feat(ui): filter empty Attack Paths queries from the selector in Cloud#12010
Open
danibarranqueroo wants to merge 2 commits into
Open
feat(ui): filter empty Attack Paths queries from the selector in Cloud#12010danibarranqueroo wants to merge 2 commits into
danibarranqueroo wants to merge 2 commits into
Conversation
📝 WalkthroughWalkthroughAttack path query result summaries now support Cloud-only filtering of queries with explicitly empty results. The adapter updates filtered pagination counts, while self-hosted behavior retains all queries. Tests cover filtering, missing responses, pagination, and environment differences. ChangesAttack path query filtering
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant AttackPathQueriesResponse
participant adaptAttackPathQueriesResponse
participant shouldShowQuery
AttackPathQueriesResponse->>adaptAttackPathQueriesResponse: provide response data
adaptAttackPathQueriesResponse->>shouldShowQuery: evaluate each query
shouldShowQuery-->>adaptAttackPathQueriesResponse: return visible queries
adaptAttackPathQueriesResponse-->>AttackPathQueriesResponse: return enriched data and pagination count
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ No Conflicts No conflict markers, and the branch merges cleanly into its base. |
Contributor
|
✅ All required changelog fragments are present. |
Contributor
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
danibarranqueroo
force-pushed
the
PROWLER-2195-attack-paths-filter-empty-queries
branch
2 times, most recently
from
July 21, 2026 12:00
73dbad1 to
279ca71
Compare
In Prowler Cloud, the Attack Paths query selector now lists only parameterless queries that returned data for the selected scan, using the precomputed per-query result summary from the queries API. Parameterized and custom queries are always shown (they run live on demand), and so are queries that errored during precompute or a scan predating the precompute step -- a query is hidden only when the scan computed it and found it empty. Gated behind NEXT_PUBLIC_IS_CLOUD_ENV: self-hosted deployments, whose API does not precompute result summaries, keep showing every query as before. Refs PROWLER-2195
danibarranqueroo
force-pushed
the
PROWLER-2195-attack-paths-filter-empty-queries
branch
from
July 22, 2026 12:04
279ca71 to
a381ac9
Compare
The Cloud flag moved from build-time NEXT_PUBLIC_IS_CLOUD_ENV to the runtime UI_CLOUD_ENABLED (#12061). The adapter already gates on isCloud(), which resolves the new mechanism; update the stale docstring to match.
danibarranqueroo
marked this pull request as ready for review
July 22, 2026 15:35
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ui/changelog.d/attack-paths-filter-empty-queries.added.md`:
- Line 1: Update the changelog statement to say that only queries confirmed
empty for the selected scan are hidden, while avoiding the broader claim that
all queries without returned data are removed.
In `@ui/types/attack-paths.ts`:
- Around line 136-138: Update AttackPathQueryResultSummary.status to use the
UI’s const-object pattern: define or reuse a const status object and derive the
property type from its values instead of declaring the inline "ok" | "error"
union. Preserve the existing allowed status values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a40e955e-2088-4e06-a11c-888851eb192d
📒 Files selected for processing (4)
ui/actions/attack-paths/queries.adapter.test.tsui/actions/attack-paths/queries.adapter.tsui/changelog.d/attack-paths-filter-empty-queries.added.mdui/types/attack-paths.ts
| @@ -0,0 +1 @@ | |||
| In Prowler Cloud, the Attack Paths query selector now lists only queries that returned data for the selected scan, hiding empty ones | |||
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Describe only confirmed-empty queries as hidden.
This says only queries that returned data remain, but errored, parameterized, and precompute-missing queries intentionally remain visible. Update it to say that queries confirmed empty for the selected scan are hidden.
-In Prowler Cloud, the Attack Paths query selector now lists only queries that returned data for the selected scan, hiding empty ones
+In Prowler Cloud, the Attack Paths query selector now hides queries confirmed to have no results for the selected scan.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| In Prowler Cloud, the Attack Paths query selector now lists only queries that returned data for the selected scan, hiding empty ones | |
| In Prowler Cloud, the Attack Paths query selector now hides queries confirmed to have no results for the selected scan. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ui/changelog.d/attack-paths-filter-empty-queries.added.md` at line 1, Update
the changelog statement to say that only queries confirmed empty for the
selected scan are hidden, while avoiding the broader claim that all queries
without returned data are removed.
Comment on lines
+136
to
+138
| export interface AttackPathQueryResultSummary { | ||
| status: "ok" | "error"; | ||
| has_data: boolean | null; |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== ui/types/attack-paths.ts =="
nl -ba ui/types/attack-paths.ts | sed -n '1,240p'
echo
echo "== string-literal unions in ui/types =="
rg -n --glob 'ui/types/**/*.ts' '"[^"]+"\s*\|\s*"[^"]+"' ui/types
echo
echo "== const-object union patterns in ui/types =="
rg -n --glob 'ui/types/**/*.ts' 'as const;' ui/typesRepository: prowler-cloud/prowler
Length of output: 230
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file="ui/types/attack-paths.ts"
if [ -f "$file" ]; then
echo "== $file (around target lines) =="
nl -ba "$file" | sed -n '120,180p'
else
echo "missing file: $file" >&2
exit 1
fi
echo
echo "== nearby union patterns in ui/types/attack-paths.ts =="
rg -n '"[^"]+"\s*\|\s*"[^"]+"' "$file" || true
echo
echo "== usages of AttackPathQueryResultSummary =="
rg -n 'AttackPathQueryResultSummary' ui || trueRepository: prowler-cloud/prowler
Length of output: 252
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== ui/types/attack-paths.ts (lines 120-180) =="
sed -n '120,180p' ui/types/attack-paths.ts | cat -n
echo
echo "== string-literal unions in ui/types =="
rg -n --glob 'ui/types/**/*.ts' '"[^"]+"\s*\|\s*"[^"]+"' ui/types || true
echo
echo "== const-object patterns in ui/types =="
rg -n --glob 'ui/types/**/*.ts' 'as const;' ui/types || true
echo
echo "== usages of AttackPathQueryResultSummary =="
rg -n 'AttackPathQueryResultSummary' ui || trueRepository: prowler-cloud/prowler
Length of output: 7091
Use the const-object pattern for status.
status: "ok" | "error" should be defined from a const object to match the UI type convention.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ui/types/attack-paths.ts` around lines 136 - 138, Update
AttackPathQueryResultSummary.status to use the UI’s const-object pattern: define
or reuse a const status object and derive the property type from its values
instead of declaring the inline "ok" | "error" union. Preserve the existing
allowed status values.
Sources: Coding guidelines, Path instructions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Frontend piece of the Attack Paths "precompute query results / filter empty queries" epic (PROWLER-2195).
Depends on the Cloud API exposing the per-query result summary (
result_summary) on the queries endpoint. That work is Cloud-only; this PR is written so it is a no-op on self-hosted (see the feature flag below).Description
In Prowler Cloud, the Attack Paths query selector now lists only the queries that returned data for the selected scan. Empty queries are hidden, so users aren't offered queries that can't return anything for their account.
The queries API now returns a
result_summary({ status, has_data }ornull) per query. The adapter filters on it with one rule — hide a query only when the scan computed it and found it empty:has_data === true→ shownhas_data === false(statusok) → hiddenhas_datanull) → shownSo a
null/missing summary is never treated as "empty", which means a partial precompute or a broken query never wrongly hides something.Feature-flagged. All of this is gated behind
NEXT_PUBLIC_IS_CLOUD_ENVvia the existingisCloud()helper. Self-hosted deployments, whose API does not precompute result summaries, keep showing every query exactly as today.Changes
types/attack-paths.ts— addAttackPathQueryResultSummaryand an optionalresult_summaryon the query attributes.actions/attack-paths/queries.adapter.ts—shouldShowQuerypredicate (short-circuits to "show all" when not in Cloud); applied inadaptAttackPathQueriesResponse.actions/attack-paths/queries.adapter.test.ts— filtering tests covering a mix of has_data true/false, errored, and parameterized queries, plus the flag-off (self-hosted) case.Steps to review
queries.adapter.ts— the predicate and the flag gate.queries.adapter.test.ts— 5 tests; verify the "absent ≠ empty" and flag-off behaviour.Verified locally against a real Cloud API + a genuine scan: with the flag on, the dropdown drops from all queries to only the with-data ones; with the flag off, all queries show.
pnpm --filter ui testfor the attack-paths actions passes (23 tests), eslint/prettier clean.License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit
New Features
Bug Fixes