How to Integrate Bolt.new with Trend Micro

1// app/api/security/check-url/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3
4const VT_BASE = 'https://www.virustotal.com/api/v3';
5
6async function vtFetch(path: string, options: RequestInit = {}) {
7  const apiKey = process.env.VIRUSTOTAL_API_KEY;
8  if (!apiKey) throw new Error('VIRUSTOTAL_API_KEY not set');
9  const response = await fetch(`${VT_BASE}${path}`, {
10    ...options,
11    headers: {
12      'x-apikey': apiKey,
13      ...(options.headers ?? {}),
14    },
15  });
16  if (!response.ok) {
17    throw new Error(`VirusTotal API error: ${response.status}`);
18  }
19  return response.json();
20}
21
22async function waitForAnalysis(analysisId: string, maxAttempts = 5): Promise<Record<string, unknown>> {
23  for (let i = 0; i < maxAttempts; i++) {
24    const result = await vtFetch(`/analyses/${analysisId}`);
25    if (result.data?.attributes?.status === 'completed') {
26      return result;
27    }
28    if (i < maxAttempts - 1) {
29      await new Promise((r) => setTimeout(r, 3000));
30    }
31  }
32  throw new Error('Analysis timed out — try again in a few seconds');
33}
34
35export async function POST(request: NextRequest) {
36  const { url } = await request.json() as { url: string };
37
38  if (!url || !url.startsWith('http')) {
39    return NextResponse.json({ error: 'Valid URL required' }, { status: 400 });
40  }
41
42  try {
43    // Step 1: Submit URL for scanning
44    const urlId = btoa(url).replace(/=/g, ''); // Base64url encode without padding
45
46    // Try to get existing analysis first (avoids rate limit)
47    let analysisData: Record<string, unknown>;
48    try {
49      const existing = await vtFetch(`/urls/${urlId}`);
50      analysisData = existing;
51    } catch {
52      // URL not in cache — submit for new scan
53      const submitForm = new FormData();
54      submitForm.append('url', url);
55      const submitted = await vtFetch('/urls', { method: 'POST', body: submitForm });
56      analysisData = await waitForAnalysis(submitted.data.id);
57    }
58
59    const stats = (analysisData.data as Record<string, unknown>)?.attributes as Record<string, Record<string, number>>;
60    const lastAnalysis = stats?.last_analysis_stats ?? {};
61
62    const malicious = lastAnalysis.malicious ?? 0;
63    const suspicious = lastAnalysis.suspicious ?? 0;
64    const harmless = lastAnalysis.harmless ?? 0;
65    const total = malicious + suspicious + harmless + (lastAnalysis.undetected ?? 0);
66
67    const verdict = malicious >= 3 ? 'malicious'
68      : malicious >= 1 || suspicious >= 2 ? 'suspicious'
69      : 'clean';
70
71    return NextResponse.json({
72      url,
73      verdict,
74      malicious,
75      suspicious,
76      harmless,
77      totalEngines: total,
78      permalink: (analysisData.data as Record<string, unknown>)?.links as Record<string, string> ?? {},
79    });
80  } catch (error) {
81    const message = error instanceof Error ? error.message : 'Scan failed';
82    return NextResponse.json({ error: message }, { status: 500 });
83  }
84}

1// app/api/security/check-email/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3
4export async function POST(request: NextRequest) {
5  const { email } = await request.json() as { email: string };
6
7  if (!email || !email.includes('@')) {
8    return NextResponse.json({ error: 'Valid email required' }, { status: 400 });
9  }
10
11  const apiKey = process.env.HIBP_API_KEY;
12  if (!apiKey) {
13    return NextResponse.json({ error: 'HIBP_API_KEY not configured' }, { status: 500 });
14  }
15
16  try {
17    const response = await fetch(
18      `https://haveibeenpwned.com/api/v3/breachedaccount/${encodeURIComponent(email)}?truncateResponse=false`,
19      {
20        headers: {
21          'hibp-api-key': apiKey,
22          'User-Agent': 'BoltApp-SecurityCheck',
23        },
24      }
25    );
26
27    if (response.status === 404) {
28      return NextResponse.json({ email, breaches: [], safe: true, count: 0 });
29    }
30
31    if (!response.ok) {
32      throw new Error(`HIBP API error: ${response.status}`);
33    }
34
35    const breaches = await response.json() as Array<{
36      Name: string;
37      BreachDate: string;
38      PwnCount: number;
39      DataClasses: string[];
40    }>;
41
42    return NextResponse.json({
43      email,
44      safe: false,
45      count: breaches.length,
46      breaches: breaches.map((b) => ({
47        name: b.Name,
48        date: b.BreachDate,
49        compromisedAccounts: b.PwnCount,
50        dataTypes: b.DataClasses,
51      })),
52    });
53  } catch (error) {
54    const message = error instanceof Error ? error.message : 'Check failed';
55    return NextResponse.json({ error: message }, { status: 500 });
56  }
57}
58
59// app/api/security/check-password/route.ts — k-anonymity password check
60// Client sends only first 5 chars of SHA-1 hash
61export async function GET_password(request: NextRequest) {
62  const { searchParams } = new URL(request.url);
63  const prefix = searchParams.get('prefix');
64  const suffix = searchParams.get('suffix')?.toUpperCase();
65
66  if (!prefix || prefix.length !== 5 || !suffix) {
67    return NextResponse.json({ error: 'prefix (5 chars) and suffix required' }, { status: 400 });
68  }
69
70  const response = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`);
71  const text = await response.text();
72
73  const lines = text.split('\r\n');
74  const match = lines.find((line) => line.startsWith(suffix));
75  const count = match ? parseInt(match.split(':')[1], 10) : 0;
76
77  return NextResponse.json({ prefix, compromised: count > 0, occurrences: count });
78}

1// components/SecurityDashboard.tsx
2'use client';
3
4import { useState } from 'react';
5
6interface UrlScanResult {
7  url: string;
8  verdict: 'clean' | 'suspicious' | 'malicious';
9  malicious: number;
10  suspicious: number;
11  harmless: number;
12  totalEngines: number;
13}
14
15interface BreachResult {
16  email: string;
17  safe: boolean;
18  count: number;
19  breaches: Array<{ name: string; date: string; dataTypes: string[] }>;
20}
21
22const verdictConfig = {
23  clean: { color: 'bg-green-100 text-green-800 border-green-200', label: 'Clean' },
24  suspicious: { color: 'bg-yellow-100 text-yellow-800 border-yellow-200', label: 'Suspicious' },
25  malicious: { color: 'bg-red-100 text-red-800 border-red-200', label: 'Malicious' },
26};
27
28export default function SecurityDashboard() {
29  const [urlInput, setUrlInput] = useState('');
30  const [urlResult, setUrlResult] = useState<UrlScanResult | null>(null);
31  const [urlLoading, setUrlLoading] = useState(false);
32  const [urlError, setUrlError] = useState('');
33
34  const [emailInput, setEmailInput] = useState('');
35  const [breachResult, setBreachResult] = useState<BreachResult | null>(null);
36  const [emailLoading, setEmailLoading] = useState(false);
37  const [emailError, setEmailError] = useState('');
38
39  async function scanUrl() {
40    if (!urlInput) return;
41    setUrlLoading(true);
42    setUrlError('');
43    setUrlResult(null);
44    try {
45      const res = await fetch('/api/security/check-url', {
46        method: 'POST',
47        headers: { 'Content-Type': 'application/json' },
48        body: JSON.stringify({ url: urlInput }),
49      });
50      const data = await res.json();
51      if (data.error) throw new Error(data.error);
52      setUrlResult(data);
53    } catch (e) {
54      setUrlError(e instanceof Error ? e.message : 'Scan failed');
55    } finally {
56      setUrlLoading(false);
57    }
58  }
59
60  async function checkEmail() {
61    if (!emailInput) return;
62    setEmailLoading(true);
63    setEmailError('');
64    setBreachResult(null);
65    try {
66      const res = await fetch('/api/security/check-email', {
67        method: 'POST',
68        headers: { 'Content-Type': 'application/json' },
69        body: JSON.stringify({ email: emailInput }),
70      });
71      const data = await res.json();
72      if (data.error) throw new Error(data.error);
73      setBreachResult(data);
74    } catch (e) {
75      setEmailError(e instanceof Error ? e.message : 'Check failed');
76    } finally {
77      setEmailLoading(false);
78    }
79  }
80
81  return (
82    <div className="p-6 max-w-2xl mx-auto space-y-8">
83      <h1 className="text-2xl font-bold">Security Dashboard</h1>
84
85      <section className="border rounded-lg p-6">
86        <h2 className="text-lg font-semibold mb-4">URL Safety Scanner</h2>
87        <div className="flex gap-2 mb-4">
88          <input value={urlInput} onChange={(e) => setUrlInput(e.target.value)}
89            placeholder="https://example.com" className="flex-1 border rounded px-3 py-2 text-sm" />
90          <button onClick={scanUrl} disabled={urlLoading}
91            className="px-4 py-2 bg-blue-600 text-white rounded text-sm disabled:opacity-50">
92            {urlLoading ? 'Scanning...' : 'Scan URL'}
93          </button>
94        </div>
95        {urlError && <p className="text-red-600 text-sm">{urlError}</p>}
96        {urlResult && (
97          <div className={`border rounded p-4 ${verdictConfig[urlResult.verdict].color}`}>
98            <div className="flex justify-between items-center mb-2">
99              <span className="font-semibold">{verdictConfig[urlResult.verdict].label}</span>
100              <span className="text-sm">{urlResult.malicious} / {urlResult.totalEngines} engines flagged</span>
101            </div>
102            <p className="text-xs truncate">{urlResult.url}</p>
103          </div>
104        )}
105      </section>
106
107      <section className="border rounded-lg p-6">
108        <h2 className="text-lg font-semibold mb-4">Email Breach Check</h2>
109        <div className="flex gap-2 mb-4">
110          <input value={emailInput} onChange={(e) => setEmailInput(e.target.value)}
111            type="email" placeholder="user@example.com"
112            className="flex-1 border rounded px-3 py-2 text-sm" />
113          <button onClick={checkEmail} disabled={emailLoading}
114            className="px-4 py-2 bg-blue-600 text-white rounded text-sm disabled:opacity-50">
115            {emailLoading ? 'Checking...' : 'Check Email'}
116          </button>
117        </div>
118        {emailError && <p className="text-red-600 text-sm">{emailError}</p>}
119        {breachResult && (
120          breachResult.safe ? (
121            <div className="bg-green-50 border border-green-200 rounded p-4 text-green-800">
122              No known data breaches found for this email address.
123            </div>
124          ) : (
125            <div className="bg-red-50 border border-red-200 rounded p-4">
126              <p className="font-semibold text-red-800 mb-2">
127                Found in {breachResult.count} breach{breachResult.count !== 1 ? 'es' : ''}
128              </p>
129              <ul className="space-y-1">
130                {breachResult.breaches.slice(0, 5).map((b) => (
131                  <li key={b.name} className="text-sm text-red-700">
132                    <strong>{b.name}</strong> ({b.date}) — {b.dataTypes.slice(0, 3).join(', ')}
133                  </li>
134                ))}
135              </ul>
136            </div>
137          )
138        )}
139      </section>
140    </div>
141  );
142}