hazcod / go-intigriti

Go library to interact with the intigriti API.

go-intigriti

Go library and commandline client for interacting with the Intigriti external API.

Checkout the autogenerated SDK docs on pkg.go.dev.

Commandline client

Usage:

# list out all company programs
# also try: inti c list
% inti company list-programs

# list out all company submissions across all programs
# also try: inti c sub
% inti company list-submissions

# verify if a specific IP address is linked to an Intigriti user
# also try: inti c ip 1.1.1.1
% inti company check-ip 1.1.1.1

Setup

Ensure the external API enabled on your company account and an integration is created with a redirect URI value of http://localhost:1337/. Afterwards create the following local configuration file:

log.level: info
auth:
    client_id: YOUR-CLIENT-ID
    client_secret: YOUR-CLIENT-SECRET

For the first call it will ask you to perform browser interaction to authenticate.
Future calls will not need to since your token will be cached in your configuration file.

Library

API Swagger documentation is available on the ReadMe.

Usage

package main

import (
	intigriti "github.com/hazcod/go-intigriti/pkg/api"
	"github.com/hazcod/go-intigriti/pkg/config"
	"log"
)

func main() {
	// this will require manual logon every time your code runs
	// look into persisting the TokenCache so refresh tokens can be saved
	// this will also launch an interactive Browser window to authenticate,
	// look at config.OpenBrowser and config.TokenCache to prevent this
	// or how the cli does it at https://github.com/hazcod/go-intigriti/blob/2eeb6a9fcee42fc4ac1ada7f5dc6d2db5446c15d/cmd/config/config.go#L86
	inti, err := intigriti.New(config.Config{
		Credentials: struct {
			ClientID     string
			ClientSecret string
		}{
		    ClientID: "my-integration-client-id",
		    ClientSecret: "my-integration-client-secret",
		},
	})
	if err != nil { log.Fatal(err) }
	
	programs, err := inti.GetPrograms()
	if err != nil { log.Fatal(err) }

	for _, program := range programs {
		log.Println(program.Name)
	}
}

Testing

# test on production using inti.yml
go test -tags integration -v ./...

# test on staging using inti.yml
INTI_TOKEN_URL=="testing.api.com" INTI_AUTH_URL=="subs.testing.api.com" INTI_API_URL="api.testing.com" go test -tags integration -v ./...

go-intigriti's Issues

implement real auth integration tests

Line: 11

go-intigriti//auth_test.go

Lines 8 to 18 in cc1f777

	"time"
	)
	// TODO implement real auth integration tests
	func TestNeedsAuthRefresh(t *testing.T) {
	now := time.Now()
	okTime := now.Add( time.Minute )
	if needsAuthRefresh(okTime, now) {
	t.Error("token needs refresh while it doesnt")

inject library tag header on every HTTP request

Line: 12

go-intigriti//v2/endpoint.go

Lines 9 to 19 in d9a25c2

	)
	const (
	// TODO: inject on every HTTP request
	clientTag = "hazcod/go-intigriti/1.0"
	)
	type Endpoint struct {
	Logger *logrus.Logger
	URLAPI string

Unable to authenticate (invalid_request)

Using the example from README.md gives me a panic error.
To solve that I had to change the code to

cfg := config.Config{}

cfg.TokenCache = &config.CachedToken{}
cfg.Credentials.ClientID = "clientId"
cfg.Credentials.ClientSecret = "clientSecret"
inti, err := intigriti.New(cfg)
if err != nil {
log.Fatal(err)
}

Still, when I get the authentication link, it gives me invalid_request. The credentials for v2 are still valid (tested in Swagger)

I tried playing around with the config and the library and couldn't find a workaround.

implement real submission integration tests

Line: 5

go-intigriti//submissions_test.go

Lines 2 to 12 in cc1f777

	import "testing"
	// TODO implement real submission integration tests
	func TestGetBearerToken(t *testing.T) {
	has := "myCoolToken"
	wants := "Bearer myCoolToken"
	if wants != getBearerTokenHeader(has) {
	t.Error("invalid bearer token")

Replace with appropriate checks for this patch

(e.g. checkpatch.pl).

Line: 35
https://github.com/hazcod/go-intigriti/blob/75e030e492a5e239276c7525fee6a2a7de44488a//.git/hooks/sendemail-validate.sample#L32-L42

test get submissions

Line: 16
https://github.com/hazcod/go-intigriti/blob/cc1f777507d9f8aae5d6886c1c65430487858343//submissions_test.go#L13-L23

implement commandline app

We should be able to interact with the API via a commandline tool.

• Also revert 8458e53 & 173374f

wait for them to implement FE view url

Line: 176

go-intigriti//submissions.go

Lines 173 to 183 in cc1f777

	Type: entry.Type.Name,
	Program: entry.Program.Name,
	ID: entry.Code,
	// TODO wait for them to implement FE view url
	URL: "https://intigriti.com/",
	Title: entry.Title,
	Researcher: entry.Researcher.UserName,
	Severity: entry.Severity.Value,
	Timestamp: time.Unix(int64(entry.CreatedAt), 0),
	Endpoint: entry.EndpointVulnerableComponent,
	})

Replace with appropriate checks for the whole series

(e.g. quick build, coding style checks, etc.).

Line: 41
https://github.com/hazcod/go-intigriti/blob/75e030e492a5e239276c7525fee6a2a7de44488a//.git/hooks/sendemail-validate.sample#L38-L48

Replace with appropriate checks (e.g. spell checking).

Line: 27
https://github.com/hazcod/go-intigriti/blob/75e030e492a5e239276c7525fee6a2a7de44488a//.git/hooks/sendemail-validate.sample#L24-L34

inject on every HTTP request

Line: 12

go-intigriti//v2/endpoint.go

Lines 9 to 19 in 7747dd9

	)
	const (
	// TODO: inject on every HTTP request
	clientTag = "hazcod/go-intigriti/1.0"
	)
	type Endpoint struct {
	Logger *logrus.Logger
	URLAPI string