                                                ...r,
                                                cves: r.cves_json ? JSON.parse(r.cves_json) : [],
                                            }));

                                            // Audit log (fire-and-forget)
                                            logAudit(db, {
                                                userId: req.user.id,
                                                username: req.user.username,
                                                action: 'batch_add_to_queue',
                                                entityType: 'ivanti_todo_queue',
                                                entityId: null,
                                                details: {
                                                    count: insertedIds.length,
                                                    workflow_type: workflow_type,
                                                    finding_ids: findings.map((f) => f.finding_id.trim()),
                                                },
                                                ipAddress: req.ip,
                                            });

                                            return res.status(201).json({ items });
                                        }
                                    );
                                });
                            }
                        }
                    }
                );
            });
        });
    });

    /**
     * POST /api/ivanti/todo-queue
     *
     * Add a single finding to the current user's queue.
     *
     * @body {string} finding_id       - Required, non-empty finding identifier
     * @body {string} [finding_title]   - Optional finding title (max 500 chars)
     * @body {string[]} [cves]          - Optional array of CVE identifiers
     * @body {string} [ip_address]      - Optional IP address (max 64 chars)
     * @body {string} [hostname]        - Optional hostname (max 255 chars)     * @body {string} vendor            - Required for FP/Archer (max 200 chars); optional for CARD
     * @body {string} workflow_type     - One of 'FP', 'Archer', 'CARD'
     *
     * @returns {Object} 201 - Created queue item with parsed cves array:
     *   id, user_id, finding_id, finding_title, cves_json, ip_address,
     *   vendor, workflow_type, status, created_at, updated_at, cves
     * @returns {Object} 400 - { error: string } on validation failure
     * @returns {Object} 500 - { error: string } on database error
     */
    router.post('/', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
        const { finding_id, finding_title, cves, ip_address, hostname, vendor, workflow_type } = req.body;

        if (!finding_id || typeof finding_id !== 'string' || finding_id.trim().length === 0) {
            return res.status(400).json({ error: 'finding_id is required.' });
        }
        if (!VALID_WORKFLOW_TYPES.includes(workflow_type)) {
            return res.status(400).json({ error: 'workflow_type must be FP, Archer, or CARD.' });
        }
        // Vendor is required for FP and Archer, optional for CARD
        if (workflow_type !== 'CARD' && !isValidVendor(vendor)) {
            return res.status(400).json({ error: 'vendor is required for FP and Archer workflows.' });
        }
        if (vendor !== undefined && vendor !== '' && !isValidVendor(vendor)) {
            return res.status(400).json({ error: 'vendor must be under 200 chars.' });
        }

        const vendorVal = workflow_type === 'CARD' ? '' : vendor.trim();
        const cvesJson  = Array.isArray(cves) ? JSON.stringify(cves) : null;
        const ipVal     = ip_address && typeof ip_address === 'string' ? ip_address.trim().slice(0, 64) : null;
        const hostVal   = hostname && typeof hostname === 'string' ? hostname.trim().slice(0, 255) : null;
        const title     = finding_title && typeof finding_title === 'string'
            ? finding_title.slice(0, 500)
            : null;

        db.run(
            `INSERT INTO ivanti_todo_queue
                 (user_id, finding_id, finding_title, cves_json, ip_address, hostname, vendor, workflow_type)
             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
            [req.user.id, finding_id.trim(), title, cvesJson, ipVal, hostVal, vendorVal, workflow_type],
            function (err) {
                if (err) {
                    console.error('Error adding to queue:', err);
                    return res.status(500).json({ error: 'Internal server error.' });
                }
                db.get(
                    'SELECT * FROM ivanti_todo_queue WHERE id = ?',
                    [this.lastID],
                    (err2, row) => {
                        if (err2 || !row) {
                            return res.status(201).json({ id: this.lastID, message: 'Added to queue.' });
                        }
                        res.status(201).json({ ...row, cves: row.cves_json ? JSON.parse(row.cves_json) : [] });
                    }
                );
            }
        );
    });

    /**
     * PUT /api/ivanti/todo-queue/:id
     *
     * Update vendor, workflow_type, or status on a queue item — scoped to current user.
     *
     * @param {string} id               - Queue item ID (URL parameter)
     * @body {string} [vendor]          - New vendor string (max 200 chars)
     * @body {string} [workflow_type]   - One of 'FP', 'Archer', 'CARD'
     * @body {string} [status]          - One of 'pending', 'complete'
     *
     * @returns {Object} 200 - Updated queue item with parsed cves array:
     *   id, user_id, finding_id, finding_title, cves_json, ip_address,
     *   vendor, workflow_type, status, created_at, updated_at, cves
     * @returns {Object} 400 - { error: string } on validation failure or no fields to update
     * @returns {Object} 404 - { error: string } if item not found for current user
     * @returns {Object} 500 - { error: string } on database error
     */
    router.put('/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
        const { id } = req.params;
        const { vendor, workflow_type, status } = req.body;

        if (vendor !== undefined && !isValidVendor(vendor)) {
            return res.status(400).json({ error: 'vendor must be a non-empty string (max 200 chars).' });
        }
        if (workflow_type !== undefined && !VALID_WORKFLOW_TYPES.includes(workflow_type)) {
            return res.status(400).json({ error: 'workflow_type must be FP or Archer.' });
        }
        if (status !== undefined && !VALID_STATUSES.includes(status)) {
            return res.status(400).json({ error: 'status must be pending or complete.' });
        }

        db.get(
            'SELECT * FROM ivanti_todo_queue WHERE id = ? AND user_id = ?',
            [id, req.user.id],
            (err, existing) => {
                if (err) {
                    console.error(err);
                    return res.status(500).json({ error: 'Internal server error.' });
                }
                if (!existing) {
                    return res.status(404).json({ error: 'Queue item not found.' });
                }

                const updates = [];
                const params  = [];

                if (vendor !== undefined) {
                    updates.push('vendor = ?');
                    params.push(vendor.trim());
                }
                if (workflow_type !== undefined) {
                    updates.push('workflow_type = ?');
                    params.push(workflow_type);
                }
                if (status !== undefined) {
                    updates.push('status = ?');
                    params.push(status);
                }

                if (updates.length === 0) {
                    return res.status(400).json({ error: 'No fields to update.' });
                }

                updates.push('updated_at = CURRENT_TIMESTAMP');
                params.push(id, req.user.id);

                db.run(
                    `UPDATE ivanti_todo_queue SET ${updates.join(', ')} WHERE id = ? AND user_id = ?`,
                    params,
                    function (err2) {
                        if (err2) {
                            console.error(err2);
                            return res.status(500).json({ error: 'Internal server error.' });
                        }
                        db.get(
                            'SELECT * FROM ivanti_todo_queue WHERE id = ?',
                            [id],
                            (err3, row) => {
                                if (err3 || !row) {
                                    return res.json({ message: 'Queue item updated.' });
                                }
                                res.json({ ...row, cves: row.cves_json ? JSON.parse(row.cves_json) : [] });
                            }
                        );
                    }
                );
            }
        );
    });

    /**
     * DELETE /api/ivanti/todo-queue/completed
     *
     * Bulk-delete all completed items for the current user.
     * IMPORTANT: This route must be registered BEFORE DELETE /:id.
     *
     * @returns {Object} 200 - { message: string, deleted: number }
     * @returns {Object} 500 - { error: string } on database error
     */
    router.delete('/completed', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
        db.run(
            "DELETE FROM ivanti_todo_queue WHERE user_id = ? AND status = 'complete'",
            [req.user.id],
            function (err) {
                if (err) {
                    console.error('Error clearing completed queue items:', err);
                    return res.status(500).json({ error: 'Internal server error.' });
                }
                res.json({ message: 'Completed items cleared.', deleted: this.changes });
            }
        );
    });

    /**
     * DELETE /api/ivanti/todo-queue/:id
     *
     * Delete a single queue item — scoped to current user.
     *
     * @param {string} id - Queue item ID (URL parameter)
     *
     * @returns {Object} 200 - { message: string }
     * @returns {Object} 404 - { error: string } if item not found for current user
     * @returns {Object} 500 - { error: string } on database error
     */
    router.delete('/:id', requireAuth(db), requireGroup('Admin', 'Standard_User'), (req, res) => {
        const { id } = req.params;

        db.get(
            'SELECT id FROM ivanti_todo_queue WHERE id = ? AND user_id = ?',
            [id, req.user.id],
            (err, row) => {
                if (err) {
                    console.error(err);
                    return res.status(500).json({ error: 'Internal server error.' });
                }
                if (!row) {
                    return res.status(404).json({ error: 'Queue item not found.' });
                }

                db.run(
                    'DELETE FROM ivanti_todo_queue WHERE id = ? AND user_id = ?',
                    [id, req.user.id],
                    function (err2) {
                        if (err2) {
                            console.error(err2);
                            return res.status(500).json({ error: 'Internal server error.' });
                        }
                        res.json({ message: 'Queue item deleted.' });
                    }
                );
            }
        );
    });

    return router;
}

module.exports = createIvantiTodoQueueRouter;