froosh

froosh - Software Bill of Materials (SBOM) Ingestion & Vulnerability Service

Quick Start & Run

cargo run -- run -p 3000

Then open http://127.0.0.1:3000 in your browser.

Default Admin Login:

• Email: admin@froosh.local
• Password: Password1

Important

Security Requirement: On initial login with default or autogenerated credentials, you will be prompted to set a new secure password before accessing the dashboard.

---

API Usage with curl

1. Authenticate & Obtain Bearer Token

Send a POST request to /login:

LOGIN_RESP=$(curl -s -X POST http://127.0.0.1:3000/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@froosh.local", "password": "Password1"}')

TOKEN=$(echo $LOGIN_RESP | jq -r '.token')
MUST_CHANGE=$(echo $LOGIN_RESP | jq -r '.must_change_password')

echo "Bearer Token: $TOKEN"
echo "Password Update Required: $MUST_CHANGE"

2. Update Password (Required if must_change_password is true)

curl -i -X POST http://127.0.0.1:3000/users/me/password \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"new_password": "MySuperSecretPassword123"}'

3. Invite / Create a New User

curl -i -X POST http://127.0.0.1:3000/users \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "jane@example.com", "password": "SecurePassword1"}'

4. List Projects & Create Project

# List projects
curl -s http://127.0.0.1:3000/projects \
  -H "Authorization: Bearer $TOKEN"

# Create a project
curl -i -X POST http://127.0.0.1:3000/projects \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Backend Service", "description": "Production API microservice"}'

5. Upload CycloneDX / SPDX SBOM File

Upload returns an asynchronous Task ID immediately (Task status set to PENDING):

curl -i -X POST "http://127.0.0.1:3000/upload?project=<PROJECT_ID>&prod=true" \
  -H "Authorization: Bearer $TOKEN" \
  -F "sbom=@sample-sbom.json"

6. Real-time Task Events (Server-Sent Events)

Subscribe to real-time task status updates (PENDING -> PROCESSING -> COMPLETED/FAILED) for a project:

curl -N "http://127.0.0.1:3000/projects/<PROJECT_ID>/events?token=$TOKEN"

7. View Project Tasks & Vulnerability Severity Summary

curl -s http://127.0.0.1:3000/projects/<PROJECT_ID>/tasks \
  -H "Authorization: Bearer $TOKEN"

Returns task status, error details (if failed), and severity breakdowns (critical, high, medium, low).

8. View Full Task Vulnerability Scan Payload

curl -s http://127.0.0.1:3000/tasks/<TASK_ID> \
  -H "Authorization: Bearer $TOKEN"

---

Container Build

podman build -f Containerfile -t froosh:latest