Repository: OWASP/threat-dragon (js)

Issue:
USE_SEARCH results in an expection when used with gitlab
**Describe the bug**:
The two env vars GITHUB_USE_SEARCH and GITHUB_SEARCH_QUERRY apply (contrary to what their name implies) to all repos.

When used with gitlab however, they result in the following exception:
```
threatdragon-1  | error: controllers/threatmodelcontroller.js:  {"service":"threat-dragon","timestamp":"2024-07-05 06:23:54"}
threatdragon-1  | error: getClient(...).reposAsync is not a function {"service":"threat-dragon","stack":"TypeError: getClient(...).reposAsync is not a function\n    at Object.searchAsync (/app/td.server/dist/repositories/gitlabrepo.js:84:33)\n    at _callee$ (/app/td.server/dist/controllers/threatmodelcontroller.js:31:29)\n    at tryCatch (/app/td.server/node_modules/@babel/runtime/helpers/regeneratorRuntime.js:45:16)\n    at Generator.<anonymous> (/app/td.server/node_modules/@babel/runtime/helpers/regeneratorRuntime.js:133:17)\n    at Generator.next (/app/td.server/node_modules/@babel/runtime/helpers/regeneratorRuntime.js:74:21)\n    at asyncGeneratorStep (/app/td.server/node_modules/@babel/runtime/helpers/asyncToGenerator.js:3:24)\n    at _next (/app/td.server/node_modules/@babel/runtime/helpers/asyncToGenerator.js:22:9)\n    at /app/td.server/node_modules/@babel/runtime/helpers/asyncToGenerator.js:27:7\n    at new Promise (<anonymous>)\n    at /app/td.server/node_modules/@babel/runtime/helpers/asyncToGenerator.js:19:12\n    at _callee$ (/app/td.server/dist/controllers/responseWrapper.js:50:18)\n    at tryCatch (/app/td.server/node_modules/@babel/runtime/helpers/regeneratorRuntime.js:45:16)\n    at Generator.<anonymous> (/app/td.server/node_modules/@babel/runtime/helpers/regeneratorRuntime.js:133:17)\n    at Generator.next (/app/td.server/node_modules/@babel/runtime/helpers/regeneratorRuntime.js:74:21)\n    at asyncGeneratorStep (/app/td.server/node_modules/@babel/runtime/helpers/asyncToGenerator.js:3:24)\n    at _next (/app/td.server/node_modules/@babel/runtime/helpers/asyncToGenerator.js:22:9)","timestamp":"2024-07-05 06:23:54"}
threatdragon-1  | error: undefined {"service":"threat-dragon","timestamp":"2024-07-05 06:23:54"}
```

The reason seems to be the [searchAsync method of the gitlabrepo](https://github.com/OWASP/threat-dragon/blob/main/td.server/src/repositories/gitlabrepo.js#L46), which uses a function that does not exist.

**Expected behaviour**:
The gitlab integration should be able to properly handle the SEARCH_QUERRY env.

Additionally the env should be renamed to make it clear, that it does not only apply to github integrations.

**Environment**:

- Version: 2.2.0

**To Reproduce**:
Integrate a gitlab repo and set GITHUB_USE_SEARCH to true.

**Any additional context, screenshots, etc**:

Side-Note:
Maybe you could consider switching to TS instead of JS.
That way using methods that dont exist becomes way more unlikely...


Pull request:
fix: REPO_SEARCH envs are processed by the application
**Summary**:
The renamed env vars REPO_USE_SEARCH and REPO_SEARCH_QUERY have not been processed by the application, because the app still expected to load env vars calles GITHUB_USE_SEARCH and GITHUB_SEARCH_QUERY.

So I moved the two env vars from the **env/Github.js** file to the general **env/ThreatDragon.js** file...

Additionally the gitlab search does not return an object with an atribute named items but simply just an array.
So i slightly tweak the `threadmodelcontroller` to handle the return value accordingly..
Fixes #1001 

**Description for the changelog**:


Patch:
diff --git a/td.server/src/controllers/threatmodelcontroller.js b/td.server/src/controllers/threatmodelcontroller.js
index 29e9b53b..e43bd781 100644
--- a/td.server/src/controllers/threatmodelcontroller.js
+++ b/td.server/src/controllers/threatmodelcontroller.js
@@ -16,7 +16,7 @@ const repos = (req, res) => responseWrapper.sendResponseAsync(async () => {
         logger.debug('Using searchAsync');
         const searchQuery = env.get().config.REPO_SEARCH_QUERY;
         reposResp = await repository.searchAsync(page, req.provider.access_token, searchQuery);
-        repos = reposResp[0].items;
+        repos = reposResp[0].items ?? reposResp[0];
     } else {
         logger.debug('Using reposAsync');
         reposResp = await repository.reposAsync(page, req.provider.access_token);
diff --git a/td.server/src/env/Github.js b/td.server/src/env/Github.js
index 37641032..f2147608 100644
--- a/td.server/src/env/Github.js
+++ b/td.server/src/env/Github.js
@@ -18,8 +18,6 @@ class GithubEnv extends Env {
             { key: 'ENTERPRISE_HOSTNAME', required: false },
             { key: 'ENTERPRISE_PORT', required: false, defaultValue: 443 },
             { key: 'ENTERPRISE_PROTOCOL', required: false, defaultValue: 'https' },
-            { key: 'USE_SEARCH', required: false, defaultValue: false },
-            { key: 'SEARCH_QUERY', required: false },
             { key: 'REPO_ROOT_DIRECTORY', required: false }
         ];
     }
diff --git a/td.server/src/env/ThreatDragon.js b/td.server/src/env/ThreatDragon.js
index 3edd011d..13087065 100644
--- a/td.server/src/env/ThreatDragon.js
+++ b/td.server/src/env/ThreatDragon.js
@@ -17,7 +17,9 @@ class ThreatDragonEnv extends Env {
             { key: 'LOG_MAX_FILE_SIZE', required: false, defaultValue: 24 },
             { key: 'LOG_LEVEL', required: false, defaultValue: 'warn' },
             { key: 'SERVER_API_PROTOCOL', required: false, defaultValue: 'https' },
-            { key: 'REPO_ROOT_DIRECTORY', required: false, defaultValue: 'ThreatDragonModels' }
+            { key: 'REPO_ROOT_DIRECTORY', required: false, defaultValue: 'ThreatDragonModels' },
+            { key: 'REPO_USE_SEARCH', required: false, defaultValue: false },
+            { key: 'REPO_SEARCH_QUERY', required: false }
         ];
     }
 }


Test patch:
diff --git a/td.server/test/env/ThreatDragon.spec.js b/td.server/test/env/ThreatDragon.spec.js
index 4d80e6cb..82789f01 100644
--- a/td.server/test/env/ThreatDragon.spec.js
+++ b/td.server/test/env/ThreatDragon.spec.js
@@ -56,4 +56,18 @@ describe('env/ThreatDragon.js', () => {
             .required;
         expect(isRequired).to.be.false;
     });
+
+    it('has the optional property REPO_USE_SEARCH', () => {
+        const isRequired = tdEnv.properties
+            .find(x => x.key === 'REPO_USE_SEARCH')
+            .required;
+        expect(isRequired).to.be.false;
+    });
+
+    it('has the optional property REPO_SEARCH_QUERY', () => {
+        const isRequired = tdEnv.properties
+            .find(x => x.key === 'REPO_SEARCH_QUERY')
+            .required;
+        expect(isRequired).to.be.false;
+    });
 });