Skip to content

Conversation

emekanwaoma
Copy link
Contributor

@emekanwaoma emekanwaoma commented Sep 19, 2025

User description

Description

What - Updated Integration Blueprint defaults and mapping and add ui base url to exported data

Why - To refine and enrich data returned from integration

How -

  • Updated default blueprints and mapping
  • Added checkmarx one ui base url to exported data

Type of change

Please leave one option from the following and delete the rest:

  • Non-breaking change (fix of existing functionality that will not change current behavior)

All tests should be run against the port production environment(using a testing org).

Core testing checklist

  • Integration able to create all default resources from scratch
  • Resync finishes successfully
  • Resync able to create entities
  • Resync able to update entities
  • Resync able to detect and delete entities
  • Scheduled resync able to abort existing resync and start a new one
  • Tested with at least 2 integrations from scratch
  • Tested with Kafka and Polling event listeners
  • Tested deletion of entities that don't pass the selector

Integration testing checklist

  • Integration able to create all default resources from scratch
  • Completed a full resync from a freshly installed integration and it completed successfully
  • Resync able to create entities
  • Resync able to update entities
  • Resync able to detect and delete entities
  • Resync finishes successfully
  • If new resource kind is added or updated in the integration, add example raw data, mapping and expected result to the examples folder in the integration directory.
  • If resource kind is updated, run the integration with the example data and check if the expected result is achieved
  • If new resource kind is added or updated, validate that live-events for that resource are working as expected
  • Docs PR link here

Preflight checklist

  • Handled rate limiting
  • Handled pagination
  • Implemented the code in async
  • Support Multi account

Screenshots

Include screenshots from your environment showing how the resources of the integration will look.

Screenshot 2025-09-19 at 15 31 50

API Documentation

Provide links to the API documentation used for this integration.


PR Type

Enhancement


Description

  • Add UI base URL metadata to all exported entities

  • Refactor metadata enrichment with centralized utility function

  • Update blueprint schemas with enhanced enum colors and properties

  • Add deep link generation for better user navigation


Diagram Walkthrough

flowchart LR
  A["Client"] --> B["UI Base URL Property"]
  B --> C["Centralized Utils"]
  C --> D["All Exporters"]
  D --> E["Enhanced Metadata"]
  E --> F["Updated Blueprints"]
  F --> G["Deep Links"]
Loading

File Walkthrough

Relevant files
Enhancement
9 files
client.py
Add UI base URL property to client                                             
+10/-0   
utils.py
Create centralized metadata enrichment utility                     
+21/-0   
api_sec_exporter.py
Refactor to use centralized metadata enrichment                   
+4/-9     
kics_exporter.py
Refactor to use centralized metadata enrichment                   
+4/-8     
project_exporter.py
Add UI base URL metadata to projects                                         
+5/-1     
sast_exporter.py
Add UI base URL metadata to SAST results                                 
+7/-1     
scan_exporter.py
Add UI base URL metadata to scans                                               
+5/-1     
scan_result_exporter.py
Add UI base URL metadata to scan results                                 
+7/-1     
blueprints.json
Add link properties and enhanced enum colors                         
+195/-26
Tests
2 files
test_api_sec_exporter.py
Update tests for centralized metadata enrichment                 
+17/-3   
test_scan_results_exporter.py
Update tests to verify UI base URL metadata                           
+18/-5   
Configuration changes
2 files
port-app-config.yaml
Add deep link mappings using UI base URL                                 
+11/-0   
pyproject.toml
Bump version to 0.3.5-dev                                                               
+1/-1     
Documentation
1 files
CHANGELOG.md
Document version 0.3.5-dev improvements                                   
+9/-0     

Copy link
Contributor

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪
🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Possible Issue

ui_base_url is derived by blindly replacing "/api" in base_url; if "/api" is not present or appears earlier in the hostname/path, the result may be incorrect. Consider a more robust approach (e.g., parse URL and strip known API path suffix).

def ui_base_url(self) -> str:
    """
    Get the Checkmarx One UI base URL (without /api suffix).

    Returns:
        UI base URL for constructing deeplinks
    """
    return self.base_url.replace("/api", "")
Mapping Robustness

New deep link mappings rely on "__ui_base_url" and various IDs (e.g., similarityID vs similarityId). Ensure all exporters consistently add "__ui_base_url" and that field names match upstream payloads to avoid empty/invalid links.

          name: .name
          createdAt: .createdAt
          updatedAt: .updatedAt
          tags: (.tags // {})
          repoUrl: .repoUrl
          mainBranch: .mainBranch
          origin: .origin
          criticality: .criticality
          link: '.__ui_base_url + "/projects/" + .id'
- kind: scan
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        blueprint: '"checkmarxScan"'
        identifier: .id
        title: '(.projectId + "-" + .id)'
        properties:
          status: .status
          branch: .branch
          createdAt: .createdAt
          updatedAt: .updatedAt
          userAgent: .userAgent
          configs: (.configs // {})
          statusDetails: (.statusDetails // [])
          link: '.__ui_base_url + "/projects/" + .projectId + "/scans/" + "?id=" + .id'
        relations:
          project: .projectId
- kind: api-security
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        identifier: .risk_id
        title: .name
        blueprint: '"checkmarxApiSec"'
        properties:
          riskId: .risk_id
          apiId: .api_id
          severity: (.severity // empty)
          name: .name
          status: .status
          httpMethod: .http_method
          url: .url
          origin: .origin
          documented: .documented
          authenticated: .authenticated
          discoveryDate: .discovery_date
          scanId: .scan_id
          sastRiskId: (.sast_risk_id // empty)
          projectId: .project_id
          state: .state
          link: '.__ui_base_url + "/results/" + .scan_id + "/" + .project_id + "/apisec"'
        relations:
          scan: .scan_id
- kind: sca
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        identifier: .id
        title: .data.packageIdentifier
        blueprint: '"checkmarxSCA"'
        properties:
          firstScanId: .firstScanId
          status: .status
          state: .state
          severity: .severity
          created: .created
          description: .description
          packageIdentifier: .data.packageIdentifier
          recommendations: .data.recommendations
          recommendedVersion: .data.recommendedVersion
          packageData: .data.packageData
          cweId: .vulnerabilityDetails.cweId
          similarityId: .similarityId
          link: '.__ui_base_url + "/applicationsAndProjects/projects"'
        relations:
          scan: .__scan_id
- kind: containers
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        identifier: .id
        title: .id
        blueprint: '"checkmarxContainerSecurity"'
        properties:
          firstScanId: .firstScanId
          status: .status
          state: .state
          severity: .severity
          confidenceLevel: .confidenceLevel
          created: .created
          description: .description
          packageName: .data.packageName
          packageVersion: .data.packageVersion
          imageName: .data.imageName
          imageTag: .data.imageTag
          imageFilePath: .data.imageFilePath
          cweId: .vulnerabilityDetails.cweId
          similarityId: .similarityId
          link: '.__ui_base_url + "/applicationsAndProjects/projects"'
        relations:
          scan: .__scan_id
- kind: kics
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        identifier: .ID
        title: .description
        blueprint: '"checkmarxKics"'
        properties:
          firstScanId: .firstScanID
          status: .status
          state: .state
          severity: (.severity // empty)
          created: .firstFoundAt
          description: .description
          fileName: (.fileName // empty)
          line: (.line // empty)
          platform: (.platform // empty)
          issueType: (.issueType // empty)
          expectedValue: (.expectedValue // empty)
          value: (.value // empty)
          similarityId: .similarityID
          link: '.__ui_base_url + "/applicationsAndProjects/projects"'
        relations:
          scan: .__scan_id
- kind: sast
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        identifier: .resultHash
        title: .queryName
        blueprint: '"checkmarxSast"'
        properties:
          firstScanId: .firstScanID
          status: .status
          state: .state
          severity: (.severity // empty)
          confidenceLevel: .confidenceLevel
          created: .firstFoundAt
          nodes: (.nodes // empty)
          cweId: (.cweID // empty)
          similarityId: .similarityID
          link: '.__ui_base_url + "/applicationsAndProjects/projects"'
        relations:
          scan: .scanID
Side Effects

enrich_result_with_metadata mutates the input dict in place. If callers reuse original payloads elsewhere, consider returning a shallow copy to avoid unintended side effects.

def enrich_result_with_metadata(
    result: Dict[str, Any], ui_base_url: str, scan_id: Optional[str] = None
) -> dict[str, Any]:
    """Enrich result with UI base URL and optionally scan ID metadata.

    Args:
        result: The result dictionary to enrich
        ui_base_url: The UI base URL to add as metadata
        scan_id: Optional scan ID to add as metadata

    Returns:
        The enriched result dictionary with __ui_base_url and optionally __scan_id fields
    """

    result["__ui_base_url"] = ui_base_url
    if scan_id:
        result["__scan_id"] = scan_id
    return result

Copy link
Contributor

qodo-merge-pro bot commented Sep 19, 2025

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Hardcoded URL paths are brittle

The PR hardcodes URL paths for deep-links in port-app-config.yaml, which is
fragile. It would be more robust to use deep-links provided directly by the
Checkmarx One API, if available.

Examples:

integrations/checkmarx-one/.port/resources/port-app-config.yaml [22]
            link: '.__ui_base_url + "/projects/" + .id'
integrations/checkmarx-one/.port/resources/port-app-config.yaml [40]
            link: '.__ui_base_url + "/projects/" + .projectId + "/scans/" + "?id=" + .id'

Solution Walkthrough:

Before:

# integrations/checkmarx-one/.port/resources/port-app-config.yaml

- kind: project
  port:
    entity:
      mappings:
        # ...
        link: '.__ui_base_url + "/projects/" + .id'
- kind: scan
  port:
    entity:
      mappings:
        # ...
        link: '.__ui_base_url + "/projects/" + .projectId + "/scans/" + "?id=" + .id'

After:

# integrations/checkmarx-one/.port/resources/port-app-config.yaml
# This assumes the Checkmarx API can return a 'uiLink' field in its response.

- kind: project
  port:
    entity:
      mappings:
        # ...
        link: .uiLink
- kind: scan
  port:
    entity:
      mappings:
        # ...
        link: .uiLink
Suggestion importance[1-10]: 8

__

Why: The suggestion correctly identifies a significant design weakness, as hardcoding URL structures makes the integration brittle and susceptible to breaking from external UI changes.

Medium
Possible issue
Fix incorrect deep link URL
Suggestion Impact:The commit removed the generic links for SCA, Containers, KICS, SAST (and others), aligning with the suggestion to address incorrect generic deep links. However, it did not add the proposed specific URLs; it simply deleted the generic link fields.

code diff:

@@ -90,7 +87,6 @@
             packageData: .data.packageData
             cweId: .vulnerabilityDetails.cweId
             similarityId: .similarityId
-            link: '.__ui_base_url + "/applicationsAndProjects/projects"'
           relations:
             scan: .__scan_id
   - kind: containers
@@ -117,7 +113,6 @@
             imageFilePath: .data.imageFilePath
             cweId: .vulnerabilityDetails.cweId
             similarityId: .similarityId
-            link: '.__ui_base_url + "/applicationsAndProjects/projects"'
           relations:
             scan: .__scan_id
   - kind: kics
@@ -143,7 +138,6 @@
             expectedValue: (.expectedValue // empty)
             value: (.value // empty)
             similarityId: .similarityID
-            link: '.__ui_base_url + "/applicationsAndProjects/projects"'
           relations:
             scan: .__scan_id
   - kind: sast
@@ -165,6 +159,5 @@
             nodes: (.nodes // empty)
             cweId: (.cweID // empty)
             similarityId: .similarityID
-            link: '.__ui_base_url + "/applicationsAndProjects/projects"'
           relations:
             scan: .scanID

Update the generic deep link for SCA, Containers, KICS, and SAST findings to a
specific link that navigates to the individual finding. This can be done by
constructing a URL with the project ID, scan ID, and similarity ID.

integrations/checkmarx-one/.port/resources/port-app-config.yaml [93]

-link: '.__ui_base_url + "/applicationsAndProjects/projects"'
+link: '.__ui_base_url + "/results/" + .__scan_id + "/" + entity.relations.scan.target.properties.projectId + "/sca/" + .similarityId'

[Suggestion processed]

Suggestion importance[1-10]: 8

__

Why: The suggestion correctly identifies that the deep links for findings are generic and provides a correct and much more useful specific link format, significantly improving the functionality introduced in the PR.

Medium
Use removesuffix for robust URL manipulation

Replace replace("/api", "") with removesuffix("/api") in the ui_base_url
property to robustly remove the suffix from the URL and avoid accidentally
altering other parts of the URL string.

integrations/checkmarx-one/checkmarx_one/clients/client.py [54-62]

 @property
 def ui_base_url(self) -> str:
     """
     Get the Checkmarx One UI base URL (without /api suffix).
 
     Returns:
         UI base URL for constructing deeplinks
     """
-    return self.base_url.replace("/api", "")
+    return self.base_url.removesuffix("/api")
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: The suggestion correctly points out a potential edge case with replace() and suggests using removesuffix() for a more robust implementation, which improves code correctness and prevents potential bugs.

Low
  • Update

Copy link
Contributor

@nivm-port nivm-port left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
Resolve @mk-armah comment 💯

Copy link
Contributor

@nivm-port nivm-port left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolve @mk-armah comment

Copy link
Member

@mk-armah mk-armah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@emekanwaoma emekanwaoma merged commit 2d9e002 into main Sep 23, 2025
23 checks passed
@emekanwaoma emekanwaoma deleted the PORT-16429 branch September 23, 2025 10:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants