Graham McIntie
1590f78bdc
- LIKE wildcard injection: sanitize %, _ in search queries (devices, sites, gaiia) - Jason.decode! → Jason.decode with error handling for untrusted input - inspect() leak: replace with generic error messages, log details server-side - SSRF protection: URL validator blocks private IPs, localhost, non-HTTP schemes - SSRF validation added to HTTP monitoring executor and integration credentials - GraphQL complexity limits: always applied, not just in prod - GraphQL introspection: also check GET query params, not just body - Stripe webhook: explicit nil/empty checks for signature and body - Cookie security: secure flag for session (prod), http_only+secure for remember_me - Honeybadger API key: read from env var with fallback - String.to_integer → Integer.parse with fallback for URL params - String.to_atom → whitelist map for HTTP methods - Gaiia webhook: remove secret_len and expected signature from log - Admin API: add rate limiting pipeline - to_atom_keys: per-key fallback instead of all-or-nothing rescue
115 lines
3.4 KiB
Elixir
115 lines
3.4 KiB
Elixir
defmodule ToweropsWeb.EscalationPolicyLive.Show do
|
|
@moduledoc false
|
|
use ToweropsWeb, :live_view
|
|
|
|
alias Towerops.OnCall
|
|
alias Towerops.Organizations
|
|
|
|
@impl true
|
|
def mount(%{"id" => id}, _session, socket) do
|
|
org_id = socket.assigns.current_scope.organization.id
|
|
policy = OnCall.get_escalation_policy!(id, org_id)
|
|
members = Organizations.list_organization_members(org_id)
|
|
users = Enum.map(members, & &1.user)
|
|
schedules = OnCall.list_schedules(org_id)
|
|
|
|
{:ok,
|
|
socket
|
|
|> assign(:page_title, policy.name)
|
|
|> assign(:active_page, "schedules")
|
|
|> assign(:policy, policy)
|
|
|> assign(:org_users, users)
|
|
|> assign(:org_schedules, schedules)
|
|
|> assign(:show_add_rule, false)}
|
|
end
|
|
|
|
@impl true
|
|
def handle_event("delete", _params, socket) do
|
|
case OnCall.delete_escalation_policy(socket.assigns.policy) do
|
|
{:ok, _} ->
|
|
{:noreply,
|
|
socket
|
|
|> put_flash(:info, t("Escalation policy deleted"))
|
|
|> push_navigate(to: ~p"/schedules?tab=escalation-policies")}
|
|
|
|
{:error, _} ->
|
|
{:noreply, put_flash(socket, :error, t("Unable to delete escalation policy"))}
|
|
end
|
|
end
|
|
|
|
def handle_event("toggle_add_rule", _params, socket) do
|
|
{:noreply, assign(socket, :show_add_rule, !socket.assigns.show_add_rule)}
|
|
end
|
|
|
|
def handle_event("save_rule", %{"timeout_minutes" => timeout}, socket) do
|
|
policy = socket.assigns.policy
|
|
next_position = length(policy.rules)
|
|
|
|
case OnCall.create_escalation_rule(%{
|
|
escalation_policy_id: policy.id,
|
|
position: next_position,
|
|
timeout_minutes: timeout
|
|
}) do
|
|
{:ok, _} ->
|
|
{:noreply,
|
|
socket
|
|
|> assign(:show_add_rule, false)
|
|
|> reload_policy()}
|
|
|
|
{:error, _} ->
|
|
{:noreply, put_flash(socket, :error, t("Unable to add rule"))}
|
|
end
|
|
end
|
|
|
|
def handle_event("delete_rule", %{"id" => rule_id}, socket) do
|
|
rule = Enum.find(socket.assigns.policy.rules, &(&1.id == rule_id))
|
|
|
|
if rule do
|
|
case OnCall.delete_escalation_rule(rule) do
|
|
{:ok, _} -> {:noreply, reload_policy(socket)}
|
|
{:error, _} -> {:noreply, put_flash(socket, :error, t("Unable to delete rule"))}
|
|
end
|
|
else
|
|
{:noreply, socket}
|
|
end
|
|
end
|
|
|
|
def handle_event("add_target", %{"rule_id" => rule_id, "target_type" => target_type} = params, socket) do
|
|
attrs = %{
|
|
escalation_rule_id: rule_id,
|
|
target_type: target_type
|
|
}
|
|
|
|
attrs =
|
|
case target_type do
|
|
"user" -> Map.put(attrs, :user_id, params["target_id"])
|
|
"schedule" -> Map.put(attrs, :schedule_id, params["target_id"])
|
|
end
|
|
|
|
case OnCall.create_escalation_target(attrs) do
|
|
{:ok, _} -> {:noreply, reload_policy(socket)}
|
|
{:error, _} -> {:noreply, put_flash(socket, :error, t("Unable to add target"))}
|
|
end
|
|
end
|
|
|
|
def handle_event("delete_target", %{"id" => target_id}, socket) do
|
|
target =
|
|
socket.assigns.policy.rules
|
|
|> Enum.flat_map(& &1.targets)
|
|
|> Enum.find(&(&1.id == target_id))
|
|
|
|
if target do
|
|
case OnCall.delete_escalation_target(target) do
|
|
{:ok, _} -> {:noreply, reload_policy(socket)}
|
|
{:error, _} -> {:noreply, put_flash(socket, :error, t("Unable to delete target"))}
|
|
end
|
|
else
|
|
{:noreply, socket}
|
|
end
|
|
end
|
|
|
|
defp reload_policy(socket) do
|
|
policy = OnCall.get_escalation_policy!(socket.assigns.policy.id)
|
|
assign(socket, :policy, policy)
|
|
end
|
|
end
|