import AuthenticatedLayout from '@/Layouts/AuthenticatedLayout'; import { Head, router } from '@inertiajs/react'; import { AlertTriangle, ShieldAlert } from 'lucide-react'; import { useState } from 'react'; import { Badge } from '@/Components/ui/badge'; import { Button } from '@/Components/ui/button'; import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@/Components/ui/card'; const CATEGORY_LABELS = { sql_injection: 'SQL Injection', xss: 'XSS', csrf: 'CSRF', directory_traversal: 'Directory Traversal', clickjacking: 'Clickjacking', open_redirect: 'Open Redirect', cors_misconfiguration: 'CORS Misconfiguration', security_headers: 'Security Headers', sensitive_file_exposure: 'Sensitive File Exposure', cve_detection: 'Known CVE Detection', tech_vulnerability_matching: 'Tech Vulnerability Matching', tls_config: 'TLS Configuration', cookie_security: 'Cookie Security', rate_limit_detection: 'Rate Limiting', subdomain_discovery: 'Subdomain Discovery', }; export default function Show({ website, availableOnPlan, categories, authorization, reports = [] }) { const [selected, setSelected] = useState(authorization?.scope ?? []); const [confirmed, setConfirmed] = useState(false); if (website.status !== 'verified' || !availableOnPlan) { return ( Pen Testing}>

{website.status !== 'verified' ? 'Verify this website to unlock penetration testing.' : 'Penetration testing is not included in your current plan.'}

); } function toggle(cat) { setSelected((s) => (s.includes(cat) ? s.filter((c) => c !== cat) : [...s, cat])); } function authorize() { router.post(route('pentest.authorize', website.id), { scope: selected }, { preserveScroll: true }); } function runTest() { router.post(route('pentest.store', website.id), { categories: selected }, { preserveScroll: true }); } const covered = authorization && selected.every((c) => authorization.scope.includes(c)); return ( Pen Testing — {website.domain}}>
Active penetration testing is a legal/liability boundary, not just a UX one. Every run requires an explicit authorization of scope, and every attempt is written to the audit log with who ran it and when.
Authorized scope {authorization ? `Authorized ${new Date(authorization.authorized_at).toLocaleString()}` : 'Select which categories to authorize, then confirm.'}
{categories.map((cat) => ( ))}
{!authorization || !covered ? (
) : ( )} Recent runs {reports.length === 0 ? (

No pen tests run yet.

) : (
    {reports.map((r) => (
  • {new Date(r.created_at).toLocaleString()} {r.risk_level} {r.cvss_score ? `(CVSS ${r.cvss_score})` : ''}

    {(r.categories_tested ?? []).map((c) => CATEGORY_LABELS[c] ?? c).join(', ')}

    • ))}
)}
); }