[GV-22] Integrate usageAnalytics microservice into GV

[qanagattandyr]

Jira Ticket

Jira Ticket

Description

Create a new router and connect to the existing schema. Added feature is usageAnalytics, added new tab, updated docker.

Test the full integration with GradeView.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• [ x] New feature (non-breaking change which adds functionality)
• Refactoring (non-breaking change)
• Breaking change (fix or feature that would change existing functionality)

Changes

website, docker-compose, api/v2 edited.

Testing

Tested by running locally on different laptops.

Checklist

• My branch name matches the format: <ticket-id>/<brief-description-of-change>
• My PR name matches the format: [<ticket-id>] <brief-description-of-change>
• I have added doc-comments to all new functions (JSDoc for JS and Docstrings for Python)
• I have reviewed all of my code
• My code only contains major changes related to my ticket

Screenshots/Video

Additional Notes

[linear]

GV-22 Integrate usageAnalytics microservice into GV

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
14519307	Triggered	Google Cloud Keys	be17226	api/auth/service_account.json	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

To fix the problem, we need to ensure that the constructed file paths are contained within the intended directories. This can be achieved by normalizing the paths and verifying that they start with the expected base directories. We will use os.path.normpath to normalize the paths and then check if they start with CSV_DIR or GRAPH_DIR.

To fix the problem, we need to ensure that any user-provided input included in the JSON response is properly sanitized or escaped. In this case, we can use the flask.escape function to escape the log_type before including it in the error message. This will prevent any malicious scripts from being executed if the JSON response is rendered in an unsafe manner by a client.

To fix the problem, we need to validate the log_type parameter to ensure it only contains allowed values. This can be achieved by defining a list of allowed log types and checking if the provided log_type is in this list before proceeding with file operations. This approach ensures that only valid log types are processed, preventing any potential path traversal attacks.

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder (CSV_DIR). This will prevent any path traversal attacks by ensuring that the file path remains within the intended directory.

To fix the problem, we need to ensure that any user-provided input, such as the log_type parameter, is properly sanitized before being included in the response. The best way to fix this issue is to use the escape function from the flask module to sanitize the log_type value before including it in the error message.

We will modify the code in the get_analytics function to escape the log_type value before including it in the error message.

To fix the problem, we need to ensure that the constructed file paths are contained within the intended directories. This can be achieved by normalizing the paths and verifying that they start with the expected base directory. We will use os.path.normpath to normalize the paths and then check if they start with CSV_DIR or GRAPH_DIR.

To fix the problem, we need to ensure that the log_type parameter is properly validated and sanitized before being used in the render_template function. The best way to fix this issue is to use the escape function from the flask module to sanitize the log_type parameter before including it in the template. This will prevent any malicious scripts from being executed.

To fix the problem, we need to ensure that the Flask application does not run in debug mode in a production environment. The best way to achieve this is by using environment variables to control the debug mode. This way, we can set the debug mode to True during development and False during production without changing the code.

We will modify the app.run method to check an environment variable (e.g., FLASK_DEBUG) to determine whether to enable debug mode. This approach maintains the existing functionality while enhancing security.

To fix the problem, we need to ensure that the constructed file path is validated before it is used to access the file system. We can achieve this by normalizing the path and ensuring it is contained within the intended base directory. This approach will prevent path traversal attacks by ensuring that the file path does not escape the base directory.

1. Normalize the constructed file path using os.path.normpath.
2. Check that the normalized path starts with the base directory (CSV_DIR).
3. Raise an exception or return an error response if the path validation fails.