Seguridad de Aplicaciones

pipeline {
    agent any
    
    environment {
        FLYNET_TOKEN = credentials('flynet-api-token')
        SONAR_TOKEN = credentials('sonar-token')
    }
    
    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }
        
        stage('Build') {
            steps {
                sh 'mvn clean compile'
            }
        }
        
        stage('Security Analysis') {
            parallel {
                stage('SAST') {
                    steps {
                        sh '''
                            flynet-cli sast \
                                --token $FLYNET_TOKEN \
                                --project-path . \
                                --language java \
                                --output sast-report.json
                        '''
                    }
                }
                
                stage('SCA') {
                    steps {
                        sh '''
                            flynet-cli sca \
                                --token $FLYNET_TOKEN \
                                --project-path . \
                                --check-licenses \
                                --generate-sbom \
                                --output sca-report.json
                        '''
                    }
                }
            }
        }
        
        stage('Package') {
            steps {
                sh 'mvn package -DskipTests'
            }
        }
        
        stage('DAST') {
            steps {
                sh '''
                    # Start application
                    java -jar target/app.jar &
                    APP_PID=$!
                    
                    # Wait for startup
                    sleep 30
                    
                    # Run DAST scan
                    flynet-cli dast \
                        --token $FLYNET_TOKEN \
                        --target http://localhost:8080 \
                        --scan-type full \
                        --output dast-report.json
                    
                    # Stop application
                    kill $APP_PID
                '''
            }
        }
        
        stage('Quality Gate') {
            steps {
                script {
                    def result = sh(
                        script: 'flynet-cli quality-gate --token $FLYNET_TOKEN',
                        returnStatus: true
                    )
                    if (result != 0) {
                        error('Security Quality Gate failed')
                    }
                }
            }
        }
    }
    
    post {
        always {
            archiveArtifacts artifacts: '*-report.json', fingerprint: true
            publishHTML([
                allowMissing: false,
                alwaysLinkToLastBuild: true,
                keepAll: true,
                reportDir: '.',
                reportFiles: 'security-dashboard.html',
                reportName: 'Security Report'
            ])
        }
    }
}

stages:
  - build
  - security
  - test
  - deploy

variables:
  FLYNET_API_URL: "https://api.flynet.sv"

before_script:
  - apt-get update -qq && apt-get install -y -qq curl
  - curl -L https://cli.flynet.sv/install.sh | sh

build:
  stage: build
  script:
    - npm ci
    - npm run build
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour

sast:
  stage: security
  script:
    - flynet-cli sast 
        --token $FLYNET_TOKEN 
        --project-path . 
        --language javascript
        --format gitlab-sast
        --output gl-sast-report.json
  artifacts:
    reports:
      sast: gl-sast-report.json
    paths:
      - gl-sast-report.json
    expire_in: 1 week

dependency_scanning:
  stage: security
  script:
    - flynet-cli sca 
        --token $FLYNET_TOKEN 
        --project-path .
        --format gitlab-dependency-scanning
        --output gl-dependency-scanning-report.json
  artifacts:
    reports:
      dependency_scanning: gl-dependency-scanning-report.json
    paths:
      - gl-dependency-scanning-report.json
    expire_in: 1 week

dast:
  stage: security
  services:
    - name: docker:dind
  script:
    - docker build -t test-app .
    - docker run -d -p 3000:3000 --name app test-app
    - sleep 30
    - flynet-cli dast 
        --token $FLYNET_TOKEN 
        --target http://docker:3000
        --format gitlab-dast
        --output gl-dast-report.json
  artifacts:
    reports:
      dast: gl-dast-report.json
    paths:
      - gl-dast-report.json
    expire_in: 1 week

security_dashboard:
  stage: security
  dependencies:
    - sast
    - dependency_scanning
    - dast
  script:
    - flynet-cli dashboard 
        --token $FLYNET_TOKEN 
        --sast-report gl-sast-report.json
        --sca-report gl-dependency-scanning-report.json
        --dast-report gl-dast-report.json
        --output security-dashboard.html
  artifacts:
    paths:
      - security-dashboard.html
    expire_in: 1 month
  only:
    - main

# Multi-stage build con análisis de seguridad
FROM node:18-alpine AS security-scanner

# Instalar Flynet CLI
RUN apk add --no-cache curl
RUN curl -L https://cli.flynet.sv/install.sh | sh

# Copiar código fuente
WORKDIR /app
COPY package*.json ./
COPY . .

# Análisis de dependencias
RUN flynet-cli sca \
    --project-path . \
    --check-licenses \
    --fail-on critical,high \
    --output /tmp/sca-report.json

# Análisis estático
RUN flynet-cli sast \
    --project-path . \
    --language javascript \
    --fail-on critical \
    --output /tmp/sast-report.json

# Build stage
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

# Production stage con usuario no-root
FROM node:18-alpine AS production

# Crear usuario no-root
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001

# Instalar dumb-init para manejo de señales
RUN apk add --no-cache dumb-init

WORKDIR /app

# Copiar archivos con permisos correctos
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nextjs:nodejs /app/package.json ./package.json

# Cambiar a usuario no-root
USER nextjs

# Exponer puerto
EXPOSE 3000

# Healthcheck
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

# Usar dumb-init como PID 1
ENTRYPOINT ["dumb-init", "--"]
CMD ["node", "dist/server.js"]

# Labels para metadata
LABEL maintainer="security@flynet.sv"
LABEL security.scan.date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
LABEL security.scan.tools="flynet-sast,flynet-sca"