Browse passive auth reports and raw evidence

src/app/api/projects/[projectId]/artifacts/[artifactId]/route.ts

@@ -0,0 +1,138 @@
+import { listArtifacts } from "../../../../../../server/chat/service";
+import { getArtifactService } from "../../../../../../server/evidence";
+import {
+  PASSIVE_AUTH_REPORT_MAX_BYTES,
+  parsePassiveAuthSurfaceSummary,
+} from "../../../../../../server/recon/passive-auth-surface";
+import { handleApiError, notFound, ok } from "../../../../_shared/http";
+
+export const dynamic = "force-dynamic";
+
+const RAW_EVIDENCE_MAX_BYTES = 32 * 1024;
+const NO_STORE = { headers: { "Cache-Control": "no-store" } };
+
+type Context = {
+  params: Promise<{ projectId: string; artifactId: string }>;
+};
+
+export async function GET(_request: Request, context: Context) {
+  try {
+    const { projectId, artifactId } = await context.params;
+    const artifact = (
+      await listArtifacts(projectId, {
+        artifactId,
+        limit: 1,
+      })
+    )[0];
+
+    if (!artifact) {
+      return notFound(`Artifact ${artifactId} was not found in this project.`);
+    }
+
+    const reader = getArtifactService().readArtifactText;
+    const report = await readPassiveAuthReport(artifact.metadata?.workflow, reader, {
+      projectId,
+      artifactId,
+    });
+    if (!reader) {
+      return ok(
+        {
+          artifact,
+          ...(report ? { report } : {}),
+          evidence: {
+            status: "unavailable" as const,
+            message: "Text preview is unavailable for this artifact.",
+            maxBytes: RAW_EVIDENCE_MAX_BYTES,
+          },
+        },
+        NO_STORE,
+      );
+    }
+
+    try {
+      const content = await reader({
+        projectId,
+        artifactId,
+        maxBytes: RAW_EVIDENCE_MAX_BYTES,
+      });
+      return ok(
+        {
+          artifact,
+          ...(report ? { report } : {}),
+          evidence: {
+            status: "text" as const,
+            text: content.text,
+            truncated: content.truncated,
+            maxBytes: RAW_EVIDENCE_MAX_BYTES,
+          },
+        },
+        NO_STORE,
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "";
+      const binary = /not a text artifact|binary/i.test(message);
+      return ok(
+        {
+          artifact,
+          ...(report ? { report } : {}),
+          evidence: {
+            status: binary ? ("binary" as const) : ("unavailable" as const),
+            message: binary
+              ? "This artifact is binary, so a text preview is not available."
+              : "The artifact is recorded, but its text preview is currently unavailable.",
+            maxBytes: RAW_EVIDENCE_MAX_BYTES,
+          },
+        },
+        NO_STORE,
+      );
+    }
+  } catch (error) {
+    return handleApiError(error);
+  }
+}
+
+async function readPassiveAuthReport(
+  workflow: unknown,
+  reader: ReturnType<typeof getArtifactService>["readArtifactText"],
+  input: { projectId: string; artifactId: string },
+) {
+  if (workflow !== "passive-auth-surface-v1") return undefined;
+  if (!reader) {
+    return {
+      status: "unavailable" as const,
+      message: "The structured passive-auth report is currently unavailable.",
+    };
+  }
+
+  try {
+    const content = await reader({ ...input, maxBytes: PASSIVE_AUTH_REPORT_MAX_BYTES });
+    if (content.truncated) {
+      return {
+        status: "over_limit" as const,
+        message: "This passive-auth report exceeds the structured report size limit.",
+      };
+    }
+    let value: unknown;
+    try {
+      value = JSON.parse(content.text);
+    } catch {
+      return {
+        status: "invalid" as const,
+        message: "This passive-auth report is not valid JSON.",
+      };
+    }
+    const parsed = parsePassiveAuthSurfaceSummary(value);
+    if (!parsed.success) {
+      return {
+        status: "invalid" as const,
+        message: "This passive-auth report does not match the supported report structure.",
+      };
+    }
+    return { status: "ready" as const, data: parsed.data };
+  } catch {
+    return {
+      status: "unavailable" as const,
+      message: "The structured passive-auth report is currently unavailable.",
+    };
+  }
+}

src/components/ChatWorkspace.tsx

@@ -2837,6 +2837,7 @@ export function ChatWorkspace({
         projectOverview={
           project ? (
             <ProjectThreadPanel
+              projectId={project.id}
               stats={stats}
               artifacts={artifacts}
               threads={threads}