Function execute

worker/src/components/security/supabase-scanner.ts:228–439

({ inputs, params }, context)

    ],
  },
  async execute({ inputs, params }, context) {
    const parsedInputs = inputSchema.parse(inputs);
    const parsedParams = parameterSchema.parse(params);
    const databaseConnectionString = (
      parsedInputs.databaseConnectionString ?? parsedParams.databaseUrl
    )?.trim();
    const projectRef = parsedInputs.projectRef ?? inferProjectRef(parsedInputs.supabaseUrl);

    if (!databaseConnectionString) {
      throw new ValidationError(
        'Provide a Database URL (Postgres connection string) via Database URL or Connection String.',
        { fieldErrors: { databaseUrl: ['Database URL is required.'] } },
      );
    }

    if (!projectRef) {
      throw new ValidationError(
        'Could not infer Supabase project ref from URL. Please provide a valid https://<project-ref>.supabase.co URL or set projectRef explicitly.',
        { fieldErrors: { supabaseUrl: ['Invalid or missing project reference'] } },
      );
    }

    const runnerPayload = {
      ...parsedInputs,
      ...parsedParams,
      projectRef,
      databaseConnectionString,
    };

    const tenantId = (context as any).tenantId ?? 'default-tenant';
    const volume = new IsolatedContainerVolume(tenantId, context.runId);
    const mountPath = '/data';
    const configFilename = 'scanner_config.yaml';
    const outputFilename = 'report.json';
    const containerConfigPath = `${mountPath}/${configFilename}`;
    const containerOutputFile = `${mountPath}/${outputFilename}`;

    // Build scanner_config.yaml to place inside the isolated volume
    const configYamlLines: string[] = [];
    configYamlLines.push('project:');
    configYamlLines.push(`  ref: ${projectRef}`);
    configYamlLines.push('database:');
    configYamlLines.push(`  connection_string: ${JSON.stringify(databaseConnectionString)}`);
    if (parsedInputs.serviceRoleKey && parsedInputs.serviceRoleKey.trim().length > 0) {
      configYamlLines.push('api:');
      configYamlLines.push(`  service_role_key: ${JSON.stringify(parsedInputs.serviceRoleKey)}`);
    }
    configYamlLines.push('scanner:');
    configYamlLines.push('  output:');
    configYamlLines.push('    format: json');
    configYamlLines.push(`    file: ${containerOutputFile}`);
    // Tuning thresholds – avoid non‑zero exit unless explicitly requested
    configYamlLines.push('thresholds:');
    if (typeof parsedParams.minimumScore === 'number') {
      configYamlLines.push(`  minimum_score: ${parsedParams.minimumScore}`);
    } else {
      configYamlLines.push('  minimum_score: 0');
    }