chore(release): 1.3.0 (#106)

Author: GeraldineMT

.gitignore

@@ -6,4 +6,5 @@ node_modules
 .DS_Store
 .nyc_output/
 coverage/
-mochawesome-report/
+mochawesome-report/
+src/lib/key.json

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [1.3.0](https://github.com/SAP/vs-code-extension-for-project-credential-digger/compare/v1.2.0...v1.3.0) (2024-05-24)
+
+### Features
+
+-   **extension:** add quick fix suggestions for secrets ([a25823c](https://github.com/SAP/vs-code-extension-for-project-credential-digger/commit/a25823c28765c3554719e7733ea87b4dd82f55e3))
+
 ## [1.2.0](https://github.com/SAP/vs-code-extension-for-project-credential-digger/compare/v1.1.0...v1.2.0) (2023-09-18)
 
 ### Features

README.md

@@ -25,6 +25,18 @@ The tool provides the following support:
 -   Triggers the scan when opening/saving a file
 -   Forces a scan of a file via the command `Credential Digger: Scan`
 -   Highlights the findings in the code and displays them in the `Problems` panel as warnings
+-   Proposes three "quick fix" functionalities to address the secrets found in the code:
+
+    -   <u>Quick Fix 1:</u> **Remove Secret** - Instantly remove the secret from your code, making cleanup tasks and revision simpler.
+    -   <u>Quick Fix 2:</u> **Create Environment Variable** - With this feature, you can effortlessly store found secrets in a dedicated file and set up dependencies. This will be done automatically if your coding language is amongst Python, PHP, JavaScript, C#, or Java Maven. If your language is outside these five, you will receive AI-assisted advice to guide your manual setup.
+    -   <u>Quick Fix 3:</u> **Secret Storage Options** - This feature provides three secret storage options, namely, BTP Secret Store, AWS Secret Manager, and Vault.
+
+        -   For BTP Secret Store, the documentation is written mostly by us with a portion that is AI-generated.
+        -   For AWS Secret Manager and Vault, the entire set of instructions is AI-generated to provide a comprehensive, dynamic and user-specific guide for securely storing secrets and integrating them into your project.
+
+        (To fully benefit from the <u>AI functionality</u>, you need to configure some settings. Go to 'Configuration' section to have more information.)
+
+These features aim to streamline your coding workflow, making it more efficient and secure.
 
 ## Requirements
 
@@ -64,6 +76,20 @@ If you would like to exclude some files from being scanned you need to configure
 
 ![exclude-files](images/credential-digger-exclude-files.gif)
 
+### OpenAI
+
+To fully benefit from the AI functionality, you need to configure some settings. Specifically, two fields need to be filled in the extension settings.
+(Your code will not be transmitted to an AI, only the file extension will be used on the prompt.)
+
+-   **Openai Mode**: Select your preferred AI mode from the dropdown. The options include "BTP OpenAI" and "OpenAI."
+
+    -   <u>BTP OpenAI</u>: This option is for a Multi-tenant BTP service proxy for third-party LLM APIs. The extension use Azure OpenAI text-davinci-003 model.
+    -   <u>OpenAI</u>: This option is for OpenAI (https://platform.openai.com/).
+
+-   **Openai Key Path**: This field is for entering the full path to your OpenAI key. The type of key file depends on the selected OpenAI mode.
+    -   If <u>BTP OpenAI</u> was selected in the OpenAI Mode, the path should lead to a `.json` file containing your key.
+    -   If <u>OpenAI</u> was chosen, the path should direct to a `.txt` file containing only your copied and pasted key.
+
 ## Support, Feedback, Contributing
 
 This project is open to feature requests/suggestions, bug reports etc. via [GitHub issues](https://github.com/SAP/vs-code-extension-for-project-credential-digger/issues). Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our [Contribution Guidelines](CONTRIBUTING.md).

package-lock.json

@@ -2,7 +2,7 @@
     "name": "vs-code-extension-for-project-credential-digger",
     "displayName": "VS Code extension for project \"Credential Digger\"",
     "description": "Runs credential digger scan",
-    "version": "1.2.0",
+    "version": "1.3.0",
     "icon": "resources/logo-CD.png",
     "keywords": [
         "Credential Digger",
@@ -183,6 +183,22 @@
                             "description": "Specifies whether to validate the Credential Digger webserver certificate"
                         }
                     }
+                },
+                "credentialDigger.openaiCallMode": {
+                    "type": "string",
+                    "description": "Specifies the way you want to call OpenAI API",
+                    "enum": [
+                        "BTP OpenAI",
+                        "OpenAI"
+                    ],
+                    "enumDescriptions": [
+                        "OpenAI instance running on BTP (the extension use Azure OpenAI text-davinci-003 model)",
+                        "OpenAI from https://openai.com/"
+                    ]
+                },
+                "credentialDigger.openaiKeyPath": {
+                    "type": "string",
+                    "description": "Full path to the file with the key\n- BTP OpenAI: a json file with a 'client credentials token' from a Multi-tenant BTP service proxy for third-party LLM APIs \n- OpenAI: a txt file with a key from https://openai.com/. \n"
                 }
             }
         }
@@ -229,7 +245,7 @@
         "@types/vscode": "1.76.0",
         "@typescript-eslint/eslint-plugin": "5.60.0",
         "@typescript-eslint/parser": "5.53.0",
-        "@vscode/test-electron": "2.3.4",
+        "@vscode/test-electron": "2.3.10",
         "@vscode/vsce": "2.19.0",
         "chai": "4.3.8",
         "commitizen": "4.3.0",

package.json

@@ -10,9 +10,13 @@ import {
     window,
     workspace,
 } from 'vscode';
+import * as vscode from 'vscode';
 
 import ignore from 'ignore';
 
+import { QuickFixProviderEnvVar } from './lib/code-actions/QuickFixProviderEnvVar';
+import { QuickFixProviderRemoveSecret } from './lib/code-actions/QuickFixProviderRemoveSecret';
+import { QuickFixProviderSecretStore } from './lib/code-actions/QuickFixProviderSecretStore';
 import LoggerFactory from './lib/logger-factory';
 import MetaReaderFactory from './lib/meta-reader-factory';
 import RunnerFactory from './lib/runner-factory';
@@ -81,6 +85,54 @@ export async function activate(context: ExtensionContext): Promise<void> {
         workspace.onDidChangeConfiguration(updateFilterPatternHandler),
     );
 
+    // Quick Fix
+    const quickFixProviderRemoveSecret = new QuickFixProviderRemoveSecret(
+        diagCollection,
+    );
+    const quickFixProviderEnvVar = new QuickFixProviderEnvVar(diagCollection);
+    const quickFixProviderSecretStore = new QuickFixProviderSecretStore(
+        diagCollection,
+    );
+
+    context.subscriptions.push(
+        vscode.languages.registerCodeActionsProvider(
+            '*',
+            quickFixProviderSecretStore,
+            {
+                //  '*' means all languages
+                providedCodeActionKinds:
+                    QuickFixProviderSecretStore.providedCodeActionKinds,
+            },
+        ),
+    );
+    context.subscriptions.push(
+        vscode.languages.registerCodeActionsProvider(
+            '*',
+            quickFixProviderEnvVar,
+            {
+                //  '*' means all languages
+                providedCodeActionKinds:
+                    QuickFixProviderEnvVar.providedCodeActionKinds,
+            },
+        ),
+    );
+    context.subscriptions.push(
+        vscode.languages.registerCodeActionsProvider(
+            '*',
+            quickFixProviderRemoveSecret,
+            {
+                //  '*' means all languages
+                providedCodeActionKinds:
+                    QuickFixProviderRemoveSecret.providedCodeActionKinds,
+            },
+        ),
+    );
+    context.subscriptions.push(
+        quickFixProviderRemoveSecret.registerCommands(),
+        quickFixProviderEnvVar.registerCommands(),
+        quickFixProviderSecretStore.registerCommands(),
+    );
+
     // The commandId has been defined in the package.json file
     let disposable = commands.registerCommand(
         MetaReaderFactory.getInstance().getExtensionScanCommand(),

src/extension.ts

@@ -95,6 +95,7 @@ export default abstract class Runner {
         if (!rules) {
             throw new Error('Please provide the path to the rules file');
         }
+        console.log('Rules file path: ', rules);
         this.rules = Uri.parse(rules);
         switch (this.runnerType) {
             case CredentialDiggerRuntime.Docker: