admin / Synapse-Sonar

import { NextResponse } from "next/server";
import { requireTenantContext, HttpError } from "@/lib/auth";
import { assertCan, can } from "@/lib/rbac";
import { prisma } from "@/lib/prisma";
import { getEnabledIntegration, NetscanXiConfig } from "@/lib/integrations";
import { IntegrationProvider } from "@prisma/client";

export const runtime = "nodejs";

/**
 * GET /api/graph
 * Tenant-scoped topology payload for NetworkGraph.tsx.
 * Vulnerability indicators are only included when the NetscanXi toggle is On.
 */
export async function GET() {
  try {
    const ctx = await requireTenantContext();
    assertCan(ctx.role, "asset:read");

    const netscanEnabled = Boolean(
      await getEnabledIntegration<NetscanXiConfig>(
        ctx.tenantId,
        IntegrationProvider.NETSCAN_XI
      )
    );

    const [assets, connections] = await Promise.all([
      prisma.asset.findMany({
        where: { tenantId: ctx.tenantId },
        include: {
          vulnerabilities: netscanEnabled
            ? { select: { cveId: true, cvssScore: true, severity: true, title: true } }
            : false,
        },
      }),
      prisma.connection.findMany({ where: { tenantId: ctx.tenantId } }),
    ]);

    const nodes = assets.map((a) => {
      const vulns = netscanEnabled ? a.vulnerabilities ?? [] : [];
      const criticalCount = vulns.filter((v) => v.severity === "CRITICAL").length;
      return {
        id: a.id,
        hostname: a.hostname ?? a.ipAddress,
        ipAddress: a.ipAddress,
        relatedIps: a.relatedIps,
        assetType: a.assetType,
        criticality: a.criticality,
        isRogue: a.isRogue,
        offline: a.manualOffline,
        openPorts: a.openPorts,
        vulnerabilities: vulns,
        criticalCount,
      };
    });

    const links = connections.map((c) => ({
      id: c.id,
      source: c.sourceAssetId,
      target: c.targetAssetId,
      protocol: c.protocol,
      port: c.port,
      // Normalize cumulative bytes into a 1-10 weight for edge thickness/speed.
      volume: Number(c.bytes),
      lastSeenAt: c.lastSeenAt,
    }));

    return NextResponse.json({
      nodes,
      links,
      netscanEnabled,
      canEdit: can(ctx.role, "asset:write"),
    });
  } catch (err) {
    if (err instanceof HttpError) {
      return NextResponse.json({ error: err.message }, { status: err.status });
    }
    const status = (err as { status?: number }).status ?? 500;
    return NextResponse.json({ error: (err as Error).message }, { status });
  }
}