// /authorize/ — the disclosure step a visitor completes before a free scan runs.
//
// Sekura executes real attacks. The Contract Stack Guide puts it plainly:
// "Without written authorization identifying the assets in scope, an assessment
// is potentially unauthorized." For Business and Enterprise that instrument is a
// countersigned Authorization to Test; for self-serve it is the authorization
// warranty in the Online Terms, recorded against one named target.
//
// Two routes to that, because they carry different weight:
//
// verified sign in with GitHub, pick a repository you administer. Control is
// proven rather than claimed. This matters under California Penal
// Code § 502 — cloning a repo is *copying data*, and § 502(e) lets
// the owner sue over it, so an assertion by a stranger is not
// permission from the party who could actually grant it.
// asserted paste a URL and warrant that you may authorize it. Backed by the
// indemnity and right to suspend in Terms §4.4–4.5.
//
// Both record the same signature: a typed name (the operative electronic
// signature — intent plus attribution) and a drawn mark with the metrics that
// show a person made it, which is what an audit pack wants to see.
//
// Copy tracks Contract Templates/contracts/02-Online-Terms-of-Service.docx §4
// and 04-Authorization-to-Test.docx §3 via data/scanAuthorization.js.
// "https://github.com/Owner/Repo.git/" and "owner/repo" are the same target.
// Compared on the normalised owner/name pair rather than by substring, so
// "acme/api" cannot match "acme/api-internal".
function sameRepo(a, b) {
const norm = (v) => String(v || '')
.trim().toLowerCase()
.replace(/^https?:\/\//, '')
.replace(/^(www\.)?(github|gitlab|bitbucket)\.(com|org)\//, '')
.replace(/\.git$/, '')
.replace(/\/+$/, '');
const x = norm(a); const y = norm(b);
return !!x && !!y && x === y;
}
function AuthorizeView() {
const { React } = window;
const { useState, useEffect, useMemo, useRef } = React;
const terms = window.ScanAuthTerms || [];
const clauseRefs = window.ScanAuthClauseRefs || '';
const roe = window.ScanAuthRulesOfEngagement || [];
const params = typeof window !== 'undefined'
? new URLSearchParams(window.location.search) : new URLSearchParams();
const [repo, setRepo] = useState((params.get('repo') || '').trim());
const [isPrivate, setIsPrivate] = useState(false);
const [repoToken, setRepoToken] = useState('');
const [name, setName] = useState('');
const [title, setTitle] = useState('');
const [org, setOrg] = useState('');
const [email, setEmail] = useState('');
const [signature, setSignature] = useState('');
const [drawn, setDrawn] = useState(null);
const [agreed, setAgreed] = useState(false);
const [featureConsent, setFeatureConsent] = useState(false);
const [attempted, setAttempted] = useState(false);
const [submitting, setSubmitting] = useState(false);
const [error, setError] = useState(null);
const [done, setDone] = useState(null);
// GitHub verification state, restored from the redirect.
const [grant] = useState(params.get('granted') || '');
const [verifyErr, setVerifyErr] = useState(params.get('verr') || '');
const [account, setAccount] = useState(null);
const [repos, setRepos] = useState(null);
const [picked, setPicked] = useState(null);
const [loadingRepos, setLoadingRepos] = useState(false);
const [ent, setEnt] = useState(null); // what is free vs paid for this account
const hpRef = useRef(null);
useEffect(() => { document.title = 'Sekura — authorize a scan'; }, []);
// Returning from Stripe. The credit is granted by the webhook, which can land
// a moment after the redirect, so this is a reassurance message rather than a
// gate — the submit will succeed once the credit is on the account.
const justPaid = params.get('paid') === '1';
// Clear the grant out of the address bar once read: it is short-lived, but a
// token has no business sitting in browser history or a shared screenshot.
useEffect(() => {
if (!grant && !verifyErr) return;
const u = new URL(window.location.href);
['granted', 'verr'].forEach((k) => u.searchParams.delete(k));
window.history.replaceState({}, '', u.toString());
}, []);
useEffect(() => {
if (!grant) return;
setLoadingRepos(true);
fetch(`/api/github/repos?grant=${encodeURIComponent(grant)}`)
.then((r) => r.json())
.then((d) => {
if (!d.ok) { setVerifyErr(d.error || 'verification failed'); return; }
setAccount({ login: d.login, name: d.name, email: d.email });
setRepos(d.repos || []);
if (d.name) setName((v) => v || d.name);
if (d.email) setEmail((v) => v || d.email);
// Fill the form in from what GitHub just told us. Coming back from an
// install with an empty box is the wrong end of the trade — the user
// has just picked the repository on GitHub's own screen, and being
// asked to type it again reads as though the grant did not register.
const list = d.repos || [];
const match = list.find((r) => sameRepo(repo, r.fullName));
const chosen = match || (list.length === 1 ? list[0] : null);
if (chosen) { setPicked(chosen); setRepo(`github.com/${chosen.fullName}`); }
})
.catch(() => setVerifyErr('could not reach GitHub'))
.finally(() => setLoadingRepos(false));
// What this account may scan, so the list can be labelled before anyone
// fills anything in. Discovering the paywall only after signing is the
// wrong order — all the work is already done by then.
fetch(`/api/scan-entitlement?grant=${encodeURIComponent(grant)}`)
.then((r) => r.json())
.then((d) => { if (d.ok) setEnt(d); })
.catch(() => { /* labels are a nicety; submit still enforces */ });
}, [grant]);
// Does choosing this repository cost anything? The first distinct repo is
// free, an already-authorized one never costs again, and credits or a
// subscription cover the rest.
const repoCost = (fullName) => {
if (!ent || !ent.identified) return 'free';
if ((ent.authorized || []).some((u) => sameRepo(u, fullName))) return 'authorized';
if (!ent.freeScanUsed) return 'free';
if (ent.subscription) return 'subscription';
if (ent.credits > 0) return 'credit';
return 'upgrade';
};
const pickedCost = picked ? repoCost(picked.fullName) : null;
const needsUpgrade = pickedCost === 'upgrade';
const verified = !!(account && picked);
const repoValid = useMemo(
() => !!(window.githubLib && window.githubLib.validate(repo).ok),
[repo],
);
const missing = [];
if (!repoValid) missing.push('a valid repository URL');
if (needsUpgrade) missing.push('an upgrade for this repository');
if (!verified && isPrivate && !repoToken.trim()) missing.push('a clone token for the private repository');
if (!agreed) missing.push('the authorization terms');
if (!name.trim()) missing.push('your name');
if (!/.+@.+\..+/.test(email)) missing.push('a valid email');
if (signature.trim().toLowerCase() !== name.trim().toLowerCase() || !signature.trim()) {
missing.push('a typed signature matching your name');
}
if (!drawn || !drawn.image) missing.push('your signature in the box');
const firstMissing = missing[0] || null;
const submit = async (e) => {
e.preventDefault();
setAttempted(true);
setError(null);
if (firstMissing) return;
setSubmitting(true);
try {
const res = await fetch('/api/free-scan', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
repoUrl: repo,
email: email.trim(),
consentScan: true,
consentFeature: featureConsent,
isPrivate: verified ? !!(picked && picked.private) : isPrivate,
repoToken: !verified && isPrivate ? repoToken.trim() : '',
hp: hpRef.current ? hpRef.current.value : '',
turnstileToken: window.__sekuraTurnstileToken || undefined,
authorization: {
version: window.ScanAuthVersion,
agreed: true,
signerName: name.trim(),
signerTitle: title.trim(),
signerOrg: org.trim(),
signatureText: signature.trim(),
signatureImage: drawn.image,
signatureMeta: drawn.meta,
grant: verified ? grant : undefined,
repoId: verified ? picked.id : undefined,
},
}),
});
const data = await res.json().catch(() => ({}));
if (!data.ok) {
// Out of free scans: hand off to the payment page, carrying the repo so
// they come back to the same target rather than starting over.
if (res.status === 402 && data.upgradeUrl) {
try { window.sessionStorage.setItem('sekura.grant', grant || ''); } catch { /* private mode */ }
window.location.href = data.upgradeUrl;
return;
}
setError(data.error || 'Something went wrong. Try again, or email hello@sekura.ai.');
return;
}
setDone(data);
window.scrollTo({ top: 0, behavior: 'smooth' });
} catch {
setError('Network error. Try again, or email hello@sekura.ai.');
} finally {
setSubmitting(false);
}
};
if (done) {
return (
Authorized
Your scan is queued.
We have your authorization for {repo} and the full report
is on its way to {email}.
{done.reference && <> Your authorization reference is {done.reference}.}
You can withdraw this authorization at any time by replying to that email
or writing to hello@sekura.ai.
We will stop immediately.
);
}
const VERIFY_ERRORS = {
denied: 'You cancelled the GitHub sign-in. You can still authorize by pasting a URL below.',
expired: 'That verification link expired. Start again if you want to verify with GitHub.',
unconfigured: 'GitHub verification is not switched on yet — authorize by URL below.',
exchange_failed: 'GitHub did not complete the sign-in. Try again, or authorize by URL.',
profile_failed: 'We could not read your GitHub account. Try again, or authorize by URL.',
bad_request: 'That sign-in did not come back correctly. Try again.',
};
return (
Before we scan
Authorize the scan.
Sekura runs real attacks against the target you give it. That is the point —
and it is why we need you to confirm, on the record, that you are entitled to
authorize testing against this repository.