Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sharang ParnerkarandClaude Fable 5
|
e5f4b562c3 |
@@ -47,11 +47,6 @@ PLC_RUNTIME_MAX_LIFETIME_SECS=180
|
||||
PLC_RUNTIME_OPENPLC_USER=openplc
|
||||
PLC_RUNTIME_OPENPLC_PASSWORD=openplc
|
||||
|
||||
# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
|
||||
# When set, mounts the runner-facing queue + artifact endpoints behind this
|
||||
# bearer token; runners present the same token. Unset = endpoints not mounted.
|
||||
WERKBANK_RUNNER_TOKEN=
|
||||
|
||||
# Dashboard
|
||||
DASHBOARD_PORT=8080
|
||||
AGENT_API_URL=http://localhost:3001
|
||||
|
||||
+13
-34
@@ -7,13 +7,6 @@ on:
|
||||
pull_request:
|
||||
|
||||
env:
|
||||
# registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot
|
||||
# username contains '$', which sh expands when interpolated into the
|
||||
# script (robot$ci-push -> robot-push) => docker login unauthorized.
|
||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
||||
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
|
||||
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
|
||||
CARGO_TERM_COLOR: always
|
||||
RUSTFLAGS: "-D warnings"
|
||||
# Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
|
||||
@@ -72,7 +65,7 @@ jobs:
|
||||
echo '[source.crates-io]'
|
||||
echo 'replace-with = "kellnr"'
|
||||
echo '[registries.kellnr]'
|
||||
echo 'index = "sparse+https://crates.breakpilot.com/api/v1/cratesio/"'
|
||||
echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
|
||||
} >> "$CARGO_HOME/config.toml"
|
||||
env:
|
||||
RUSTC_WRAPPER: ""
|
||||
@@ -94,8 +87,8 @@ jobs:
|
||||
- name: Configure git auth for private tramiton dependency
|
||||
run: |
|
||||
git config --global \
|
||||
url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@git.breakpilot.com/".insteadOf \
|
||||
"ssh://git@git.breakpilot.com:22222/"
|
||||
url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
|
||||
"ssh://git@gitea.meghsakha.com:22222/"
|
||||
env:
|
||||
RUSTC_WRAPPER: ""
|
||||
|
||||
@@ -116,8 +109,6 @@ jobs:
|
||||
run: cargo clippy -p compliance-mcp -- -D warnings
|
||||
- name: Clippy (werkbank-exec)
|
||||
run: cargo clippy -p werkbank-exec -- -D warnings
|
||||
- name: Clippy (control-map)
|
||||
run: cargo clippy -p control-map -- -D warnings
|
||||
|
||||
# Security audit
|
||||
- name: Security Audit
|
||||
@@ -126,8 +117,8 @@ jobs:
|
||||
RUSTC_WRAPPER: ""
|
||||
|
||||
# Tests (reuses compilation artifacts from clippy)
|
||||
- name: Tests (core + agent + werkbank-exec + control-map)
|
||||
run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
|
||||
- name: Tests (core + agent + werkbank-exec)
|
||||
run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib
|
||||
- name: Tests (dashboard server)
|
||||
run: cargo test -p compliance-dashboard --features server --no-default-features
|
||||
- name: Tests (dashboard web)
|
||||
@@ -213,14 +204,11 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.breakpilot.com/certifai/compliance-agent
|
||||
echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-agent
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
|
||||
-f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
{ command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
|
||||
chmod +x /usr/local/bin/cosign 2>/dev/null || true
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
@@ -240,14 +228,11 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.breakpilot.com/certifai/compliance-dashboard
|
||||
echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-dashboard
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
|
||||
-f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
{ command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
|
||||
chmod +x /usr/local/bin/cosign 2>/dev/null || true
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
@@ -265,13 +250,10 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.breakpilot.com/certifai/compliance-docs
|
||||
echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-docs
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
{ command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
|
||||
chmod +x /usr/local/bin/cosign 2>/dev/null || true
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
@@ -291,14 +273,11 @@ jobs:
|
||||
apk add --no-cache git curl openssl
|
||||
git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
|
||||
git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
|
||||
IMAGE=repo.breakpilot.com/certifai/compliance-mcp
|
||||
echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
|
||||
IMAGE=registry.meghsakha.com/compliance-mcp
|
||||
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
|
||||
-f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
|
||||
docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
|
||||
{ command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
|
||||
chmod +x /usr/local/bin/cosign 2>/dev/null || true
|
||||
cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
|
||||
PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
|
||||
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
|
||||
RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
|
||||
|
||||
Generated
-17
@@ -666,7 +666,6 @@ dependencies = [
|
||||
"compliance-core",
|
||||
"compliance-dast",
|
||||
"compliance-graph",
|
||||
"control-map",
|
||||
"dashmap",
|
||||
"dotenvy",
|
||||
"futures-core",
|
||||
@@ -969,15 +968,6 @@ dependencies = [
|
||||
"charset",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "control-map"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.18",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "convert_case"
|
||||
version = "0.8.0"
|
||||
@@ -5099,12 +5089,6 @@ dependencies = [
|
||||
"digest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sha1_smol"
|
||||
version = "1.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
|
||||
|
||||
[[package]]
|
||||
name = "sha2"
|
||||
version = "0.10.9"
|
||||
@@ -6488,7 +6472,6 @@ dependencies = [
|
||||
"getrandom 0.4.1",
|
||||
"js-sys",
|
||||
"serde_core",
|
||||
"sha1_smol",
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
|
||||
+1
-3
@@ -8,7 +8,6 @@ members = [
|
||||
"compliance-mcp",
|
||||
"compliance-smoke",
|
||||
"werkbank-exec",
|
||||
"control-map",
|
||||
]
|
||||
resolver = "2"
|
||||
|
||||
@@ -18,7 +17,6 @@ expect_used = "deny"
|
||||
|
||||
[workspace.dependencies]
|
||||
compliance-core = { path = "compliance-core", default-features = false }
|
||||
control-map = { path = "control-map" }
|
||||
serde = { version = "1", features = ["derive"] }
|
||||
serde_json = "1"
|
||||
tokio = { version = "1", features = ["full"] }
|
||||
@@ -30,7 +28,7 @@ reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "co
|
||||
thiserror = "2"
|
||||
sha2 = "0.10"
|
||||
hex = "0.4"
|
||||
uuid = { version = "1", features = ["v4", "v5", "serde"] }
|
||||
uuid = { version = "1", features = ["v4", "serde"] }
|
||||
secrecy = { version = "0.10", features = ["serde"] }
|
||||
regex = "1"
|
||||
zip = { version = "2", features = ["aes-crypto", "deflate"] }
|
||||
|
||||
+2
-2
@@ -8,8 +8,8 @@ COPY . .
|
||||
RUN --mount=type=secret,id=tramiton_token \
|
||||
if [ -s /run/secrets/tramiton_token ]; then \
|
||||
git config --global \
|
||||
url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
|
||||
"ssh://git@git.breakpilot.com:22222/"; \
|
||||
url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
|
||||
"ssh://git@gitea.meghsakha.com:22222/"; \
|
||||
fi && \
|
||||
CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
|
||||
|
||||
|
||||
@@ -13,8 +13,8 @@ ENV DOCS_URL=${DOCS_URL}
|
||||
RUN --mount=type=secret,id=tramiton_token \
|
||||
if [ -s /run/secrets/tramiton_token ]; then \
|
||||
git config --global \
|
||||
url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
|
||||
"ssh://git@git.breakpilot.com:22222/"; \
|
||||
url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
|
||||
"ssh://git@gitea.meghsakha.com:22222/"; \
|
||||
fi && \
|
||||
CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
|
||||
|
||||
|
||||
+2
-2
@@ -8,8 +8,8 @@ COPY . .
|
||||
RUN --mount=type=secret,id=tramiton_token \
|
||||
if [ -s /run/secrets/tramiton_token ]; then \
|
||||
git config --global \
|
||||
url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
|
||||
"ssh://git@git.breakpilot.com:22222/"; \
|
||||
url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
|
||||
"ssh://git@gitea.meghsakha.com:22222/"; \
|
||||
fi && \
|
||||
CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
|
||||
|
||||
|
||||
@@ -8,7 +8,6 @@ workspace = true
|
||||
|
||||
[dependencies]
|
||||
compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
|
||||
control-map = { workspace = true }
|
||||
compliance-graph = { path = "../compliance-graph" }
|
||||
compliance-dast = { path = "../compliance-dast" }
|
||||
# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also
|
||||
|
||||
@@ -1,117 +0,0 @@
|
||||
# Custom semgrep rules for CRA controls that no off-the-shelf ruleset digs out.
|
||||
# Each rule id is `cra-ai-<n>-<slug>` and is keyed back to its control via the
|
||||
# `control-map` LUT (by rule-id suffix, so semgrep's path prefix on check_id does
|
||||
# not matter). Detection here is deterministic; the grounded LLM judge downstream
|
||||
# only confirms/refutes — it never detects. Keep patterns tight: a false positive
|
||||
# that the judge refutes marks the whole finding a false positive.
|
||||
rules:
|
||||
# --- cra-ai-1: Secure-by-Default-Konfiguration -------------------------------
|
||||
- id: cra-ai-1-flask-debug-enabled
|
||||
languages: [python]
|
||||
severity: WARNING
|
||||
message: Flask app started with debug=True — ships an interactive debugger / code execution in production (secure-by-default violation).
|
||||
metadata:
|
||||
cwe: ["CWE-489: Active Debug Code"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern: '$APP.run(..., debug=True, ...)'
|
||||
|
||||
- id: cra-ai-1-django-debug-true
|
||||
languages: [python]
|
||||
severity: WARNING
|
||||
message: Django DEBUG = True — leaks stack traces / settings in production (secure-by-default violation).
|
||||
metadata:
|
||||
cwe: ["CWE-489: Active Debug Code"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern: 'DEBUG = True'
|
||||
|
||||
- id: cra-ai-1-tls-verify-disabled
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: TLS certificate verification disabled (verify=False) — defeats transport security by default.
|
||||
metadata:
|
||||
cwe: ["CWE-295: Improper Certificate Validation"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern: 'requests.$M(..., verify=False, ...)'
|
||||
|
||||
- id: cra-ai-1-cors-wildcard
|
||||
languages: [javascript, typescript]
|
||||
severity: WARNING
|
||||
message: CORS Access-Control-Allow-Origin set to "*" — opens the API to any origin by default.
|
||||
metadata:
|
||||
cwe: ["CWE-942: Permissive Cross-domain Policy with Untrusted Domains"]
|
||||
control: cra-ai-1
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: '$RES.header("Access-Control-Allow-Origin", "*")'
|
||||
- pattern: '$RES.setHeader("Access-Control-Allow-Origin", "*")'
|
||||
|
||||
# --- cra-ai-7: Starke Authentifizierung (weak password hashing) --------------
|
||||
- id: cra-ai-7-weak-password-hash
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: Password/secret hashed with a fast, broken digest (md5/sha1) — use a password KDF (bcrypt/scrypt/argon2).
|
||||
metadata:
|
||||
cwe: ["CWE-916: Use of Password Hash With Insufficient Computational Effort"]
|
||||
control: cra-ai-7
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'hashlib.md5($PW)'
|
||||
- pattern: 'hashlib.sha1($PW)'
|
||||
- metavariable-regex:
|
||||
metavariable: $PW
|
||||
regex: '(?i).*(pass|pwd|secret|cred|token).*'
|
||||
|
||||
# --- cra-ai-10: Sitzungsmanagement (insecure session cookies) ----------------
|
||||
- id: cra-ai-10-session-cookie-insecure
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: Session cookie hardened flag explicitly disabled (Secure/HttpOnly = False) — session token exposed to theft.
|
||||
metadata:
|
||||
cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
|
||||
control: cra-ai-10
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'SESSION_COOKIE_SECURE = False'
|
||||
- pattern: 'SESSION_COOKIE_HTTPONLY = False'
|
||||
|
||||
- id: cra-ai-10-express-cookie-insecure
|
||||
languages: [javascript, typescript]
|
||||
severity: ERROR
|
||||
message: Express cookie set with secure/httpOnly = false — session token exposed to interception / XSS theft.
|
||||
metadata:
|
||||
cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
|
||||
control: cra-ai-10
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: '$RES.cookie($NAME, $VAL, {..., secure: false, ...})'
|
||||
- pattern: '$RES.cookie($NAME, $VAL, {..., httpOnly: false, ...})'
|
||||
|
||||
# --- cra-ai-14: Speicher-Schutz / Data at Rest (weak cipher) -----------------
|
||||
- id: cra-ai-14-python-weak-cipher
|
||||
languages: [python]
|
||||
severity: ERROR
|
||||
message: Data-at-rest encrypted with a broken cipher/mode (ECB, DES, 3DES) — provides no real confidentiality.
|
||||
metadata:
|
||||
cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
|
||||
control: cra-ai-14
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'AES.new($K, AES.MODE_ECB, ...)'
|
||||
- pattern: 'DES.new(...)'
|
||||
- pattern: 'DES3.new(...)'
|
||||
|
||||
- id: cra-ai-14-node-weak-cipher
|
||||
languages: [javascript, typescript]
|
||||
severity: ERROR
|
||||
message: Data-at-rest encrypted with a broken cipher (DES / deprecated createCipher) — provides no real confidentiality.
|
||||
metadata:
|
||||
cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
|
||||
control: cra-ai-14
|
||||
patterns:
|
||||
- pattern-either:
|
||||
- pattern: 'crypto.createCipheriv("des-ecb", ...)'
|
||||
- pattern: 'crypto.createCipheriv("des", ...)'
|
||||
- pattern: 'crypto.createCipher(...)'
|
||||
@@ -10,12 +10,10 @@ pub mod issues;
|
||||
pub mod mcp_tokens;
|
||||
pub mod notifications;
|
||||
pub mod onboarding;
|
||||
pub mod oscal;
|
||||
pub mod pentest_handlers;
|
||||
pub use pentest_handlers as pentest;
|
||||
pub mod sbom;
|
||||
pub mod scans;
|
||||
pub mod werkbank_jobs;
|
||||
|
||||
// Re-export all handler functions so routes.rs can use `handlers::function_name`
|
||||
pub use dto::*;
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
//! OSCAL assessment endpoint.
|
||||
//!
|
||||
//! Returns a standard OSCAL assessment-results document for a target's findings,
|
||||
//! driven by each finding's stamped `control_refs` (from the scan's control-triage
|
||||
//! stage): mapped findings target their controls, unmapped findings are reported
|
||||
//! as-is. See `compliance_core::models::oscal_assessment`.
|
||||
|
||||
use axum::extract::Extension;
|
||||
use axum::http::StatusCode;
|
||||
use axum::response::{IntoResponse, Response};
|
||||
use axum::Json;
|
||||
use mongodb::bson::doc;
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::models::oscal_assessment::assess;
|
||||
use compliance_core::models::Finding;
|
||||
use compliance_core::tenant_ctx::TenantCtx;
|
||||
|
||||
use super::dto::{collect_cursor_async, tenant_db, AgentExt};
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct AssessRequest {
|
||||
/// The target / repo id whose findings are assessed.
|
||||
pub target_id: String,
|
||||
}
|
||||
|
||||
/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
|
||||
pub async fn assess_target(
|
||||
Extension(agent): AgentExt,
|
||||
tenant: TenantCtx,
|
||||
Json(req): Json<AssessRequest>,
|
||||
) -> Response {
|
||||
let db = match tenant_db(&agent, &tenant).await {
|
||||
Ok(db) => db,
|
||||
Err(code) => return code.into_response(),
|
||||
};
|
||||
|
||||
let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
|
||||
{
|
||||
Ok(cursor) => collect_cursor_async(cursor).await,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
|
||||
return StatusCode::INTERNAL_SERVER_ERROR.into_response();
|
||||
}
|
||||
};
|
||||
|
||||
Json(assess(&findings, chrono::Utc::now())).into_response()
|
||||
}
|
||||
@@ -1,289 +0,0 @@
|
||||
//! Werkbank runner endpoints (`/api/v1/werkbank/jobs/*`).
|
||||
//!
|
||||
//! The pull API a Werkbank runner talks to: lease a job, heartbeat while it runs,
|
||||
//! and post the result back. Machine auth is a **static bearer token**
|
||||
//! (`WERKBANK_RUNNER_TOKEN`) — not a Keycloak JWT, because a runner acts across
|
||||
//! tenants (each request names its `tenant`). Routes are only mounted when the
|
||||
//! token is configured; with none set they don't exist (404).
|
||||
//!
|
||||
//! On completion the runner's findings are persisted against the job's target,
|
||||
//! so a job run by a remote runner lands the same findings an in-process run
|
||||
//! would (WB-05, the control-plane cut-over).
|
||||
|
||||
use axum::extract::{Extension, Path, Request};
|
||||
use axum::http::{header, StatusCode};
|
||||
use axum::middleware::Next;
|
||||
use axum::response::{IntoResponse, Response};
|
||||
use axum::Json;
|
||||
use mongodb::bson::{doc, oid::ObjectId};
|
||||
use secrecy::ExposeSecret;
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::time::Duration;
|
||||
|
||||
use compliance_core::models::werkbank::{
|
||||
CompleteRequest, CompleteResponse, HeartbeatRequest, InputRef, Job, JobResult, LeaseRequest,
|
||||
};
|
||||
use compliance_core::models::ArtifactKind;
|
||||
|
||||
use super::dto::AgentExt;
|
||||
use crate::database::Database;
|
||||
use crate::werkbank::JobQueue;
|
||||
|
||||
/// Gate the runner endpoints behind the static runner bearer token.
|
||||
pub async fn require_runner_token(
|
||||
Extension(agent): AgentExt,
|
||||
request: Request,
|
||||
next: Next,
|
||||
) -> Response {
|
||||
let Some(expected) = agent.config.werkbank_runner_token.as_ref() else {
|
||||
return (StatusCode::NOT_FOUND, "werkbank runner API disabled").into_response();
|
||||
};
|
||||
let presented = request
|
||||
.headers()
|
||||
.get(header::AUTHORIZATION)
|
||||
.and_then(|v| v.to_str().ok())
|
||||
.and_then(|s| s.strip_prefix("Bearer "))
|
||||
.map(str::trim)
|
||||
.filter(|s| !s.is_empty());
|
||||
let Some(presented) = presented else {
|
||||
return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
|
||||
};
|
||||
if !constant_time_eq(presented, expected.expose_secret()) {
|
||||
return (StatusCode::UNAUTHORIZED, "Invalid runner token").into_response();
|
||||
}
|
||||
next.run(request).await
|
||||
}
|
||||
|
||||
/// `POST /api/v1/werkbank/jobs/lease` — lease the oldest runnable job, or `204`.
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, runner = %req.runner_id))]
|
||||
pub async fn lease(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<LeaseRequest>,
|
||||
) -> Result<Response, StatusCode> {
|
||||
let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
|
||||
let leased = queue
|
||||
.lease(
|
||||
&req.runner_id,
|
||||
req.executor,
|
||||
&req.labels,
|
||||
Duration::from_secs(req.lease_ttl_secs),
|
||||
chrono::Utc::now(),
|
||||
)
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
Ok(match leased {
|
||||
Some(job) => Json(job).into_response(),
|
||||
None => StatusCode::NO_CONTENT.into_response(),
|
||||
})
|
||||
}
|
||||
|
||||
/// `POST /api/v1/werkbank/jobs/heartbeat` — extend the lease; `409` if it's lost.
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
|
||||
pub async fn heartbeat(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<HeartbeatRequest>,
|
||||
) -> Result<Response, StatusCode> {
|
||||
let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
|
||||
let ack = queue
|
||||
.heartbeat(
|
||||
&req.job_id,
|
||||
&req.lease_token,
|
||||
Duration::from_secs(req.lease_ttl_secs),
|
||||
chrono::Utc::now(),
|
||||
)
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
Ok(match ack {
|
||||
Some(ack) => Json(ack).into_response(),
|
||||
// Lease lost — the runner should abandon the job.
|
||||
None => StatusCode::CONFLICT.into_response(),
|
||||
})
|
||||
}
|
||||
|
||||
/// `POST /api/v1/werkbank/jobs/complete` — record the result and persist findings.
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
|
||||
pub async fn complete(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<CompleteRequest>,
|
||||
) -> Result<Json<CompleteResponse>, StatusCode> {
|
||||
let db = tenant_db(&agent, &req.tenant).await?;
|
||||
let queue = JobQueue::new(&db);
|
||||
let now = chrono::Utc::now();
|
||||
let recorded = queue
|
||||
.complete(&req.job_id, &req.lease_token, &req.result, now)
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
|
||||
// Only persist findings for the run that actually recorded the result, so a
|
||||
// duplicate/late completion can't double-insert.
|
||||
if recorded {
|
||||
if let Some(record) = queue.get(&req.job_id).await.map_err(internal)? {
|
||||
persist_findings(&db, &record.job.target_id, &req.result).await;
|
||||
}
|
||||
}
|
||||
Ok(Json(CompleteResponse { recorded }))
|
||||
}
|
||||
|
||||
/// `GET /api/v1/werkbank/artifacts/{hash}` — serve a content-addressed blob (the
|
||||
/// program a runner needs to load). The hash is validated against traversal by
|
||||
/// [`crate::ingest::blob::read_blob`]; a runner fetches this for a job's `blob`
|
||||
/// input.
|
||||
#[tracing::instrument(skip_all, fields(hash = %hash))]
|
||||
pub async fn serve_artifact(
|
||||
Extension(agent): AgentExt,
|
||||
Path(hash): Path<String>,
|
||||
) -> Result<Response, StatusCode> {
|
||||
let base = std::path::Path::new(&agent.config.artifact_store_base_path);
|
||||
match crate::ingest::blob::read_blob(base, &hash) {
|
||||
Ok(bytes) => {
|
||||
Ok(([(header::CONTENT_TYPE, "application/octet-stream")], bytes).into_response())
|
||||
}
|
||||
Err(_) => Err(StatusCode::NOT_FOUND),
|
||||
}
|
||||
}
|
||||
|
||||
/// Enqueue a `plc-provision` job for a target: extract its control-logic program,
|
||||
/// stash it as a content-addressed blob (which the runner fetches via
|
||||
/// [`serve_artifact`]), and queue the job. This is the control-plane "enqueue"
|
||||
/// half of the loop — a runner then leases it, provisions, and posts results.
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct EnqueueRequest {
|
||||
/// The tenant whose queue to enqueue into.
|
||||
pub tenant: String,
|
||||
/// The onboarded target to test.
|
||||
pub target_id: String,
|
||||
}
|
||||
|
||||
/// The enqueued job's id.
|
||||
#[derive(Debug, Serialize)]
|
||||
pub struct EnqueueResponse {
|
||||
/// The new job id.
|
||||
pub job_id: String,
|
||||
/// Whether this call inserted it (false = already queued).
|
||||
pub enqueued: bool,
|
||||
}
|
||||
|
||||
#[tracing::instrument(skip_all, fields(tenant = %req.tenant, target = %req.target_id))]
|
||||
pub async fn enqueue(
|
||||
Extension(agent): AgentExt,
|
||||
Json(req): Json<EnqueueRequest>,
|
||||
) -> Result<Json<EnqueueResponse>, StatusCode> {
|
||||
let db = tenant_db(&agent, &req.tenant).await?;
|
||||
let oid = ObjectId::parse_str(&req.target_id).map_err(|_| StatusCode::BAD_REQUEST)?;
|
||||
let target = db
|
||||
.onboarded_targets()
|
||||
.find_one(doc! { "_id": oid })
|
||||
.await
|
||||
.map_err(internal)?
|
||||
.ok_or(StatusCode::NOT_FOUND)?;
|
||||
|
||||
// Extract the control-logic program from the target's PLC-source artifacts
|
||||
// (same selection as the in-process PLC scan).
|
||||
let ctx = crate::ingest::IngestContext::from_config(&agent.config, &req.target_id);
|
||||
let ingest_set = crate::ingest::ingest_all(&target, &ctx).map_err(internal)?;
|
||||
let program = target
|
||||
.artifacts
|
||||
.iter()
|
||||
.filter(|a| {
|
||||
matches!(
|
||||
a.kind,
|
||||
ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
|
||||
)
|
||||
})
|
||||
.find_map(|a| {
|
||||
let path = ingest_set
|
||||
.get(&a.id)
|
||||
.and_then(|ia| ia.working_path.clone())?;
|
||||
werkbank_exec::plc::extract_program(&path)
|
||||
})
|
||||
.ok_or(StatusCode::UNPROCESSABLE_ENTITY)?;
|
||||
|
||||
// Stash the program source so the runner can fetch it by hash.
|
||||
let base = std::path::Path::new(&agent.config.artifact_store_base_path);
|
||||
let hash =
|
||||
crate::ingest::blob::store_bytes(base, program.source.as_bytes()).map_err(internal)?;
|
||||
|
||||
let job_id = format!("job_{}", uuid::Uuid::new_v4().simple());
|
||||
let job = Job::plc_provision(
|
||||
&job_id,
|
||||
&req.tenant,
|
||||
&req.target_id,
|
||||
InputRef::blob(hash),
|
||||
agent.config.plc_runtime.max_lifetime_secs,
|
||||
);
|
||||
let enqueued = JobQueue::new(&db)
|
||||
.enqueue(job, chrono::Utc::now())
|
||||
.await
|
||||
.map_err(internal)?;
|
||||
Ok(Json(EnqueueResponse { job_id, enqueued }))
|
||||
}
|
||||
|
||||
/// Persist a job result's findings against its target: general findings
|
||||
/// (dedup'd by fingerprint) and DAST findings. Best-effort — a persistence hiccup
|
||||
/// is logged, not surfaced to the runner (its result is already recorded).
|
||||
async fn persist_findings(db: &Database, target_id: &str, result: &JobResult) {
|
||||
for finding in &result.findings {
|
||||
let exists = db
|
||||
.findings()
|
||||
.find_one(doc! { "fingerprint": &finding.fingerprint })
|
||||
.await
|
||||
.ok()
|
||||
.flatten()
|
||||
.is_some();
|
||||
if !exists {
|
||||
if let Err(e) = db.findings().insert_one(finding).await {
|
||||
tracing::warn!(target_id, error = %e, "werkbank: persist finding failed");
|
||||
}
|
||||
}
|
||||
}
|
||||
for finding in &result.dast_findings {
|
||||
if let Err(e) = db.dast_findings().insert_one(finding).await {
|
||||
tracing::warn!(target_id, error = %e, "werkbank: persist DAST finding failed");
|
||||
}
|
||||
}
|
||||
tracing::info!(
|
||||
target_id,
|
||||
findings = result.findings.len(),
|
||||
dast = result.dast_findings.len(),
|
||||
"werkbank: persisted runner results"
|
||||
);
|
||||
}
|
||||
|
||||
/// Resolve the tenant-scoped database for a request.
|
||||
async fn tenant_db(
|
||||
agent: &crate::agent::ComplianceAgent,
|
||||
tenant: &str,
|
||||
) -> Result<Database, StatusCode> {
|
||||
agent.db_pool.for_tenant_id(tenant).await.map_err(internal)
|
||||
}
|
||||
|
||||
/// Map any internal error to a 500.
|
||||
fn internal<E: std::fmt::Display>(e: E) -> StatusCode {
|
||||
tracing::error!("werkbank endpoint error: {e}");
|
||||
StatusCode::INTERNAL_SERVER_ERROR
|
||||
}
|
||||
|
||||
/// Length-checked, constant-time-ish token comparison.
|
||||
fn constant_time_eq(a: &str, b: &str) -> bool {
|
||||
if a.len() != b.len() {
|
||||
return false;
|
||||
}
|
||||
let mut diff = 0u8;
|
||||
for (x, y) in a.bytes().zip(b.bytes()) {
|
||||
diff |= x ^ y;
|
||||
}
|
||||
diff == 0
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::constant_time_eq;
|
||||
|
||||
#[test]
|
||||
fn token_compare() {
|
||||
assert!(constant_time_eq("secret", "secret"));
|
||||
assert!(!constant_time_eq("secret", "secrex"));
|
||||
assert!(!constant_time_eq("secret", "secretx"));
|
||||
assert!(!constant_time_eq("", "x"));
|
||||
}
|
||||
}
|
||||
@@ -6,7 +6,6 @@ use crate::api::handlers;
|
||||
pub fn build_router() -> Router {
|
||||
Router::new()
|
||||
.route("/api/v1/health", get(handlers::health))
|
||||
.route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
|
||||
.route("/api/v1/stats/overview", get(handlers::stats_overview))
|
||||
.route(
|
||||
"/api/v1/settings/ssh-public-key",
|
||||
|
||||
@@ -4,7 +4,7 @@ use axum::extract::{DefaultBodyLimit, Request};
|
||||
use axum::http::HeaderValue;
|
||||
use axum::middleware::Next;
|
||||
use axum::response::Response;
|
||||
use axum::routing::{delete, get, post};
|
||||
use axum::routing::{delete, get};
|
||||
use axum::{middleware, Extension, Router};
|
||||
use tokio::sync::RwLock;
|
||||
use tower_http::cors::CorsLayer;
|
||||
@@ -72,43 +72,8 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
|
||||
Router::new()
|
||||
};
|
||||
|
||||
// Werkbank runner API. Like admin, only mounted when its bearer token is
|
||||
// configured; runners authenticate with WERKBANK_RUNNER_TOKEN (not a JWT).
|
||||
let werkbank_router: Router = if agent.config.werkbank_runner_token.is_some() {
|
||||
tracing::info!(
|
||||
"Werkbank runner API enabled — /api/v1/werkbank/jobs/* behind WERKBANK_RUNNER_TOKEN"
|
||||
);
|
||||
Router::new()
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/lease",
|
||||
post(handlers::werkbank_jobs::lease),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/heartbeat",
|
||||
post(handlers::werkbank_jobs::heartbeat),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/complete",
|
||||
post(handlers::werkbank_jobs::complete),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/enqueue",
|
||||
post(handlers::werkbank_jobs::enqueue),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/artifacts/{hash}",
|
||||
get(handlers::werkbank_jobs::serve_artifact),
|
||||
)
|
||||
.layer(middleware::from_fn(
|
||||
handlers::werkbank_jobs::require_runner_token,
|
||||
))
|
||||
} else {
|
||||
Router::new()
|
||||
};
|
||||
|
||||
let mut app = routes::build_router()
|
||||
.merge(admin_router)
|
||||
.merge(werkbank_router)
|
||||
// Allow large artifact uploads (PLC .projectarchive, firmware images,
|
||||
// mobile packages) — axum's default request-body limit is only 2 MiB.
|
||||
.layer(DefaultBodyLimit::max(512 * 1024 * 1024))
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
|
||||
use compliance_core::config::PlcRuntimeConfig;
|
||||
use compliance_core::AgentConfig;
|
||||
use secrecy::SecretString;
|
||||
|
||||
@@ -65,8 +65,6 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
|
||||
admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
|
||||
tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
|
||||
plc_runtime: load_plc_runtime_config(),
|
||||
werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
|
||||
breakpilot: load_breakpilot_config(),
|
||||
})
|
||||
}
|
||||
|
||||
@@ -91,20 +89,3 @@ fn load_plc_runtime_config() -> PlcRuntimeConfig {
|
||||
.unwrap_or(d.openplc_password),
|
||||
}
|
||||
}
|
||||
|
||||
/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
|
||||
/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
|
||||
fn load_breakpilot_config() -> BreakpilotConfig {
|
||||
let d = BreakpilotConfig::default();
|
||||
BreakpilotConfig {
|
||||
base_url: env_var_opt("BREAKPILOT_BASE_URL"),
|
||||
token: env_secret_opt("BREAKPILOT_TOKEN"),
|
||||
snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
|
||||
semantic_mapping: env_var_opt("BREAKPILOT_SEMANTIC_MAPPING")
|
||||
.map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
|
||||
.unwrap_or(d.semantic_mapping),
|
||||
grounded_control_checks: env_var_opt("BREAKPILOT_GROUNDED_CHECKS")
|
||||
.map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
|
||||
.unwrap_or(d.grounded_control_checks),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,114 +0,0 @@
|
||||
//! The grounded control checker: judge each candidate region for a control, then
|
||||
//! keep only the verdicts that survive the grounding gate.
|
||||
//!
|
||||
//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
|
||||
//! the whole recognize → ground path is then exercised without an LLM. With the
|
||||
//! real judge, determinism comes from temperature 0 plus the gate.
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
|
||||
pub struct GroundedControlChecker<J> {
|
||||
judge: J,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> GroundedControlChecker<J> {
|
||||
pub fn new(judge: J) -> Self {
|
||||
Self { judge }
|
||||
}
|
||||
|
||||
/// Judge every candidate region for `spec` and return the grounded findings.
|
||||
/// A verdict that doesn't quote real code in its region is dropped by
|
||||
/// [`ground`], so nothing fabricated reaches the caller.
|
||||
pub async fn check(
|
||||
&self,
|
||||
spec: &ControlCheckSpec,
|
||||
regions: &[CandidateRegion],
|
||||
repo_id: &str,
|
||||
) -> Vec<Finding> {
|
||||
let mut findings = Vec::new();
|
||||
for region in regions {
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
if let Some(finding) = ground(spec, region, &verdict, repo_id) {
|
||||
findings.push(finding);
|
||||
}
|
||||
}
|
||||
findings
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::LlmVerdict;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
/// Deterministic stub: returns a fixed verdict for every region, so the
|
||||
/// recognize → ground composition is tested without an LLM.
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "No default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
fn region(content: &str) -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: content.into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn keeps_grounded_and_drops_ungrounded() {
|
||||
let checker = GroundedControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
});
|
||||
let regions = vec![
|
||||
region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
|
||||
region("totally unrelated code\n"), // snippet absent → dropped
|
||||
];
|
||||
let findings = checker.check(&spec(), ®ions, "repo").await;
|
||||
assert_eq!(findings.len(), 1);
|
||||
assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
|
||||
assert_eq!(findings[0].line_number, Some(2));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn non_violation_yields_nothing() {
|
||||
let checker = GroundedControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.0,
|
||||
},
|
||||
});
|
||||
let findings = checker
|
||||
.check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
|
||||
.await;
|
||||
assert!(findings.is_empty());
|
||||
}
|
||||
}
|
||||
@@ -1,245 +0,0 @@
|
||||
//! In-memory embedding index over the control corpus, for region → control
|
||||
//! retrieval.
|
||||
//!
|
||||
//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
|
||||
//! controls carry none), so we map by *similarity*: embed each control's
|
||||
//! requirement text once, then for a code region pull the top-K nearest controls
|
||||
//! to hand to the grounded judge. This is the retrieval half of the semantic path.
|
||||
|
||||
use std::path::Path;
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
use compliance_core::control_check::ControlCheckSpec;
|
||||
use compliance_core::error::CoreError;
|
||||
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// A control spec paired with its requirement-text embedding.
|
||||
pub struct ControlIndex {
|
||||
entries: Vec<(ControlCheckSpec, Vec<f64>)>,
|
||||
}
|
||||
|
||||
/// On-disk form of the index: the corpus identity hash plus every spec+embedding.
|
||||
/// The hash lets a later scan reuse the embeddings only if the corpus is unchanged.
|
||||
#[derive(Serialize, Deserialize)]
|
||||
struct PersistedIndex {
|
||||
corpus_hash: String,
|
||||
entries: Vec<PersistedEntry>,
|
||||
}
|
||||
|
||||
#[derive(Serialize, Deserialize)]
|
||||
struct PersistedEntry {
|
||||
spec: ControlCheckSpec,
|
||||
embedding: Vec<f64>,
|
||||
}
|
||||
|
||||
/// Stable hash of the corpus identity (each control's id + requirement text, in
|
||||
/// order). Same catalog → same hash → the cached embeddings are reused instead of
|
||||
/// re-embedding the whole corpus.
|
||||
fn corpus_hash(specs: &[ControlCheckSpec]) -> String {
|
||||
let mut hasher = Sha256::new();
|
||||
for s in specs {
|
||||
hasher.update(s.control_id.as_bytes());
|
||||
hasher.update([0u8]);
|
||||
hasher.update(s.requirement.as_bytes());
|
||||
hasher.update([0u8]);
|
||||
}
|
||||
format!("{:x}", hasher.finalize())
|
||||
}
|
||||
|
||||
impl ControlIndex {
|
||||
/// Build directly from precomputed embeddings (used by tests + callers that
|
||||
/// already embedded the corpus).
|
||||
pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
|
||||
Self { entries }
|
||||
}
|
||||
|
||||
/// Load the index from `cache_path` if it still matches the current corpus,
|
||||
/// otherwise embed the corpus and persist it there. This turns the per-scan
|
||||
/// re-embed of the whole (~13.6k) master-control corpus into a one-time cost
|
||||
/// that survives across scans; the cache self-invalidates when the catalog
|
||||
/// changes (its [`corpus_hash`] no longer matches).
|
||||
pub async fn load_or_build(
|
||||
llm: &LlmClient,
|
||||
specs: Vec<ControlCheckSpec>,
|
||||
cache_path: &Path,
|
||||
) -> Result<Self, CoreError> {
|
||||
let hash = corpus_hash(&specs);
|
||||
if let Some(index) = Self::load_cache(cache_path, &hash).await {
|
||||
tracing::debug!(
|
||||
controls = index.len(),
|
||||
"reusing cached control embedding index"
|
||||
);
|
||||
return Ok(index);
|
||||
}
|
||||
let index = Self::build(llm, specs).await?;
|
||||
if let Err(e) = index.write_cache(cache_path, &hash).await {
|
||||
tracing::warn!(error = %e, "failed to persist control embedding index");
|
||||
}
|
||||
Ok(index)
|
||||
}
|
||||
|
||||
/// Read a persisted index, returning it only if its corpus hash matches.
|
||||
async fn load_cache(path: &Path, hash: &str) -> Option<Self> {
|
||||
let raw = tokio::fs::read(path).await.ok()?;
|
||||
let persisted: PersistedIndex = serde_json::from_slice(&raw).ok()?;
|
||||
if persisted.corpus_hash != hash {
|
||||
return None;
|
||||
}
|
||||
Some(Self {
|
||||
entries: persisted
|
||||
.entries
|
||||
.into_iter()
|
||||
.map(|e| (e.spec, e.embedding))
|
||||
.collect(),
|
||||
})
|
||||
}
|
||||
|
||||
/// Persist the index atomically (temp file + rename) keyed by corpus hash.
|
||||
async fn write_cache(&self, path: &Path, hash: &str) -> Result<(), CoreError> {
|
||||
if let Some(parent) = path.parent() {
|
||||
tokio::fs::create_dir_all(parent).await?;
|
||||
}
|
||||
let persisted = PersistedIndex {
|
||||
corpus_hash: hash.to_string(),
|
||||
entries: self
|
||||
.entries
|
||||
.iter()
|
||||
.map(|(spec, emb)| PersistedEntry {
|
||||
spec: spec.clone(),
|
||||
embedding: emb.clone(),
|
||||
})
|
||||
.collect(),
|
||||
};
|
||||
let raw = serde_json::to_vec(&persisted)?;
|
||||
let tmp = path.with_extension("json.tmp");
|
||||
tokio::fs::write(&tmp, &raw).await?;
|
||||
tokio::fs::rename(&tmp, path).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Build by embedding each control's requirement text.
|
||||
pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
|
||||
if specs.is_empty() {
|
||||
return Ok(Self {
|
||||
entries: Vec::new(),
|
||||
});
|
||||
}
|
||||
let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
|
||||
let embeddings = llm
|
||||
.embed(texts)
|
||||
.await
|
||||
.map_err(|e| CoreError::Llm(e.to_string()))?;
|
||||
Ok(Self {
|
||||
entries: specs.into_iter().zip(embeddings).collect(),
|
||||
})
|
||||
}
|
||||
|
||||
pub fn len(&self) -> usize {
|
||||
self.entries.len()
|
||||
}
|
||||
|
||||
pub fn is_empty(&self) -> bool {
|
||||
self.entries.is_empty()
|
||||
}
|
||||
|
||||
/// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
|
||||
pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
|
||||
let mut scored: Vec<(f64, &ControlCheckSpec)> = self
|
||||
.entries
|
||||
.iter()
|
||||
.map(|(spec, emb)| (cosine(query, emb), spec))
|
||||
.collect();
|
||||
scored.sort_by(|a, b| b.0.total_cmp(&a.0));
|
||||
scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
|
||||
}
|
||||
}
|
||||
|
||||
/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
|
||||
fn cosine(a: &[f64], b: &[f64]) -> f64 {
|
||||
if a.len() != b.len() || a.is_empty() {
|
||||
return 0.0;
|
||||
}
|
||||
let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
|
||||
let na: f64 = a.iter().map(|x| x * x).sum();
|
||||
let nb: f64 = b.iter().map(|x| x * x).sum();
|
||||
if na == 0.0 || nb == 0.0 {
|
||||
return 0.0;
|
||||
}
|
||||
dot / (na.sqrt() * nb.sqrt())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
fn spec(id: &str) -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: id.into(),
|
||||
title: id.into(),
|
||||
requirement: id.into(),
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nearest_ranks_by_cosine() {
|
||||
let index = ControlIndex::from_embeddings(vec![
|
||||
(spec("a"), vec![1.0, 0.0]),
|
||||
(spec("b"), vec![0.0, 1.0]),
|
||||
(spec("c"), vec![0.7, 0.7]),
|
||||
]);
|
||||
let hits = index.nearest(&[0.9, 0.1], 2);
|
||||
assert_eq!(hits.len(), 2);
|
||||
assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn cosine_edges_are_zero() {
|
||||
assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
|
||||
assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
|
||||
assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn corpus_hash_is_stable_and_identity_sensitive() {
|
||||
let a = corpus_hash(&[spec("x"), spec("y")]);
|
||||
assert_eq!(a, corpus_hash(&[spec("x"), spec("y")])); // same corpus → same hash
|
||||
assert_ne!(a, corpus_hash(&[spec("y"), spec("x")])); // reorder → different
|
||||
assert_ne!(a, corpus_hash(&[spec("x")])); // fewer controls → different
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
async fn cache_round_trips_and_misses_on_corpus_change() {
|
||||
let dir = std::env::temp_dir().join(format!("cidx-{}", uuid::Uuid::new_v4()));
|
||||
let path = dir.join("control-index.json");
|
||||
let specs = [spec("a"), spec("b")];
|
||||
let hash = corpus_hash(&specs);
|
||||
let index = ControlIndex::from_embeddings(vec![
|
||||
(spec("a"), vec![1.0, 0.0]),
|
||||
(spec("b"), vec![0.0, 1.0]),
|
||||
]);
|
||||
index.write_cache(&path, &hash).await.unwrap();
|
||||
|
||||
// matching corpus hash → hit
|
||||
let loaded = ControlIndex::load_cache(&path, &hash).await.unwrap();
|
||||
assert_eq!(loaded.len(), 2);
|
||||
assert_eq!(loaded.nearest(&[0.9, 0.1], 1)[0].control_id, "a");
|
||||
// corpus changed → miss (forces a rebuild)
|
||||
assert!(ControlIndex::load_cache(&path, "differenthash")
|
||||
.await
|
||||
.is_none());
|
||||
// absent file → miss, not an error
|
||||
assert!(
|
||||
ControlIndex::load_cache(dir.join("nope.json").as_path(), &hash)
|
||||
.await
|
||||
.is_none()
|
||||
);
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
}
|
||||
@@ -1,167 +0,0 @@
|
||||
//! The "recognize" stage: judge whether a code region violates a control.
|
||||
//!
|
||||
//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
|
||||
//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
|
||||
//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
|
||||
//! and everything it returns is then re-checked by the grounding gate
|
||||
//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
|
||||
//! smart; it is never trusted.
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
|
||||
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// Prompt/logic version — part of the verdict cache key, bump on any change here.
|
||||
pub const PROMPT_VERSION: &str = "control-judge-v1";
|
||||
|
||||
const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
|
||||
You are given ONE compliance control (a requirement) and ONE code region. Decide \
|
||||
ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
|
||||
shown — never assume code that is not present. (2) If and only if it violates, copy \
|
||||
the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
|
||||
region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
|
||||
violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
|
||||
Respond with STRICT JSON only, no prose: \
|
||||
{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
|
||||
|
||||
/// Judges one (control, region). Async-in-trait so a stub can drive tests.
|
||||
#[allow(async_fn_in_trait)]
|
||||
pub trait ControlJudge: Send + Sync {
|
||||
async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
|
||||
}
|
||||
|
||||
/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
|
||||
pub struct LlmControlJudge {
|
||||
llm: Arc<LlmClient>,
|
||||
}
|
||||
|
||||
impl LlmControlJudge {
|
||||
pub fn new(llm: Arc<LlmClient>) -> Self {
|
||||
Self { llm }
|
||||
}
|
||||
}
|
||||
|
||||
impl ControlJudge for LlmControlJudge {
|
||||
async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
|
||||
let user = build_user_prompt(spec, region);
|
||||
match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
|
||||
Ok(response) => parse_verdict(&response),
|
||||
Err(e) => {
|
||||
// Fail closed: a transient model error yields no finding, never a
|
||||
// fabricated one.
|
||||
tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
|
||||
no_violation()
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
|
||||
format!(
|
||||
"CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
|
||||
id = spec.control_id,
|
||||
title = spec.title,
|
||||
req = spec.requirement,
|
||||
file = region.file,
|
||||
line = region.start_line,
|
||||
code = region.content,
|
||||
)
|
||||
}
|
||||
|
||||
#[derive(Debug, Default, Deserialize)]
|
||||
struct RawVerdict {
|
||||
#[serde(default)]
|
||||
violates: bool,
|
||||
#[serde(default)]
|
||||
snippet: String,
|
||||
#[serde(default)]
|
||||
cwe: Option<String>,
|
||||
#[serde(default)]
|
||||
confidence: f64,
|
||||
}
|
||||
|
||||
/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
|
||||
/// degrades to a non-violation (never a fabricated finding).
|
||||
fn parse_verdict(response: &str) -> LlmVerdict {
|
||||
let cleaned = response
|
||||
.trim()
|
||||
.trim_start_matches("```json")
|
||||
.trim_start_matches("```")
|
||||
.trim_end_matches("```")
|
||||
.trim();
|
||||
match serde_json::from_str::<RawVerdict>(cleaned) {
|
||||
Ok(raw) => LlmVerdict {
|
||||
violates: raw.violates,
|
||||
snippet: raw.snippet,
|
||||
cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
|
||||
confidence: raw.confidence,
|
||||
},
|
||||
Err(e) => {
|
||||
tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
|
||||
no_violation()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn no_violation() -> LlmVerdict {
|
||||
LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.0,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "Products must not ship default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_plain_and_fenced_json() {
|
||||
let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
|
||||
let v = parse_verdict(plain);
|
||||
assert!(v.violates);
|
||||
assert_eq!(v.snippet, "PASSWORD = \"x\"");
|
||||
assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
|
||||
|
||||
let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
|
||||
assert!(!parse_verdict(fenced).violates);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn garbage_and_empty_cwe_are_safe() {
|
||||
assert!(!parse_verdict("not json at all").violates); // fail closed
|
||||
let no_cwe =
|
||||
parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": " ", "confidence": 0.5}"#);
|
||||
assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn user_prompt_carries_control_and_code() {
|
||||
let region = CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 10,
|
||||
content: "PASSWORD = \"admin\"".into(),
|
||||
};
|
||||
let p = build_user_prompt(&spec(), ®ion);
|
||||
assert!(p.contains("cra-ai-8"));
|
||||
assert!(p.contains("Products must not ship default credentials"));
|
||||
assert!(p.contains("PASSWORD = \"admin\""));
|
||||
assert!(p.contains("src/auth.py"));
|
||||
}
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
//! Controls corpus providers.
|
||||
//!
|
||||
//! Implementations of [`compliance_core::traits::ControlsProvider`] that supply
|
||||
//! the control corpus the mapping engine assesses findings against. Currently:
|
||||
//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
|
||||
//! and snapshots it locally.
|
||||
|
||||
mod checker;
|
||||
mod index;
|
||||
mod judge;
|
||||
mod oscal_provider;
|
||||
mod scan_triage;
|
||||
mod semantic;
|
||||
mod surface;
|
||||
mod triage;
|
||||
|
||||
pub use checker::GroundedControlChecker;
|
||||
pub use index::ControlIndex;
|
||||
pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
|
||||
pub use oscal_provider::OscalControlsProvider;
|
||||
pub use scan_triage::{grounded_surface_findings, semantic_stamp_findings, triage_repo_findings};
|
||||
pub use semantic::SemanticControlChecker;
|
||||
pub use triage::{ControlTriage, TriageOutcome};
|
||||
@@ -1,229 +0,0 @@
|
||||
//! Pull + snapshot [`ControlsProvider`] backed by breakpilot-compliance's OSCAL
|
||||
//! catalog export.
|
||||
//!
|
||||
//! Fetches `GET {base}/api/compliance/v1/oscal/catalog?framework=<fw>`, snapshots
|
||||
//! the exact bytes to disk (so scans are deterministic and keep working offline /
|
||||
//! on-prem), and maps the catalog into the corpus controls the mapping engine
|
||||
//! consumes. The producer owns the catalog; we own the assessment — this is the
|
||||
//! ingest half of the loop.
|
||||
|
||||
use std::path::PathBuf;
|
||||
|
||||
use secrecy::{ExposeSecret, SecretString};
|
||||
|
||||
use compliance_core::error::CoreError;
|
||||
use compliance_core::models::onboarding::ComplianceFramework;
|
||||
use compliance_core::models::oscal::OscalDocument;
|
||||
use compliance_core::traits::{Control, ControlQuery, ControlsProvider};
|
||||
|
||||
/// A [`ControlsProvider`] that pulls the OSCAL catalog from breakpilot-compliance
|
||||
/// and snapshots it locally for deterministic / offline reuse.
|
||||
pub struct OscalControlsProvider {
|
||||
http: reqwest::Client,
|
||||
base_url: String,
|
||||
token: Option<SecretString>,
|
||||
snapshot_dir: PathBuf,
|
||||
}
|
||||
|
||||
impl OscalControlsProvider {
|
||||
/// Create a provider. `base_url` is the breakpilot-compliance root (e.g.
|
||||
/// `http://backend-compliance:8002`); `snapshot_dir` is where catalog
|
||||
/// snapshots are written so a later scan can reuse them without the network.
|
||||
pub fn new(
|
||||
http: reqwest::Client,
|
||||
base_url: impl Into<String>,
|
||||
token: Option<SecretString>,
|
||||
snapshot_dir: impl Into<PathBuf>,
|
||||
) -> Self {
|
||||
Self {
|
||||
http,
|
||||
base_url: base_url.into(),
|
||||
token,
|
||||
snapshot_dir: snapshot_dir.into(),
|
||||
}
|
||||
}
|
||||
|
||||
fn catalog_url(&self, framework: &str) -> String {
|
||||
format!(
|
||||
"{}/api/compliance/v1/oscal/catalog?framework={framework}",
|
||||
self.base_url.trim_end_matches('/')
|
||||
)
|
||||
}
|
||||
|
||||
fn snapshot_path(&self, framework: &str) -> PathBuf {
|
||||
self.snapshot_dir
|
||||
.join(format!("oscal-catalog-{framework}.json"))
|
||||
}
|
||||
|
||||
/// Fetch the raw catalog bytes for a framework token over HTTP.
|
||||
async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
|
||||
let mut req = self.http.get(self.catalog_url(framework));
|
||||
if let Some(token) = &self.token {
|
||||
req = req.bearer_auth(token.expose_secret());
|
||||
}
|
||||
let resp = req
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| CoreError::Http(e.to_string()))?;
|
||||
if !resp.status().is_success() {
|
||||
return Err(CoreError::Http(format!(
|
||||
"catalog fetch for {framework} returned HTTP {}",
|
||||
resp.status()
|
||||
)));
|
||||
}
|
||||
resp.bytes()
|
||||
.await
|
||||
.map(|b| b.to_vec())
|
||||
.map_err(|e| CoreError::Http(e.to_string()))
|
||||
}
|
||||
|
||||
/// Write a catalog snapshot atomically (temp file + rename).
|
||||
async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
|
||||
tokio::fs::create_dir_all(&self.snapshot_dir).await?;
|
||||
let path = self.snapshot_path(framework);
|
||||
let tmp = path.with_extension("json.tmp");
|
||||
tokio::fs::write(&tmp, raw).await?;
|
||||
tokio::fs::rename(&tmp, &path).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Read a previously written snapshot, if one exists.
|
||||
async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
|
||||
match tokio::fs::read(self.snapshot_path(framework)).await {
|
||||
Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
|
||||
Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
|
||||
Err(e) => Err(e.into()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Load the catalog for a framework token: fetch fresh + snapshot the exact
|
||||
/// bytes; on network failure, fall back to the last snapshot so scans run.
|
||||
async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
|
||||
match self.fetch_raw(framework).await {
|
||||
Ok(raw) => {
|
||||
let doc: OscalDocument = serde_json::from_slice(&raw)?;
|
||||
if let Err(e) = self.write_snapshot(framework, &raw).await {
|
||||
tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
|
||||
}
|
||||
Ok(doc)
|
||||
}
|
||||
Err(fetch_err) => match self.read_snapshot(framework).await? {
|
||||
Some(doc) => {
|
||||
tracing::warn!(
|
||||
framework, error = %fetch_err,
|
||||
"OSCAL catalog fetch failed; falling back to snapshot"
|
||||
);
|
||||
Ok(doc)
|
||||
}
|
||||
None => Err(fetch_err),
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
/// Load the OSCAL catalog for a compliance framework.
|
||||
pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
|
||||
self.load_token(&framework.to_string()).await
|
||||
}
|
||||
|
||||
/// Load the code-checkable master-controls catalog
|
||||
/// (`?framework=master-controls`).
|
||||
pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
|
||||
self.load_token("master-controls").await
|
||||
}
|
||||
}
|
||||
|
||||
/// Order controls whose title/text mention the query context first (stable), then
|
||||
/// truncate to the requested limit. Naive relevance — refined when the assessment
|
||||
/// layer lands.
|
||||
fn rank_and_truncate(mut controls: Vec<Control>, context: &str, limit: usize) -> Vec<Control> {
|
||||
if !context.is_empty() {
|
||||
let needle = context.to_lowercase();
|
||||
controls.sort_by_key(|c| {
|
||||
let hit =
|
||||
c.title.to_lowercase().contains(&needle) || c.text.to_lowercase().contains(&needle);
|
||||
u8::from(!hit)
|
||||
});
|
||||
}
|
||||
controls.truncate(limit);
|
||||
controls
|
||||
}
|
||||
|
||||
impl ControlsProvider for OscalControlsProvider {
|
||||
fn name(&self) -> &str {
|
||||
"breakpilot-oscal"
|
||||
}
|
||||
|
||||
async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError> {
|
||||
let mut out: Vec<Control> = Vec::new();
|
||||
for &framework in query.frameworks {
|
||||
match self.load(framework).await {
|
||||
Ok(doc) => out.extend(doc.to_controls()),
|
||||
Err(e) => {
|
||||
tracing::warn!(%framework, error = %e, "skipping framework: catalog unavailable")
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(rank_and_truncate(out, query.context, query.limit))
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
const MINI_CATALOG: &str = r#"{"catalog":{"uuid":"u","metadata":{"title":"T",
|
||||
"version":"1.0.0","oscal-version":"1.1.2","props":[{"name":"framework","value":"cra"}]},
|
||||
"groups":[{"id":"g","title":"G","controls":[{"id":"cra-ai-1","title":"MFA",
|
||||
"props":[],"parts":[{"name":"statement","prose":"require mfa"}]}]}]}}"#;
|
||||
|
||||
fn provider(dir: &std::path::Path) -> OscalControlsProvider {
|
||||
OscalControlsProvider::new(reqwest::Client::new(), "http://unused/", None, dir)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn builds_catalog_url_and_snapshot_path() {
|
||||
let p = provider(std::path::Path::new("/snap"));
|
||||
assert_eq!(
|
||||
p.catalog_url("cra"),
|
||||
"http://unused/api/compliance/v1/oscal/catalog?framework=cra"
|
||||
);
|
||||
assert_eq!(
|
||||
p.snapshot_path("cra"),
|
||||
std::path::Path::new("/snap/oscal-catalog-cra.json")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ranks_context_hits_first_then_truncates() {
|
||||
let mk = |id: &str, title: &str| Control {
|
||||
id: id.into(),
|
||||
framework: ComplianceFramework::Cra,
|
||||
title: title.into(),
|
||||
text: String::new(),
|
||||
source: None,
|
||||
};
|
||||
let controls = vec![
|
||||
mk("a", "logging policy"),
|
||||
mk("b", "multi-factor auth"),
|
||||
mk("c", "backup"),
|
||||
];
|
||||
let ranked = rank_and_truncate(controls, "auth", 2);
|
||||
assert_eq!(ranked.len(), 2);
|
||||
assert_eq!(ranked[0].id, "b"); // the "auth" hit floats to the top
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn snapshot_round_trip_and_offline_fallback() {
|
||||
let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
|
||||
let p = provider(&dir);
|
||||
assert!(p.read_snapshot("cra").await.unwrap().is_none());
|
||||
p.write_snapshot("cra", MINI_CATALOG.as_bytes())
|
||||
.await
|
||||
.unwrap();
|
||||
let doc = p.read_snapshot("cra").await.unwrap().unwrap();
|
||||
assert_eq!(doc.to_controls().len(), 1);
|
||||
assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
}
|
||||
@@ -1,299 +0,0 @@
|
||||
//! Scan-pipeline integration for control triage.
|
||||
//!
|
||||
//! After the deterministic tools have produced findings, this stamps each finding
|
||||
//! with the compliance control(s) it's evidence for and marks control-level false
|
||||
//! positives — using the ingested OSCAL catalog for control text, the
|
||||
//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
|
||||
//! confirm. Skipped entirely unless breakpilot is configured.
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::path::Path;
|
||||
use std::sync::Arc;
|
||||
|
||||
use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::finding::{Finding, FindingStatus, Severity};
|
||||
use compliance_core::models::onboarding::ComplianceFramework;
|
||||
use compliance_core::AgentConfig;
|
||||
use control_map::ControlMap;
|
||||
|
||||
use super::surface;
|
||||
use super::{
|
||||
ControlIndex, ControlTriage, GroundedControlChecker, LlmControlJudge, OscalControlsProvider,
|
||||
SemanticControlChecker, TriageOutcome,
|
||||
};
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// Nearest master controls judged per code region in the semantic pass.
|
||||
const SEMANTIC_TOP_K: usize = 5;
|
||||
|
||||
/// Lines of context to read on each side of a finding's line.
|
||||
const REGION_WINDOW: usize = 6;
|
||||
|
||||
/// Triage every finding in `findings` against the CRA control map: stamp
|
||||
/// `control_refs` on confirmed findings and flag control false positives. Returns
|
||||
/// the number of findings tagged with at least one control.
|
||||
pub async fn triage_repo_findings(
|
||||
config: &AgentConfig,
|
||||
llm: Arc<LlmClient>,
|
||||
repo_path: &Path,
|
||||
findings: &mut [Finding],
|
||||
) -> usize {
|
||||
let Some(base_url) = config.breakpilot.base_url.clone() else {
|
||||
return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
|
||||
};
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
base_url,
|
||||
config.breakpilot.token.clone(),
|
||||
&config.breakpilot.snapshot_dir,
|
||||
);
|
||||
let specs = build_specs(&provider).await;
|
||||
if specs.is_empty() {
|
||||
return 0;
|
||||
}
|
||||
let map = match ControlMap::cra() {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "control map failed to load; skipping control triage");
|
||||
return 0;
|
||||
}
|
||||
};
|
||||
let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
|
||||
|
||||
let mut tagged = 0;
|
||||
for finding in findings.iter_mut() {
|
||||
let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
|
||||
continue;
|
||||
};
|
||||
let Some(region) = fetch_region(repo_path, &file, line) else {
|
||||
continue;
|
||||
};
|
||||
match triage.triage(finding, ®ion).await {
|
||||
TriageOutcome::Confirmed(controls) => {
|
||||
finding.control_refs = controls;
|
||||
tagged += 1;
|
||||
}
|
||||
TriageOutcome::FalsePositive => {
|
||||
finding.status = FindingStatus::FalsePositive;
|
||||
finding.triage_action = Some("control_false_positive".to_string());
|
||||
}
|
||||
TriageOutcome::Unmapped => {}
|
||||
}
|
||||
}
|
||||
tagged
|
||||
}
|
||||
|
||||
/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
|
||||
async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
|
||||
let mut specs = HashMap::new();
|
||||
match provider.load(ComplianceFramework::Cra).await {
|
||||
Ok(doc) => {
|
||||
for control in doc.to_controls() {
|
||||
specs.insert(
|
||||
control.id.clone(),
|
||||
ControlCheckSpec {
|
||||
control_id: control.id,
|
||||
title: control.title,
|
||||
requirement: control.text,
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
},
|
||||
);
|
||||
}
|
||||
}
|
||||
Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
|
||||
}
|
||||
specs
|
||||
}
|
||||
|
||||
/// Absence-based control pass (the grounded half of the hybrid coverage): for each
|
||||
/// control with a [`surface`] definition, deterministically retrieve the code
|
||||
/// surfaces it governs (login routes, logging setup, update/download code) and have
|
||||
/// the grounded judge decide whether the control holds there. Returns net-new
|
||||
/// findings, each already tagged with its control and grounded to a real snippet.
|
||||
///
|
||||
/// The orchestrator runs this when `breakpilot.grounded_control_checks` is set
|
||||
/// (on by default). Validated live; it covers the 8 absence-based CRA controls
|
||||
/// (the judge decides presence/absence, grounded to a real snippet).
|
||||
pub async fn grounded_surface_findings(
|
||||
config: &AgentConfig,
|
||||
llm: Arc<LlmClient>,
|
||||
repo_path: &Path,
|
||||
repo_id: &str,
|
||||
) -> Vec<Finding> {
|
||||
let Some(base_url) = config.breakpilot.base_url.clone() else {
|
||||
return Vec::new();
|
||||
};
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
base_url,
|
||||
config.breakpilot.token.clone(),
|
||||
&config.breakpilot.snapshot_dir,
|
||||
);
|
||||
let specs = build_specs(&provider).await;
|
||||
if specs.is_empty() {
|
||||
return Vec::new();
|
||||
}
|
||||
let checker = GroundedControlChecker::new(LlmControlJudge::new(llm));
|
||||
|
||||
let mut out = Vec::new();
|
||||
for surf in surface::SURFACES {
|
||||
let Some(spec) = specs.get(surf.control_id) else {
|
||||
continue; // catalog doesn't carry this control
|
||||
};
|
||||
let regions = surface::retrieve(repo_path, surf.terms);
|
||||
if regions.is_empty() {
|
||||
continue;
|
||||
}
|
||||
out.extend(checker.check(spec, ®ions, repo_id).await);
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Read a window of lines around `line` (1-based) from `repo_path/file`.
|
||||
fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
|
||||
let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
|
||||
let lines: Vec<&str> = content.lines().collect();
|
||||
if lines.is_empty() {
|
||||
return None;
|
||||
}
|
||||
let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
|
||||
let start = center.saturating_sub(REGION_WINDOW);
|
||||
let end = (center + REGION_WINDOW + 1).min(lines.len());
|
||||
Some(CandidateRegion {
|
||||
file: file.to_string(),
|
||||
start_line: (start as u32) + 1,
|
||||
content: lines[start..end].join("\n"),
|
||||
})
|
||||
}
|
||||
|
||||
/// Master-controls **semantic** pass: for each finding's code region, retrieve the
|
||||
/// top-K nearest master controls by embedding, have the grounded judge confirm,
|
||||
/// and stamp the confirmed control ids onto the finding — the scale path for the
|
||||
/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
|
||||
/// of findings that gained a master-control ref.
|
||||
///
|
||||
/// The orchestrator runs this when `breakpilot.semantic_mapping` is set (on by
|
||||
/// default). The control embedding index is built once and cached to
|
||||
/// `snapshot_dir` keyed by corpus hash ([`ControlIndex::load_or_build`]), so only
|
||||
/// the first scan after a catalog change pays the embedding cost.
|
||||
pub async fn semantic_stamp_findings(
|
||||
config: &AgentConfig,
|
||||
llm: Arc<LlmClient>,
|
||||
repo_path: &Path,
|
||||
findings: &mut [Finding],
|
||||
) -> usize {
|
||||
let Some(base_url) = config.breakpilot.base_url.clone() else {
|
||||
return 0;
|
||||
};
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
base_url,
|
||||
config.breakpilot.token.clone(),
|
||||
&config.breakpilot.snapshot_dir,
|
||||
);
|
||||
let doc = match provider.load_master_controls().await {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
|
||||
return 0;
|
||||
}
|
||||
};
|
||||
let specs: Vec<ControlCheckSpec> = doc
|
||||
.to_controls()
|
||||
.into_iter()
|
||||
.map(|c| ControlCheckSpec {
|
||||
control_id: c.id,
|
||||
title: c.title,
|
||||
requirement: c.text,
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
})
|
||||
.collect();
|
||||
let cache_path =
|
||||
Path::new(&config.breakpilot.snapshot_dir).join("control-index-master-controls.json");
|
||||
let index = match ControlIndex::load_or_build(&llm, specs, &cache_path).await {
|
||||
Ok(i) if !i.is_empty() => i,
|
||||
Ok(_) => return 0,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "failed to embed master-controls corpus");
|
||||
return 0;
|
||||
}
|
||||
};
|
||||
let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
|
||||
|
||||
let mut tagged = 0;
|
||||
for finding in findings.iter_mut() {
|
||||
if finding.status == FindingStatus::FalsePositive {
|
||||
continue;
|
||||
}
|
||||
let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
|
||||
continue;
|
||||
};
|
||||
let Some(region) = fetch_region(repo_path, &file, line) else {
|
||||
continue;
|
||||
};
|
||||
// Retrieve on the finding's intent + the code, not the region alone: two
|
||||
// findings in one file share overlapping windows and otherwise embed alike,
|
||||
// collapsing onto the same controls. The finding's title/description carry
|
||||
// the discriminating signal (e.g. "brute-force protection" vs "weak hash").
|
||||
// The raw `region` still goes to the judge for snippet grounding.
|
||||
let query = format!(
|
||||
"{}\n{}\n\n{}",
|
||||
finding.title, finding.description, region.content
|
||||
);
|
||||
let query_emb = match llm.embed(vec![query]).await {
|
||||
Ok(mut embs) => match embs.pop() {
|
||||
Some(v) => v,
|
||||
None => continue,
|
||||
},
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "query embed failed; skipping finding");
|
||||
continue;
|
||||
}
|
||||
};
|
||||
let confirmed = checker
|
||||
.check(
|
||||
&index,
|
||||
®ion,
|
||||
&query_emb,
|
||||
SEMANTIC_TOP_K,
|
||||
&finding.repo_id,
|
||||
)
|
||||
.await;
|
||||
let before = finding.control_refs.len();
|
||||
for f in confirmed {
|
||||
for cref in f.control_refs {
|
||||
if !finding.control_refs.contains(&cref) {
|
||||
finding.control_refs.push(cref);
|
||||
}
|
||||
}
|
||||
}
|
||||
if finding.control_refs.len() > before {
|
||||
tagged += 1;
|
||||
}
|
||||
}
|
||||
tagged
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn fetch_region_windows_around_the_line() {
|
||||
let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
let file = "a.py";
|
||||
std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
|
||||
let r = fetch_region(&dir, file, 4).unwrap();
|
||||
assert!(r.content.contains("SECRET=1"));
|
||||
assert_eq!(r.start_line, 1); // window clamps to file start
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fetch_region_missing_file_is_none() {
|
||||
assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
|
||||
}
|
||||
}
|
||||
@@ -1,121 +0,0 @@
|
||||
//! Semantic control mapping: retrieve the top-K controls nearest a code region,
|
||||
//! then confirm each with the grounded judge.
|
||||
//!
|
||||
//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
|
||||
//! what scales to the full master-control corpus: the LLM only ever judges a
|
||||
//! handful of retrieved candidates, and every surviving verdict is still anchored
|
||||
//! to real code by the grounding gate.
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion};
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use super::index::ControlIndex;
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// Retrieve → judge → ground, generic over the judge so tests use a stub.
|
||||
pub struct SemanticControlChecker<J> {
|
||||
judge: J,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> SemanticControlChecker<J> {
|
||||
pub fn new(judge: J) -> Self {
|
||||
Self { judge }
|
||||
}
|
||||
|
||||
/// Map a code region to the controls it violates. `query_embedding` is the
|
||||
/// caller-supplied retrieval embedding — typically the finding's intent
|
||||
/// (title/description) plus the region, so retrieval keys on what the finding
|
||||
/// is *about*, not just the ambient code. The top-`k` nearest controls in
|
||||
/// `index` are then judged against the raw `region` and grounded.
|
||||
pub async fn check(
|
||||
&self,
|
||||
index: &ControlIndex,
|
||||
region: &CandidateRegion,
|
||||
query_embedding: &[f64],
|
||||
k: usize,
|
||||
repo_id: &str,
|
||||
) -> Vec<Finding> {
|
||||
let candidates = index.nearest(query_embedding, k);
|
||||
let mut findings = Vec::new();
|
||||
for spec in &candidates {
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
if let Some(finding) = ground(spec, region, &verdict, repo_id) {
|
||||
findings.push(finding);
|
||||
}
|
||||
}
|
||||
findings
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn spec(id: &str) -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: id.into(),
|
||||
title: id.into(),
|
||||
requirement: id.into(),
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn retrieves_then_grounds_the_nearest_control() {
|
||||
let index = ControlIndex::from_embeddings(vec![
|
||||
(spec("mc-near"), vec![1.0, 0.0]),
|
||||
(spec("mc-far"), vec![0.0, 1.0]),
|
||||
]);
|
||||
let checker = SemanticControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
});
|
||||
let region = CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: "PASSWORD = \"admin\"\n".into(),
|
||||
};
|
||||
// Query embedding nearest to mc-near; k=1 → only mc-near is judged.
|
||||
let findings = checker
|
||||
.check(&index, ®ion, &[0.95, 0.05], 1, "repo")
|
||||
.await;
|
||||
assert_eq!(findings.len(), 1);
|
||||
assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn ungrounded_verdict_is_dropped() {
|
||||
let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
|
||||
let checker = SemanticControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "not in the region".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
});
|
||||
let region = CandidateRegion {
|
||||
file: "f".into(),
|
||||
start_line: 1,
|
||||
content: "real code\n".into(),
|
||||
};
|
||||
let findings = checker.check(&index, ®ion, &[1.0, 0.0], 1, "repo").await;
|
||||
assert!(findings.is_empty());
|
||||
}
|
||||
}
|
||||
@@ -1,258 +0,0 @@
|
||||
//! Surface retrieval for absence-based controls.
|
||||
//!
|
||||
//! Some CRA controls are violated by an *absence* — no rate limiting on login, no
|
||||
//! security logging, no signature check on an update — so there's no offending
|
||||
//! pattern for semgrep to match. Instead we deterministically locate the code
|
||||
//! *surface* the control governs (a login route, a logging setup, update/download
|
||||
//! code) by identifier/route terms, then hand each surface region to the grounded
|
||||
//! judge, which decides whether the control is satisfied there. The resulting
|
||||
//! finding grounds to the surface snippet, so nothing fabricated survives.
|
||||
//!
|
||||
//! Retrieval is intentionally cheap and bounded: keyword match + a fixed window,
|
||||
//! capped per control to keep the downstream LLM cost predictable.
|
||||
|
||||
use std::path::Path;
|
||||
|
||||
use compliance_core::control_check::CandidateRegion;
|
||||
|
||||
/// An absence-based control and the case-insensitive terms that mark the code
|
||||
/// surface it governs.
|
||||
pub struct Surface {
|
||||
pub control_id: &'static str,
|
||||
pub terms: &'static [&'static str],
|
||||
}
|
||||
|
||||
/// The absence-based CRA controls we retrieve surfaces for — the grounded half of
|
||||
/// the hybrid coverage (the pattern-expressible half is custom semgrep rules).
|
||||
pub const SURFACES: &[Surface] = &[
|
||||
Surface {
|
||||
control_id: "cra-ai-6", // Integritaetspruefung
|
||||
terms: &[
|
||||
"checksum",
|
||||
"sha256",
|
||||
"signature",
|
||||
"hmac",
|
||||
"integrity",
|
||||
"verify",
|
||||
],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-11", // Brute-Force-Schutz
|
||||
terms: &[
|
||||
"login",
|
||||
"signin",
|
||||
"authenticate",
|
||||
"/auth",
|
||||
"password",
|
||||
"ratelimit",
|
||||
],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-12", // Rollenbasierte Autorisierung (RBAC)
|
||||
terms: &[
|
||||
"authorize",
|
||||
"permission",
|
||||
"role",
|
||||
"rbac",
|
||||
"require_role",
|
||||
"has_role",
|
||||
],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-24", // Security-Logging
|
||||
terms: &["login", "authorize", "permission", "role", "admin", "audit"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-27", // Log-Integritaet und -Aufbewahrung
|
||||
terms: &["logging", "logger", "getlogger", "audit_log"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-28", // Sichere Update-Mechanismen
|
||||
terms: &["update", "upgrade", "download", "firmware"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-29", // Update-Authentizitaet
|
||||
terms: &["update", "signature", "verify", "pubkey", "certificate"],
|
||||
},
|
||||
Surface {
|
||||
control_id: "cra-ai-30", // Update-Integritaet
|
||||
terms: &["update", "checksum", "digest", "integrity", "verify"],
|
||||
},
|
||||
];
|
||||
|
||||
/// Source file extensions worth reading (skip binaries/assets/lockfiles).
|
||||
const CODE_EXTS: &[&str] = &[
|
||||
"py", "js", "ts", "tsx", "jsx", "go", "java", "rb", "php", "rs", "cs", "kt",
|
||||
];
|
||||
/// Directories never worth walking.
|
||||
const SKIP_DIRS: &[&str] = &[
|
||||
".git",
|
||||
"node_modules",
|
||||
"target",
|
||||
"vendor",
|
||||
".venv",
|
||||
"__pycache__",
|
||||
"dist",
|
||||
"build",
|
||||
];
|
||||
/// Lines of context on each side of a hit.
|
||||
const WINDOW: usize = 6;
|
||||
/// Cap on regions per control, to bound downstream LLM calls.
|
||||
const MAX_REGIONS_PER_CONTROL: usize = 8;
|
||||
/// Skip files larger than this (generated/minified).
|
||||
const MAX_FILE_BYTES: u64 = 512 * 1024;
|
||||
|
||||
/// Deterministically retrieve up to [`MAX_REGIONS_PER_CONTROL`] code regions in
|
||||
/// `repo_path` whose lines mention any of `terms`. Hits close together within a
|
||||
/// file are merged into one region; results are capped to bound LLM cost.
|
||||
pub fn retrieve(repo_path: &Path, terms: &[&str]) -> Vec<CandidateRegion> {
|
||||
let lowered: Vec<String> = terms.iter().map(|t| t.to_lowercase()).collect();
|
||||
let mut regions = Vec::new();
|
||||
for entry in walk(repo_path) {
|
||||
if regions.len() >= MAX_REGIONS_PER_CONTROL {
|
||||
break;
|
||||
}
|
||||
let path = entry.path();
|
||||
if !has_code_ext(path) {
|
||||
continue;
|
||||
}
|
||||
let Ok(meta) = entry.metadata() else { continue };
|
||||
if !meta.is_file() || meta.len() > MAX_FILE_BYTES {
|
||||
continue;
|
||||
}
|
||||
let Ok(content) = std::fs::read_to_string(path) else {
|
||||
continue;
|
||||
};
|
||||
let rel = path
|
||||
.strip_prefix(repo_path)
|
||||
.unwrap_or(path)
|
||||
.to_string_lossy()
|
||||
.to_string();
|
||||
let lines: Vec<&str> = content.lines().collect();
|
||||
let hits: Vec<usize> = lines
|
||||
.iter()
|
||||
.enumerate()
|
||||
.filter(|(_, line)| {
|
||||
let ll = line.to_lowercase();
|
||||
lowered.iter().any(|t| ll.contains(t.as_str()))
|
||||
})
|
||||
.map(|(i, _)| i)
|
||||
.collect();
|
||||
for center in merge_centers(&hits) {
|
||||
if regions.len() >= MAX_REGIONS_PER_CONTROL {
|
||||
break;
|
||||
}
|
||||
let start = center.saturating_sub(WINDOW);
|
||||
let end = (center + WINDOW + 1).min(lines.len());
|
||||
regions.push(CandidateRegion {
|
||||
file: rel.clone(),
|
||||
start_line: (start as u32) + 1,
|
||||
content: lines[start..end].join("\n"),
|
||||
});
|
||||
}
|
||||
}
|
||||
regions
|
||||
}
|
||||
|
||||
/// Collapse ascending hit indices that fall within one window into a single
|
||||
/// representative center, so overlapping regions aren't judged repeatedly.
|
||||
fn merge_centers(hits: &[usize]) -> Vec<usize> {
|
||||
let mut out: Vec<usize> = Vec::new();
|
||||
for &h in hits {
|
||||
match out.last() {
|
||||
Some(&last) if h.saturating_sub(last) <= WINDOW => {}
|
||||
_ => out.push(h),
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
fn has_code_ext(path: &Path) -> bool {
|
||||
path.extension()
|
||||
.and_then(|e| e.to_str())
|
||||
.is_some_and(|e| CODE_EXTS.contains(&e))
|
||||
}
|
||||
|
||||
fn walk(root: &Path) -> Vec<walkdir::DirEntry> {
|
||||
walkdir::WalkDir::new(root)
|
||||
.into_iter()
|
||||
.filter_entry(|e| {
|
||||
let name = e.file_name().to_string_lossy();
|
||||
!SKIP_DIRS.contains(&name.as_ref())
|
||||
})
|
||||
.filter_map(|e| e.ok())
|
||||
.collect()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn write(dir: &Path, rel: &str, body: &str) {
|
||||
let p = dir.join(rel);
|
||||
if let Some(parent) = p.parent() {
|
||||
std::fs::create_dir_all(parent).unwrap();
|
||||
}
|
||||
std::fs::write(p, body).unwrap();
|
||||
}
|
||||
|
||||
fn terms_for(control_id: &str) -> &'static [&'static str] {
|
||||
SURFACES
|
||||
.iter()
|
||||
.find(|s| s.control_id == control_id)
|
||||
.unwrap()
|
||||
.terms
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn surfaces_cover_the_absence_based_controls() {
|
||||
assert_eq!(SURFACES.len(), 8);
|
||||
for id in [
|
||||
"cra-ai-6",
|
||||
"cra-ai-11",
|
||||
"cra-ai-12",
|
||||
"cra-ai-24",
|
||||
"cra-ai-27",
|
||||
"cra-ai-28",
|
||||
"cra-ai-29",
|
||||
"cra-ai-30",
|
||||
] {
|
||||
assert!(SURFACES.iter().any(|s| s.control_id == id), "{id} missing");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn retrieves_matching_region_with_context() {
|
||||
let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
write(
|
||||
&dir,
|
||||
"app/auth.py",
|
||||
"import x\n\n\n\n\n\n\ndef login(u, p):\n return check(u, p)\n",
|
||||
);
|
||||
let regions = retrieve(&dir, terms_for("cra-ai-11"));
|
||||
assert_eq!(regions.len(), 1);
|
||||
assert!(regions[0].content.contains("def login"));
|
||||
assert_eq!(regions[0].file, "app/auth.py");
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn skips_non_code_and_vendored() {
|
||||
let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
write(&dir, "README.md", "login and password and audit\n"); // not code ext
|
||||
write(&dir, "node_modules/pkg/index.js", "function login() {}\n"); // vendored
|
||||
assert!(retrieve(&dir, terms_for("cra-ai-11")).is_empty());
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn merges_adjacent_hits_into_one_region() {
|
||||
// Two hits one line apart collapse to a single center/region.
|
||||
assert_eq!(merge_centers(&[10, 11, 30]), vec![10, 30]);
|
||||
assert_eq!(merge_centers(&[]), Vec::<usize>::new());
|
||||
assert_eq!(merge_centers(&[5]), vec![5]);
|
||||
}
|
||||
}
|
||||
@@ -1,234 +0,0 @@
|
||||
//! Triage step: confirm/refute a deterministic tool finding against the controls
|
||||
//! it maps to (via the `control-map` LUT), grounding the judgment.
|
||||
//!
|
||||
//! This is where the LLM finally enters — as a **false-positive filter over tool
|
||||
//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
|
||||
//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
|
||||
//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
|
||||
//! judge then confirms or refutes each, and only judgments anchored to real code
|
||||
//! survive.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::Finding;
|
||||
use control_map::ControlMap;
|
||||
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// What triage decided for one tool finding.
|
||||
#[derive(Debug, Clone, PartialEq, Eq)]
|
||||
pub enum TriageOutcome {
|
||||
/// The finding maps to no control in the LUT — keep it, untagged.
|
||||
Unmapped,
|
||||
/// Maps to controls and the grounded judge confirmed at least one — keep the
|
||||
/// finding and tag it with these control ids.
|
||||
Confirmed(Vec<String>),
|
||||
/// Maps to controls but the judge grounded none — treat as a false positive.
|
||||
FalsePositive,
|
||||
}
|
||||
|
||||
/// Triages tool findings against the control map, confirming with a grounded judge.
|
||||
pub struct ControlTriage<J> {
|
||||
judge: J,
|
||||
map: ControlMap,
|
||||
/// Control requirement specs (by control id), built from the ingested catalog.
|
||||
specs: HashMap<String, ControlCheckSpec>,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> ControlTriage<J> {
|
||||
pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
|
||||
Self { judge, map, specs }
|
||||
}
|
||||
|
||||
/// Triage one tool finding. `region` is the code around the finding, used as
|
||||
/// the grounding evidence for the judge.
|
||||
pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
|
||||
// Match by CWE (off-the-shelf findings) and/or rule id (our custom
|
||||
// detectors, which carry no LUT-bound CWE). A finding with neither is
|
||||
// simply unmapped.
|
||||
let mapped = self.map.controls_for_finding(
|
||||
&finding.scanner,
|
||||
finding.cwe.as_deref(),
|
||||
finding.rule_id.as_deref(),
|
||||
);
|
||||
if mapped.is_empty() {
|
||||
return TriageOutcome::Unmapped;
|
||||
}
|
||||
|
||||
let mut confirmed = Vec::new();
|
||||
for entry in mapped {
|
||||
let Some(spec) = self.specs.get(&entry.control) else {
|
||||
continue;
|
||||
};
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
// The verdict only counts if it grounds to real code in the region.
|
||||
if ground(spec, region, &verdict, &finding.repo_id).is_some() {
|
||||
confirmed.push(entry.control.clone());
|
||||
}
|
||||
}
|
||||
|
||||
if confirmed.is_empty() {
|
||||
TriageOutcome::FalsePositive
|
||||
} else {
|
||||
TriageOutcome::Confirmed(confirmed)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::LlmVerdict;
|
||||
use compliance_core::models::finding::Severity;
|
||||
use compliance_core::models::scan::ScanType;
|
||||
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn specs() -> HashMap<String, ControlCheckSpec> {
|
||||
let mut m = HashMap::new();
|
||||
m.insert(
|
||||
"cra-ai-8".to_string(),
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "No default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
},
|
||||
);
|
||||
m
|
||||
}
|
||||
|
||||
fn semgrep_finding(cwe: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
"fp1".into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"hardcoded credential".into(),
|
||||
"desc".into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.cwe = Some(cwe.into());
|
||||
f
|
||||
}
|
||||
|
||||
fn region() -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: "PASSWORD = \"admin123\"\n".into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn confirmed_finding_is_tagged_with_control() {
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage.triage(&semgrep_finding("CWE-798"), ®ion()).await;
|
||||
assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn refuted_mapped_finding_is_false_positive() {
|
||||
// Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.1,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage.triage(&semgrep_finding("CWE-798"), ®ion()).await;
|
||||
assert_eq!(out, TriageOutcome::FalsePositive);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn custom_rule_finding_without_cwe_is_confirmed() {
|
||||
// A custom detector finding carries a rule id but no LUT-bound CWE; it must
|
||||
// still map (by rule id) and confirm.
|
||||
let mut specs = specs();
|
||||
specs.insert(
|
||||
"cra-ai-1".to_string(),
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-1".into(),
|
||||
title: "Secure-by-Default".into(),
|
||||
requirement: "Ship secure defaults".into(),
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
},
|
||||
);
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "app.run(debug=True)".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs,
|
||||
);
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
"fp".into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"flask debug".into(),
|
||||
"desc".into(),
|
||||
Severity::Medium,
|
||||
);
|
||||
f.rule_id = Some("tmp.x.cra-ai-1-flask-debug-enabled".into()); // no cwe
|
||||
let region = CandidateRegion {
|
||||
file: "app.py".into(),
|
||||
start_line: 1,
|
||||
content: "app.run(debug=True)\n".into(),
|
||||
};
|
||||
let out = triage.triage(&f, ®ion).await;
|
||||
assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-1".to_string()]));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn unmapped_cwe_is_left_untagged() {
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage
|
||||
.triage(&semgrep_finding("CWE-99999"), ®ion())
|
||||
.await;
|
||||
assert_eq!(out, TriageOutcome::Unmapped);
|
||||
}
|
||||
}
|
||||
@@ -32,30 +32,6 @@ pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
|
||||
Ok((hex::encode(hasher.finalize()), total))
|
||||
}
|
||||
|
||||
/// Store raw bytes in the content-addressed blob store under `base`, returning
|
||||
/// the SHA-256 digest. Used to stash a small derived artifact (e.g. the extracted
|
||||
/// PLC program source) so a Werkbank runner can fetch it by hash. Idempotent.
|
||||
pub fn store_bytes(base: &Path, bytes: &[u8]) -> Result<String, AgentError> {
|
||||
let sha = hex::encode(Sha256::digest(bytes));
|
||||
let dir = base.join("blobs").join(&sha[0..2]);
|
||||
fs::create_dir_all(&dir)?;
|
||||
let dest = dir.join(&sha);
|
||||
if !dest.exists() {
|
||||
fs::write(&dest, bytes)?;
|
||||
}
|
||||
Ok(sha)
|
||||
}
|
||||
|
||||
/// Read a blob's bytes by its SHA-256 digest. Rejects a non-hex/wrong-length hash
|
||||
/// so a request can't traverse outside the blob store.
|
||||
pub fn read_blob(base: &Path, sha: &str) -> Result<Vec<u8>, AgentError> {
|
||||
if sha.len() != 64 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
|
||||
return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
|
||||
}
|
||||
let path = base.join("blobs").join(&sha[0..2]).join(sha);
|
||||
Ok(fs::read(path)?)
|
||||
}
|
||||
|
||||
/// Copy `src` into the content-addressed blob store under `base`, returning the
|
||||
/// stored path. Idempotent: an already-present blob is not rewritten.
|
||||
pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
//! is also the reconciliation key against sibling products (a firmware sha256
|
||||
//! matches tramiton's `Artifact.sha256`).
|
||||
|
||||
pub(crate) mod blob;
|
||||
mod blob;
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
@@ -4,7 +4,6 @@ pub mod agent;
|
||||
pub mod api;
|
||||
pub mod classify;
|
||||
pub mod config;
|
||||
pub mod controls;
|
||||
pub mod database;
|
||||
pub mod error;
|
||||
pub mod ingest;
|
||||
|
||||
@@ -22,11 +22,6 @@ struct EmbeddingData {
|
||||
index: usize,
|
||||
}
|
||||
|
||||
/// Max inputs per embedding request. The bge/OpenAI-like backends cap the input
|
||||
/// array (bge-multilingual-gemma2 rejects >25 with "batch size overflow"), so we
|
||||
/// chunk larger corpora — a whole control catalog (~1.8k) would otherwise 500.
|
||||
const EMBED_BATCH_SIZE: usize = 16;
|
||||
|
||||
// ── Embedding implementation ───────────────────────────────────
|
||||
|
||||
impl LlmClient {
|
||||
@@ -34,21 +29,8 @@ impl LlmClient {
|
||||
&self.embed_model
|
||||
}
|
||||
|
||||
/// Generate embeddings for a batch of texts, chunking into backend-sized
|
||||
/// requests and preserving input order across chunks.
|
||||
/// Generate embeddings for a batch of texts
|
||||
pub async fn embed(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
|
||||
if texts.is_empty() {
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
let mut out = Vec::with_capacity(texts.len());
|
||||
for chunk in texts.chunks(EMBED_BATCH_SIZE) {
|
||||
out.extend(self.embed_batch(chunk.to_vec()).await?);
|
||||
}
|
||||
Ok(out)
|
||||
}
|
||||
|
||||
/// Embed one backend-sized batch (≤ [`EMBED_BATCH_SIZE`]) in a single request.
|
||||
async fn embed_batch(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
|
||||
let url = format!("{}/v1/embeddings", self.base_url.trim_end_matches('/'));
|
||||
|
||||
let request_body = EmbeddingRequest {
|
||||
@@ -90,33 +72,3 @@ impl LlmClient {
|
||||
Ok(data.into_iter().map(|d| d.embedding).collect())
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use secrecy::SecretString;
|
||||
|
||||
fn client() -> LlmClient {
|
||||
LlmClient::new(
|
||||
"http://unused".into(),
|
||||
SecretString::from(String::new()),
|
||||
"m".into(),
|
||||
"e".into(),
|
||||
)
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn empty_input_makes_no_request() {
|
||||
// Must short-circuit before any HTTP call (base_url is unroutable).
|
||||
let out = client().embed(Vec::new()).await.unwrap();
|
||||
assert!(out.is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn batch_size_is_within_backend_cap() {
|
||||
assert!(
|
||||
EMBED_BATCH_SIZE <= 25,
|
||||
"must stay under the bge 25-input cap"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -343,8 +343,6 @@ mod tests {
|
||||
admin_api_token: None,
|
||||
tenant_registry_url: None,
|
||||
plc_runtime: compliance_core::PlcRuntimeConfig::default(),
|
||||
werkbank_runner_token: None,
|
||||
breakpilot: compliance_core::config::BreakpilotConfig::default(),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -215,72 +215,8 @@ impl PipelineOrchestrator {
|
||||
.await;
|
||||
tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
|
||||
|
||||
// Stage 5b: control triage — stamp findings with the compliance control(s)
|
||||
// they're evidence for and flag control false positives (grounded LLM over
|
||||
// deterministic tool output). No-op unless breakpilot is configured.
|
||||
self.update_phase(scan_run_id, "control_triage").await;
|
||||
let tagged = crate::controls::triage_repo_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&repo_path,
|
||||
&mut all_findings,
|
||||
)
|
||||
.await;
|
||||
if tagged > 0 {
|
||||
tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
|
||||
}
|
||||
|
||||
// Stage 5c: semantic control mapping — scale path for the master-controls
|
||||
// corpus (no CWE to LUT on): embed each finding's region, retrieve the
|
||||
// nearest master controls, grounded-judge, and stamp confirmed refs. On by
|
||||
// default (validated live); the corpus embedding is cached so only the
|
||||
// first scan after a catalog change pays it.
|
||||
if self.config.breakpilot.semantic_mapping {
|
||||
self.update_phase(scan_run_id, "semantic_control_mapping")
|
||||
.await;
|
||||
let sem = crate::controls::semantic_stamp_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&repo_path,
|
||||
&mut all_findings,
|
||||
)
|
||||
.await;
|
||||
if sem > 0 {
|
||||
tracing::info!(
|
||||
"[{repo_id}] Semantic mapping tagged {sem} findings with master-control refs"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Stage 5d: grounded surface checks — the absence-based controls (no
|
||||
// rate limiting, no security logging, no update-signature check) have no
|
||||
// syntactic pattern to match, so we retrieve the code surface each governs
|
||||
// and let the grounded judge decide whether it holds, producing net-new
|
||||
// findings already tagged + grounded. On by default (validated live); it
|
||||
// covers the 8 absence-based CRA controls.
|
||||
if self.config.breakpilot.grounded_control_checks {
|
||||
self.update_phase(scan_run_id, "grounded_control_checks")
|
||||
.await;
|
||||
let grounded = crate::controls::grounded_surface_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&repo_path,
|
||||
&repo_id,
|
||||
)
|
||||
.await;
|
||||
if !grounded.is_empty() {
|
||||
tracing::info!(
|
||||
"[{repo_id}] Grounded surface checks raised {} control findings",
|
||||
grounded.len()
|
||||
);
|
||||
all_findings.extend(grounded);
|
||||
}
|
||||
}
|
||||
|
||||
// Dedup against existing findings: insert first-seen ones, and refresh the
|
||||
// control mappings on ones we've seen before.
|
||||
// Dedup against existing findings and insert new ones
|
||||
let mut new_count = 0u32;
|
||||
let mut refreshed_count = 0u32;
|
||||
let mut new_findings: Vec<Finding> = Vec::new();
|
||||
for mut finding in all_findings {
|
||||
finding.scan_run_id = Some(scan_run_id.to_string());
|
||||
@@ -295,25 +231,8 @@ impl PipelineOrchestrator {
|
||||
finding.id = result.inserted_id.as_object_id();
|
||||
new_findings.push(finding);
|
||||
new_count += 1;
|
||||
} else if !finding.control_refs.is_empty() {
|
||||
// Re-scan refresh: a mapping pass (newly enabled or tuned) computed
|
||||
// control_refs for a finding first seen before mapping ran. Persist
|
||||
// them onto the existing row — the insert path alone never would.
|
||||
self.db
|
||||
.findings()
|
||||
.update_one(
|
||||
doc! { "fingerprint": &finding.fingerprint },
|
||||
doc! { "$set": { "control_refs": finding.control_refs.clone() } },
|
||||
)
|
||||
.await?;
|
||||
refreshed_count += 1;
|
||||
}
|
||||
}
|
||||
if refreshed_count > 0 {
|
||||
tracing::info!(
|
||||
"[{repo_id}] Refreshed control_refs on {refreshed_count} existing findings"
|
||||
);
|
||||
}
|
||||
|
||||
// Remove stale SBOM entries for this repo before reinserting
|
||||
if !sbom_entries.is_empty() {
|
||||
@@ -586,21 +505,7 @@ impl PipelineOrchestrator {
|
||||
let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
|
||||
continue;
|
||||
};
|
||||
let mut source_findings = crate::pipeline::plc::analyze_tree(&path, target_id);
|
||||
// Control mapping for the PLC path (run_plc_scan is separate from
|
||||
// run_pipeline, which does its own mapping). PLC findings carry
|
||||
// file_path/line/cwe, so the semantic pass reads each region under this
|
||||
// source's `path` and stamps master-control refs. The LUT + grounded
|
||||
// surface passes are code-pattern / CRA-specific and don't apply to
|
||||
// IEC 61131-3 control logic, so only the semantic pass runs here.
|
||||
crate::controls::semantic_stamp_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&path,
|
||||
&mut source_findings,
|
||||
)
|
||||
.await;
|
||||
all_findings.extend(source_findings);
|
||||
all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
|
||||
// Control-application SBOM: CODESYS libraries + runtime from a
|
||||
// `.projectarchive` (uploaded, or committed in the working tree).
|
||||
let archive = a
|
||||
@@ -625,7 +530,6 @@ impl PipelineOrchestrator {
|
||||
);
|
||||
|
||||
let mut new_count = 0u32;
|
||||
let mut refreshed_count = 0u32;
|
||||
for mut finding in all_findings {
|
||||
finding.scan_run_id = Some(scan_run_id.to_string());
|
||||
if self
|
||||
@@ -637,27 +541,8 @@ impl PipelineOrchestrator {
|
||||
{
|
||||
self.db.findings().insert_one(&finding).await?;
|
||||
new_count += 1;
|
||||
} else if !finding.control_refs.is_empty() {
|
||||
// Re-scan refresh: mirror run_pipeline — persist newly-computed
|
||||
// control_refs onto a PLC finding first seen before the semantic
|
||||
// pass ran. The insert path alone never would, so without this a
|
||||
// PLC re-scan can only pick up mappings via a delete + re-add.
|
||||
self.db
|
||||
.findings()
|
||||
.update_one(
|
||||
doc! { "fingerprint": &finding.fingerprint },
|
||||
doc! { "$set": { "control_refs": finding.control_refs.clone() } },
|
||||
)
|
||||
.await?;
|
||||
refreshed_count += 1;
|
||||
}
|
||||
}
|
||||
if refreshed_count > 0 {
|
||||
tracing::info!(
|
||||
target_id,
|
||||
"Refreshed control_refs on {refreshed_count} existing PLC findings"
|
||||
);
|
||||
}
|
||||
|
||||
if !all_sbom.is_empty() {
|
||||
if let Err(e) = self
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::path::Path;
|
||||
|
||||
use compliance_core::models::{Finding, ScanType, Severity};
|
||||
use compliance_core::traits::{ScanOutput, Scanner};
|
||||
@@ -6,30 +6,6 @@ use compliance_core::CoreError;
|
||||
|
||||
use crate::pipeline::dedup;
|
||||
|
||||
/// Custom CRA-control detectors bundled into the binary and staged to a temp file
|
||||
/// at scan time so semgrep can `--config` them alongside the auto ruleset. These
|
||||
/// cover controls no off-the-shelf rule digs out (secure defaults, weak password
|
||||
/// hashing, insecure session cookies, weak data-at-rest ciphers); each rule id is
|
||||
/// keyed back to its control by the `control-map` LUT.
|
||||
const CRA_RULES: &str = include_str!("../../rules/cra_semgrep.yaml");
|
||||
|
||||
/// Write the bundled CRA rules to a stable temp path (atomic: unique tmp +
|
||||
/// rename). Returns `None` on failure — the scan then runs with auto rules only.
|
||||
async fn stage_cra_rules() -> Option<PathBuf> {
|
||||
let dir = std::env::temp_dir();
|
||||
let path = dir.join("compliance-cra-semgrep.yaml");
|
||||
let tmp = dir.join(format!("compliance-cra-semgrep.{}.tmp", std::process::id()));
|
||||
if let Err(e) = tokio::fs::write(&tmp, CRA_RULES).await {
|
||||
tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
|
||||
return None;
|
||||
}
|
||||
if let Err(e) = tokio::fs::rename(&tmp, &path).await {
|
||||
tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
|
||||
return None;
|
||||
}
|
||||
Some(path)
|
||||
}
|
||||
|
||||
pub struct SemgrepScanner;
|
||||
|
||||
impl Scanner for SemgrepScanner {
|
||||
@@ -43,26 +19,30 @@ impl Scanner for SemgrepScanner {
|
||||
|
||||
#[tracing::instrument(skip_all)]
|
||||
async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
|
||||
let cra_rules = stage_cra_rules().await;
|
||||
let mut command = tokio::process::Command::new("semgrep");
|
||||
command.arg("--config=auto");
|
||||
if let Some(path) = &cra_rules {
|
||||
command.arg(format!("--config={}", path.display()));
|
||||
}
|
||||
command
|
||||
.args(["--json", "--quiet", "--max-memory", "500", "--jobs", "1"])
|
||||
.arg(repo_path);
|
||||
|
||||
let output = tokio::time::timeout(std::time::Duration::from_secs(600), command.output())
|
||||
.await
|
||||
.map_err(|_| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: "timed out after 10 minutes".into(),
|
||||
})?
|
||||
.map_err(|e| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: Box::new(e),
|
||||
})?;
|
||||
let output = tokio::time::timeout(
|
||||
std::time::Duration::from_secs(600),
|
||||
tokio::process::Command::new("semgrep")
|
||||
.args([
|
||||
"--config=auto",
|
||||
"--json",
|
||||
"--quiet",
|
||||
"--max-memory",
|
||||
"500",
|
||||
"--jobs",
|
||||
"1",
|
||||
])
|
||||
.arg(repo_path)
|
||||
.output(),
|
||||
)
|
||||
.await
|
||||
.map_err(|_| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: "timed out after 10 minutes".into(),
|
||||
})?
|
||||
.map_err(|e| CoreError::Scanner {
|
||||
scanner: "semgrep".to_string(),
|
||||
source: Box::new(e),
|
||||
})?;
|
||||
|
||||
if !output.status.success() && output.stdout.is_empty() {
|
||||
let stderr = String::from_utf8_lossy(&output.stderr);
|
||||
@@ -102,7 +82,10 @@ impl Scanner for SemgrepScanner {
|
||||
finding.file_path = Some(r.path);
|
||||
finding.line_number = Some(r.start.line);
|
||||
finding.code_snippet = Some(r.extra.lines);
|
||||
finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
|
||||
finding.cwe = r
|
||||
.extra
|
||||
.metadata
|
||||
.and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
|
||||
finding
|
||||
})
|
||||
.collect();
|
||||
@@ -141,34 +124,10 @@ struct SemgrepExtra {
|
||||
metadata: Option<serde_json::Value>,
|
||||
}
|
||||
|
||||
/// semgrep emits `metadata.cwe` as a list of strings like
|
||||
/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
|
||||
/// the first entry and normalise it to just the `CWE-NNN` id.
|
||||
fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
|
||||
let raw = metadata.get("cwe")?;
|
||||
let text = match raw {
|
||||
serde_json::Value::Array(items) => items.first()?.as_str()?,
|
||||
serde_json::Value::String(s) => s.as_str(),
|
||||
_ => return None,
|
||||
};
|
||||
let id = text.split(':').next().unwrap_or(text).trim();
|
||||
(!id.is_empty()).then(|| id.to_string())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn extract_cwe_handles_list_and_normalises() {
|
||||
let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
|
||||
assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
|
||||
let bare = serde_json::json!({"cwe": "CWE-89"});
|
||||
assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
|
||||
let none = serde_json::json!({"severity": "ERROR"});
|
||||
assert_eq!(extract_cwe(&none), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn deserialize_semgrep_output() {
|
||||
let json = r#"{
|
||||
|
||||
@@ -1,125 +0,0 @@
|
||||
//! C5 example 2 — exploratory (not a committed regression test). Four topically
|
||||
//! distinct findings, to see whether tuned semantic retrieval maps each to the
|
||||
//! right master-control family. Run:
|
||||
//! export ... (LITELLM_* + BREAKPILOT_BASE_URL)
|
||||
//! cargo test -p compliance-agent --test c5_example2 -- --ignored --nocapture
|
||||
|
||||
mod common;
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use compliance_agent::llm::LlmClient;
|
||||
use compliance_core::config::BreakpilotConfig;
|
||||
use compliance_core::models::finding::{Finding, Severity};
|
||||
use compliance_core::models::scan::ScanType;
|
||||
use secrecy::SecretString;
|
||||
|
||||
fn env(k: &str) -> String {
|
||||
std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
|
||||
}
|
||||
|
||||
fn mk(file: &str, line: u32, title: &str, desc: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo-c5b".into(),
|
||||
format!("{file}:{line}"),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
title.into(),
|
||||
desc.into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.file_path = Some(file.into());
|
||||
f.line_number = Some(line);
|
||||
f
|
||||
}
|
||||
|
||||
fn write(repo: &std::path::Path, rel: &str, body: &str) {
|
||||
let p = repo.join(rel);
|
||||
if let Some(parent) = p.parent() {
|
||||
std::fs::create_dir_all(parent).unwrap();
|
||||
}
|
||||
std::fs::write(p, body).unwrap();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore = "live: api-dev + LiteLLM"]
|
||||
async fn c5b_varied_findings() {
|
||||
let llm = Arc::new(LlmClient::new(
|
||||
env("LITELLM_URL"),
|
||||
SecretString::from(env("LITELLM_API_KEY")),
|
||||
env("LITELLM_MODEL"),
|
||||
env("LITELLM_EMBED_MODEL"),
|
||||
));
|
||||
let mut config = common::dev_config("mongodb://unused".into(), "c5b".into());
|
||||
config.breakpilot = BreakpilotConfig {
|
||||
base_url: Some(env("BREAKPILOT_BASE_URL")),
|
||||
token: None,
|
||||
snapshot_dir: std::env::temp_dir()
|
||||
.join("c5-oscal-snap")
|
||||
.to_string_lossy()
|
||||
.into_owned(),
|
||||
semantic_mapping: true,
|
||||
grounded_control_checks: false,
|
||||
};
|
||||
|
||||
let repo = std::env::temp_dir().join("c5b-fixture-repo");
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
write(
|
||||
&repo,
|
||||
"app/db.py",
|
||||
"import sqlite3\n\ndef get_user(username):\n q = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n return conn.execute(q)\n",
|
||||
);
|
||||
write(
|
||||
&repo,
|
||||
"app/config.py",
|
||||
"# service config\nAPI_KEY = \"sk_live_51H8xYz3kQ9v2bNmR7wT4uSpQ\"\nDB_HOST = \"db.internal\"\n",
|
||||
);
|
||||
write(
|
||||
&repo,
|
||||
"app/net.py",
|
||||
"import requests\n\ndef fetch(url):\n return requests.get(url, verify=False, timeout=5)\n",
|
||||
);
|
||||
write(
|
||||
&repo,
|
||||
"app/ser.py",
|
||||
"import pickle\n\ndef load_state(blob):\n return pickle.loads(blob)\n",
|
||||
);
|
||||
|
||||
let mut findings = vec![
|
||||
mk(
|
||||
"app/db.py",
|
||||
4,
|
||||
"SQL injection via string-concatenated query",
|
||||
"User input is concatenated directly into a SQL statement, allowing SQL injection.",
|
||||
),
|
||||
mk(
|
||||
"app/config.py",
|
||||
2,
|
||||
"Hardcoded API credential in source",
|
||||
"A live API key is hardcoded in source code instead of a secret store.",
|
||||
),
|
||||
mk(
|
||||
"app/net.py",
|
||||
4,
|
||||
"TLS certificate verification disabled",
|
||||
"requests is called with verify=False, disabling TLS certificate validation.",
|
||||
),
|
||||
mk(
|
||||
"app/ser.py",
|
||||
3,
|
||||
"Insecure deserialization with pickle.loads",
|
||||
"Untrusted data is deserialized with pickle.loads, allowing remote code execution.",
|
||||
),
|
||||
];
|
||||
|
||||
let tagged =
|
||||
compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
|
||||
.await;
|
||||
println!("\n=== C5 example 2: varied findings ===");
|
||||
for f in &findings {
|
||||
println!(" {:52} -> {:?}", f.title, f.control_refs);
|
||||
}
|
||||
println!("tagged: {tagged}/4");
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
assert!(tagged >= 1);
|
||||
}
|
||||
@@ -1,145 +0,0 @@
|
||||
//! C5 live verification — the semantic master-controls path end to end against the
|
||||
//! deployed api-dev catalog. Ignored (hits api-dev + LiteLLM). Run explicitly:
|
||||
//!
|
||||
//! set -a; . ./.env; set +a
|
||||
//! BREAKPILOT_BASE_URL=https://api-dev.breakpilot.ai \
|
||||
//! cargo test -p compliance-agent --test c5_semantic_live -- --ignored --nocapture
|
||||
//!
|
||||
//! Pulls the live master-controls catalog, embeds the corpus (chunked), then for a
|
||||
//! couple of real vulnerable findings retrieves the nearest master controls and
|
||||
//! grounded-judges them, stamping master-control refs.
|
||||
|
||||
mod common;
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use compliance_agent::llm::LlmClient;
|
||||
use compliance_core::config::BreakpilotConfig;
|
||||
use compliance_core::models::finding::{Finding, Severity};
|
||||
use compliance_core::models::scan::ScanType;
|
||||
use secrecy::SecretString;
|
||||
|
||||
fn env(k: &str) -> String {
|
||||
std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set for the live C5 test"))
|
||||
}
|
||||
|
||||
fn mk_finding(file: &str, line: u32, title: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo-c5".into(),
|
||||
format!("{file}:{line}"),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
title.into(),
|
||||
title.into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.file_path = Some(file.into());
|
||||
f.line_number = Some(line);
|
||||
f
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore = "live: requires deployed api-dev master-controls (fetch+parse only, no LLM)"]
|
||||
async fn c5_ingest_master_controls_catalog() {
|
||||
use compliance_agent::controls::OscalControlsProvider;
|
||||
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
env("BREAKPILOT_BASE_URL"),
|
||||
None,
|
||||
std::env::temp_dir().join("c5-ingest-snap"),
|
||||
);
|
||||
let doc = provider
|
||||
.load_master_controls()
|
||||
.await
|
||||
.expect("pull + parse master-controls catalog");
|
||||
let controls = doc.to_controls();
|
||||
println!(
|
||||
"\n=== C5 ingest: {} master controls parsed ===",
|
||||
controls.len()
|
||||
);
|
||||
for c in controls.iter().take(4) {
|
||||
let text: String = c.text.chars().take(90).collect();
|
||||
println!(" {} | {} | {}", c.id, c.title, text);
|
||||
}
|
||||
assert!(
|
||||
!controls.is_empty(),
|
||||
"expected a non-empty master-control corpus"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore = "live: requires deployed api-dev master-controls + LiteLLM"]
|
||||
async fn c5_semantic_stamps_master_control_refs() {
|
||||
let llm = Arc::new(LlmClient::new(
|
||||
env("LITELLM_URL"),
|
||||
SecretString::from(env("LITELLM_API_KEY")),
|
||||
env("LITELLM_MODEL"),
|
||||
env("LITELLM_EMBED_MODEL"),
|
||||
));
|
||||
|
||||
let mut config = common::dev_config("mongodb://unused".into(), "c5".into());
|
||||
let snapshot = std::env::temp_dir().join("c5-oscal-snap");
|
||||
config.breakpilot = BreakpilotConfig {
|
||||
base_url: Some(env("BREAKPILOT_BASE_URL")),
|
||||
token: None,
|
||||
snapshot_dir: snapshot.to_string_lossy().into_owned(),
|
||||
semantic_mapping: true,
|
||||
grounded_control_checks: false,
|
||||
};
|
||||
|
||||
// Fixture repo with recognizable code-checkable surfaces.
|
||||
let repo = std::env::temp_dir().join("c5-fixture-repo");
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
std::fs::create_dir_all(repo.join("app")).expect("mkdir");
|
||||
std::fs::write(
|
||||
repo.join("app/auth.py"),
|
||||
concat!(
|
||||
"import hashlib\n",
|
||||
"\n",
|
||||
"def store_password(user, password):\n",
|
||||
" # weak, unsalted password hashing\n",
|
||||
" digest = hashlib.md5(password.encode()).hexdigest()\n",
|
||||
" db.save(user, digest)\n",
|
||||
"\n",
|
||||
"@app.route('/login', methods=['POST'])\n",
|
||||
"def login():\n",
|
||||
" u = request.form['username']\n",
|
||||
" p = request.form['password']\n",
|
||||
" return 'ok' if check(u, p) else ('bad', 401)\n",
|
||||
),
|
||||
)
|
||||
.expect("write fixture");
|
||||
|
||||
let mut findings = vec![
|
||||
mk_finding("app/auth.py", 5, "Weak password hash (md5, unsalted)"),
|
||||
mk_finding(
|
||||
"app/auth.py",
|
||||
9,
|
||||
"Login endpoint without brute-force protection",
|
||||
),
|
||||
];
|
||||
|
||||
let tagged =
|
||||
compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
|
||||
.await;
|
||||
|
||||
println!("\n=== C5 semantic master-controls stamping ===");
|
||||
for f in &findings {
|
||||
println!(
|
||||
" {:50} {}:{:?} -> {:?}",
|
||||
f.title,
|
||||
f.file_path.as_deref().unwrap_or(""),
|
||||
f.line_number,
|
||||
f.control_refs
|
||||
);
|
||||
}
|
||||
println!("findings that gained >=1 master-control ref: {tagged}");
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
|
||||
// Live corpus — assert only that the path runs and stamps at least one ref.
|
||||
assert!(
|
||||
tagged >= 1,
|
||||
"expected at least one finding to gain a master-control ref"
|
||||
);
|
||||
}
|
||||
@@ -2,10 +2,6 @@
|
||||
//
|
||||
// Spins up the agent API server on a random port with an isolated test
|
||||
// database. Each test gets a fresh database that is dropped on cleanup.
|
||||
//
|
||||
// Included via `mod common;` in several test binaries; not every binary uses
|
||||
// every helper, so allow dead code here.
|
||||
#![allow(dead_code)]
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
@@ -15,55 +11,6 @@ use compliance_agent::database::DatabasePool;
|
||||
use compliance_core::AgentConfig;
|
||||
use secrecy::SecretString;
|
||||
|
||||
/// The runner bearer token wired into the test config.
|
||||
pub const TEST_RUNNER_TOKEN: &str = "test-runner-token";
|
||||
|
||||
/// A minimal dev [`AgentConfig`] for tests: unauthenticated (no Keycloak), the
|
||||
/// Werkbank runner API enabled with [`TEST_RUNNER_TOKEN`].
|
||||
pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
|
||||
AgentConfig {
|
||||
mongodb_uri,
|
||||
mongodb_database: db_name,
|
||||
litellm_url: std::env::var("TEST_LITELLM_URL")
|
||||
.unwrap_or_else(|_| "http://localhost:4000".into()),
|
||||
litellm_api_key: SecretString::from(String::new()),
|
||||
litellm_model: "gpt-4o".into(),
|
||||
litellm_embed_model: "text-embedding-3-small".into(),
|
||||
agent_port: 0, // not used — we bind ourselves
|
||||
scan_schedule: String::new(),
|
||||
cve_monitor_schedule: String::new(),
|
||||
git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
|
||||
artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
|
||||
ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
|
||||
github_token: None,
|
||||
github_webhook_secret: None,
|
||||
gitlab_url: None,
|
||||
gitlab_token: None,
|
||||
gitlab_webhook_secret: None,
|
||||
jira_url: None,
|
||||
jira_email: None,
|
||||
jira_api_token: None,
|
||||
jira_project_key: None,
|
||||
searxng_url: None,
|
||||
nvd_api_key: None,
|
||||
keycloak_url: None,
|
||||
keycloak_realm: None,
|
||||
keycloak_admin_username: None,
|
||||
keycloak_admin_password: None,
|
||||
pentest_verification_email: None,
|
||||
pentest_imap_host: None,
|
||||
pentest_imap_port: None,
|
||||
pentest_imap_tls: false,
|
||||
pentest_imap_username: None,
|
||||
pentest_imap_password: None,
|
||||
admin_api_token: None,
|
||||
tenant_registry_url: None,
|
||||
plc_runtime: compliance_core::PlcRuntimeConfig::default(),
|
||||
werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
|
||||
breakpilot: compliance_core::config::BreakpilotConfig::default(),
|
||||
}
|
||||
}
|
||||
|
||||
/// A running test server with a unique database.
|
||||
pub struct TestServer {
|
||||
pub base_url: String,
|
||||
@@ -86,7 +33,45 @@ impl TestServer {
|
||||
.await
|
||||
.expect("Failed to build DatabasePool");
|
||||
|
||||
let config = dev_config(mongodb_uri.clone(), db_name.clone());
|
||||
let config = AgentConfig {
|
||||
mongodb_uri: mongodb_uri.clone(),
|
||||
mongodb_database: db_name.clone(),
|
||||
litellm_url: std::env::var("TEST_LITELLM_URL")
|
||||
.unwrap_or_else(|_| "http://localhost:4000".into()),
|
||||
litellm_api_key: SecretString::from(String::new()),
|
||||
litellm_model: "gpt-4o".into(),
|
||||
litellm_embed_model: "text-embedding-3-small".into(),
|
||||
agent_port: 0, // not used — we bind ourselves
|
||||
scan_schedule: String::new(),
|
||||
cve_monitor_schedule: String::new(),
|
||||
git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
|
||||
artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
|
||||
ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
|
||||
github_token: None,
|
||||
github_webhook_secret: None,
|
||||
gitlab_url: None,
|
||||
gitlab_token: None,
|
||||
gitlab_webhook_secret: None,
|
||||
jira_url: None,
|
||||
jira_email: None,
|
||||
jira_api_token: None,
|
||||
jira_project_key: None,
|
||||
searxng_url: None,
|
||||
nvd_api_key: None,
|
||||
keycloak_url: None,
|
||||
keycloak_realm: None,
|
||||
keycloak_admin_username: None,
|
||||
keycloak_admin_password: None,
|
||||
pentest_verification_email: None,
|
||||
pentest_imap_host: None,
|
||||
pentest_imap_port: None,
|
||||
pentest_imap_tls: false,
|
||||
pentest_imap_username: None,
|
||||
pentest_imap_password: None,
|
||||
admin_api_token: None,
|
||||
tenant_registry_url: None,
|
||||
plc_runtime: compliance_core::PlcRuntimeConfig::default(),
|
||||
};
|
||||
|
||||
let agent = ComplianceAgent::new(config, db_pool);
|
||||
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
//! Live validation of the grounded surface path (Stage 5d) for absence-based CRA
|
||||
//! controls. Ignored (hits api-dev CRA catalog + LiteLLM). Run:
|
||||
//! export ... (LITELLM_* + BREAKPILOT_BASE_URL)
|
||||
//! cargo test -p compliance-agent --test grounded_surface_live -- --ignored --nocapture
|
||||
//!
|
||||
//! Builds a fixture whose code surfaces trigger several absence-based controls
|
||||
//! (no rate limiting, no security logging, unverified update) and checks that the
|
||||
//! grounded checker produces control-tagged findings.
|
||||
|
||||
mod common;
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use compliance_agent::llm::LlmClient;
|
||||
use compliance_core::config::BreakpilotConfig;
|
||||
use secrecy::SecretString;
|
||||
|
||||
fn env(k: &str) -> String {
|
||||
std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
|
||||
}
|
||||
|
||||
fn write(repo: &std::path::Path, rel: &str, body: &str) {
|
||||
let p = repo.join(rel);
|
||||
if let Some(parent) = p.parent() {
|
||||
std::fs::create_dir_all(parent).unwrap();
|
||||
}
|
||||
std::fs::write(p, body).unwrap();
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore = "live: api-dev CRA catalog + LiteLLM"]
|
||||
async fn grounded_surface_flags_absence_controls() {
|
||||
let llm = Arc::new(LlmClient::new(
|
||||
env("LITELLM_URL"),
|
||||
SecretString::from(env("LITELLM_API_KEY")),
|
||||
env("LITELLM_MODEL"),
|
||||
env("LITELLM_EMBED_MODEL"),
|
||||
));
|
||||
let mut config = common::dev_config("mongodb://unused".into(), "grounded".into());
|
||||
config.breakpilot = BreakpilotConfig {
|
||||
base_url: Some(env("BREAKPILOT_BASE_URL")),
|
||||
token: None,
|
||||
snapshot_dir: std::env::temp_dir()
|
||||
.join("grounded-snap")
|
||||
.to_string_lossy()
|
||||
.into_owned(),
|
||||
semantic_mapping: false,
|
||||
grounded_control_checks: true,
|
||||
};
|
||||
|
||||
let repo = std::env::temp_dir().join("grounded-fixture-repo");
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
// cra-ai-11: login endpoint with no rate limiting / lockout
|
||||
write(
|
||||
&repo,
|
||||
"app/auth.py",
|
||||
"@app.route('/login', methods=['POST'])\ndef login():\n u = request.form['username']\n p = request.form['password']\n if authenticate(u, p):\n return redirect('/')\n return 'bad credentials', 401\n",
|
||||
);
|
||||
// cra-ai-24: privileged admin action with no security/audit logging
|
||||
write(
|
||||
&repo,
|
||||
"app/admin.py",
|
||||
"@app.route('/admin/delete_user', methods=['POST'])\ndef admin_delete_user():\n uid = request.form['uid']\n db.users.delete_one({'_id': uid})\n return 'ok', 200\n",
|
||||
);
|
||||
// cra-ai-28/29/30: firmware update applied without signature / checksum verification
|
||||
write(
|
||||
&repo,
|
||||
"app/updater.py",
|
||||
"def apply_firmware_update(url):\n blob = download(url)\n install_firmware(blob)\n reboot_device()\n",
|
||||
);
|
||||
|
||||
let findings =
|
||||
compliance_agent::controls::grounded_surface_findings(&config, llm, &repo, "repo-grounded")
|
||||
.await;
|
||||
|
||||
println!("\n=== Grounded surface findings ({}) ===", findings.len());
|
||||
for f in &findings {
|
||||
println!(
|
||||
" {:24} {}:{:?} {}",
|
||||
f.control_refs.join(","),
|
||||
f.file_path.as_deref().unwrap_or(""),
|
||||
f.line_number,
|
||||
f.title
|
||||
);
|
||||
}
|
||||
let _ = std::fs::remove_dir_all(&repo);
|
||||
|
||||
assert!(
|
||||
!findings.is_empty(),
|
||||
"expected the grounded pass to flag at least one absence-based control"
|
||||
);
|
||||
}
|
||||
@@ -1,291 +0,0 @@
|
||||
//! Integration tests for the Werkbank runner endpoints (WB-05).
|
||||
//!
|
||||
//! Drives the real HTTP handlers (lease/heartbeat/complete) against a live Mongo:
|
||||
//! a runner leases a seeded job, completes it, and the result's findings are
|
||||
//! persisted against the job's target. Also checks the bearer-token gate. Skips
|
||||
//! cleanly when no Mongo is reachable.
|
||||
|
||||
#![allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
|
||||
mod common;
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::routing::{get, post};
|
||||
use axum::{middleware, Extension, Router};
|
||||
|
||||
use compliance_agent::agent::ComplianceAgent;
|
||||
use compliance_agent::api::handlers::werkbank_jobs;
|
||||
use compliance_agent::database::DatabasePool;
|
||||
use compliance_agent::werkbank::JobQueue;
|
||||
use compliance_core::models::werkbank::{InputRef, Job, JobResult, JobStatus, LeasedJob};
|
||||
use compliance_core::models::{
|
||||
Artifact, Finding, OnboardedTarget, PlcFormat, ScanType, Severity, TargetType,
|
||||
};
|
||||
|
||||
use common::{dev_config, TEST_RUNNER_TOKEN};
|
||||
|
||||
const TENANT: &str = "dev";
|
||||
|
||||
/// A running werkbank API on a random port, or `None` if no Mongo.
|
||||
struct Harness {
|
||||
base_url: String,
|
||||
client: reqwest::Client,
|
||||
pool: DatabasePool,
|
||||
db_name: String,
|
||||
}
|
||||
|
||||
async fn start() -> Option<Harness> {
|
||||
let uri = std::env::var("TEST_MONGODB_URI")
|
||||
.unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
|
||||
let db_name = format!("wba_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
|
||||
let pool = match DatabasePool::connect(&uri, &db_name).await {
|
||||
Ok(p) => p,
|
||||
Err(_) => {
|
||||
eprintln!("SKIP werkbank_api: no MongoDB reachable at {uri}");
|
||||
return None;
|
||||
}
|
||||
};
|
||||
// Touch the tenant DB so indexes are ensured before the queue is used.
|
||||
pool.for_tenant_id(TENANT).await.expect("tenant db");
|
||||
|
||||
let agent = ComplianceAgent::new(dev_config(uri, db_name.clone()), pool.clone());
|
||||
let app = Router::new()
|
||||
.route("/api/v1/werkbank/jobs/lease", post(werkbank_jobs::lease))
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/heartbeat",
|
||||
post(werkbank_jobs::heartbeat),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/complete",
|
||||
post(werkbank_jobs::complete),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/jobs/enqueue",
|
||||
post(werkbank_jobs::enqueue),
|
||||
)
|
||||
.route(
|
||||
"/api/v1/werkbank/artifacts/{hash}",
|
||||
get(werkbank_jobs::serve_artifact),
|
||||
)
|
||||
.layer(middleware::from_fn(werkbank_jobs::require_runner_token))
|
||||
.layer(Extension(Arc::new(agent)));
|
||||
|
||||
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let port = listener.local_addr().unwrap().port();
|
||||
tokio::spawn(async move {
|
||||
axum::serve(listener, app).await.ok();
|
||||
});
|
||||
|
||||
Some(Harness {
|
||||
base_url: format!("http://127.0.0.1:{port}"),
|
||||
client: reqwest::Client::new(),
|
||||
pool,
|
||||
db_name,
|
||||
})
|
||||
}
|
||||
|
||||
impl Harness {
|
||||
fn post(
|
||||
&self,
|
||||
path: &str,
|
||||
token: Option<&str>,
|
||||
body: serde_json::Value,
|
||||
) -> reqwest::RequestBuilder {
|
||||
let mut r = self
|
||||
.client
|
||||
.post(format!("{}{path}", self.base_url))
|
||||
.json(&body);
|
||||
if let Some(t) = token {
|
||||
r = r.bearer_auth(t);
|
||||
}
|
||||
r
|
||||
}
|
||||
async fn cleanup(&self) {
|
||||
let _ = self
|
||||
.pool
|
||||
.client()
|
||||
.database(&format!("{}_{TENANT}", self.db_name))
|
||||
.drop()
|
||||
.await;
|
||||
}
|
||||
}
|
||||
|
||||
fn finding_for(target: &str, fp: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
target.to_string(),
|
||||
fp.to_string(),
|
||||
"ics-probe".to_string(),
|
||||
ScanType::IcsProbe,
|
||||
"Modbus exposed".to_string(),
|
||||
"unauthenticated".to_string(),
|
||||
Severity::Critical,
|
||||
);
|
||||
f.rule_id = Some("ics-modbus-exposed".to_string());
|
||||
f
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn lease_complete_persists_findings_against_the_target() {
|
||||
let Some(h) = start().await else { return };
|
||||
let db = h.pool.for_tenant_id(TENANT).await.unwrap();
|
||||
let queue = JobQueue::new(&db);
|
||||
|
||||
// Seed a queued job.
|
||||
let job = Job::plc_provision("job-1", TENANT, "target-1", InputRef::blob("sha256:x"), 180);
|
||||
assert!(queue.enqueue(job, chrono::Utc::now()).await.unwrap());
|
||||
|
||||
// Lease it over HTTP.
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/lease",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({
|
||||
"tenant": TENANT, "runner_id": "r1", "executor": "docker",
|
||||
"labels": [], "lease_ttl_secs": 60
|
||||
}),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 200, "lease should return a job");
|
||||
let leased: LeasedJob = resp.json().await.unwrap();
|
||||
assert_eq!(leased.job.id, "job-1");
|
||||
|
||||
// Complete it with a finding.
|
||||
let mut result = JobResult::succeeded("job-1");
|
||||
result.findings = vec![finding_for("target-1", "fp-abc")];
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/complete",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({
|
||||
"tenant": TENANT, "job_id": "job-1",
|
||||
"lease_token": leased.lease_token, "result": result
|
||||
}),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 200);
|
||||
assert!(resp.json::<serde_json::Value>().await.unwrap()["recorded"]
|
||||
.as_bool()
|
||||
.unwrap());
|
||||
|
||||
// The job is now succeeded, and the finding was persisted to the target.
|
||||
assert_eq!(
|
||||
queue.get("job-1").await.unwrap().unwrap().status,
|
||||
JobStatus::Succeeded
|
||||
);
|
||||
let stored = db
|
||||
.findings()
|
||||
.find_one(mongodb::bson::doc! { "fingerprint": "fp-abc" })
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(stored.is_some(), "finding should be persisted");
|
||||
|
||||
h.cleanup().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn enqueue_extracts_program_stores_a_blob_and_serves_it() {
|
||||
let Some(h) = start().await else { return };
|
||||
let db = h.pool.for_tenant_id(TENANT).await.unwrap();
|
||||
|
||||
// A PlcSps target with a single complete ST program uploaded.
|
||||
let dir = std::env::temp_dir().join(format!("wbq-prog-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
let st = dir.join("main.st");
|
||||
std::fs::write(
|
||||
&st,
|
||||
"PROGRAM Main\nEND_PROGRAM\nCONFIGURATION C\n RESOURCE R\nEND_CONFIGURATION\n",
|
||||
)
|
||||
.unwrap();
|
||||
let mut target = OnboardedTarget::new("plc".into(), TargetType::PlcSps);
|
||||
let mut art = Artifact::plc_project("main.st", PlcFormat::StructuredText);
|
||||
art.stored_path = Some(st.to_string_lossy().to_string());
|
||||
target.artifacts.push(art);
|
||||
let ins = db.onboarded_targets().insert_one(&target).await.unwrap();
|
||||
let target_id = ins.inserted_id.as_object_id().unwrap().to_hex();
|
||||
|
||||
// Enqueue → a plc-provision job whose program is a content-addressed blob.
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/enqueue",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({ "tenant": TENANT, "target_id": target_id }),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 200, "enqueue should succeed");
|
||||
let body: serde_json::Value = resp.json().await.unwrap();
|
||||
let job_id = body["job_id"].as_str().unwrap().to_string();
|
||||
|
||||
let rec = JobQueue::new(&db).get(&job_id).await.unwrap().unwrap();
|
||||
let hash = rec
|
||||
.job
|
||||
.inputs
|
||||
.get("program")
|
||||
.and_then(|i| i.blob.clone())
|
||||
.expect("program blob");
|
||||
|
||||
// Serve the blob back and confirm it's the program source (what the runner
|
||||
// would fetch).
|
||||
let served = h
|
||||
.client
|
||||
.get(format!("{}/api/v1/werkbank/artifacts/{hash}", h.base_url))
|
||||
.bearer_auth(TEST_RUNNER_TOKEN)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(served.status(), 200);
|
||||
assert!(served.text().await.unwrap().contains("CONFIGURATION"));
|
||||
|
||||
h.cleanup().await;
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn empty_queue_leases_nothing() {
|
||||
let Some(h) = start().await else { return };
|
||||
let resp = h
|
||||
.post(
|
||||
"/api/v1/werkbank/jobs/lease",
|
||||
Some(TEST_RUNNER_TOKEN),
|
||||
serde_json::json!({
|
||||
"tenant": TENANT, "runner_id": "r1", "executor": "docker",
|
||||
"labels": [], "lease_ttl_secs": 60
|
||||
}),
|
||||
)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), 204, "no job → 204");
|
||||
h.cleanup().await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn runner_endpoints_require_the_bearer_token() {
|
||||
let Some(h) = start().await else { return };
|
||||
let body = serde_json::json!({
|
||||
"tenant": TENANT, "runner_id": "r1", "executor": "docker",
|
||||
"labels": [], "lease_ttl_secs": 60
|
||||
});
|
||||
|
||||
let no_token = h
|
||||
.post("/api/v1/werkbank/jobs/lease", None, body.clone())
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(no_token.status(), 401, "missing token → 401");
|
||||
|
||||
let bad_token = h
|
||||
.post("/api/v1/werkbank/jobs/lease", Some("wrong"), body)
|
||||
.send()
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(bad_token.status(), 401, "wrong token → 401");
|
||||
|
||||
h.cleanup().await;
|
||||
}
|
||||
@@ -64,11 +64,11 @@ struct Claims {
|
||||
const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
|
||||
|
||||
/// Path prefixes that bypass JWT validation. The admin sub-router
|
||||
/// (`/api/v1/admin/*`) and the Werkbank runner API (`/api/v1/werkbank/*`)
|
||||
/// have their own static-bearer middleware and must not be routed through the
|
||||
/// customer-JWT path — a Keycloak token always carries a single tenant_id and
|
||||
/// would semantically conflict with these cross-tenant / machine operations.
|
||||
const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/", "/api/v1/werkbank/"];
|
||||
/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
|
||||
/// not be routed through the customer-JWT path — a Keycloak token
|
||||
/// always carries a single tenant_id and would semantically conflict
|
||||
/// with cross-tenant admin operations.
|
||||
const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
|
||||
|
||||
/// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
|
||||
/// and attaches a `TenantContext` extension on success.
|
||||
|
||||
@@ -53,51 +53,6 @@ pub struct AgentConfig {
|
||||
/// default: it needs Docker access in the agent's runtime, which is a
|
||||
/// deployment opt-in.
|
||||
pub plc_runtime: PlcRuntimeConfig,
|
||||
/// Static bearer for the Werkbank runner endpoints
|
||||
/// (`/api/v1/werkbank/jobs/*`). Machine auth for runners leasing/completing
|
||||
/// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
|
||||
/// `None`, those endpoints are not mounted at all.
|
||||
pub werkbank_runner_token: Option<SecretString>,
|
||||
/// Source for the OSCAL control catalog pulled from breakpilot-compliance
|
||||
/// (drives the [`crate::traits::ControlsProvider`]). Disabled when
|
||||
/// `base_url` is `None`.
|
||||
pub breakpilot: BreakpilotConfig,
|
||||
}
|
||||
|
||||
/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
|
||||
/// to snapshot it for deterministic / offline reuse.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct BreakpilotConfig {
|
||||
/// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
|
||||
/// the OSCAL controls provider.
|
||||
pub base_url: Option<String>,
|
||||
/// Optional bearer token for the catalog endpoint.
|
||||
pub token: Option<SecretString>,
|
||||
/// Directory for catalog snapshots.
|
||||
pub snapshot_dir: String,
|
||||
/// Enable the master-controls **semantic** mapping pass (embed regions,
|
||||
/// Enable the master-controls **semantic** mapping pass (embed regions,
|
||||
/// retrieve nearest controls, grounded-judge). On by default — validated live
|
||||
/// against the deployed master-controls catalog. Still a no-op unless
|
||||
/// `base_url` is set and the catalog is reachable.
|
||||
pub semantic_mapping: bool,
|
||||
/// Enable the **grounded surface** pass for absence-based controls (retrieve
|
||||
/// the code surface a control governs, judge whether it holds). On by default
|
||||
/// — validated live; it covers the 8 absence-based CRA controls that no
|
||||
/// syntactic rule can.
|
||||
pub grounded_control_checks: bool,
|
||||
}
|
||||
|
||||
impl Default for BreakpilotConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
base_url: None,
|
||||
token: None,
|
||||
snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
|
||||
semantic_mapping: true,
|
||||
grounded_control_checks: true,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
|
||||
|
||||
@@ -1,205 +0,0 @@
|
||||
//! Grounded control-driven checking.
|
||||
//!
|
||||
//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
|
||||
//! whose output is grounded to real code — so a hallucinated finding cannot
|
||||
//! survive. Determinism is structural, not a prompt plea:
|
||||
//!
|
||||
//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
|
||||
//! code it never saw;
|
||||
//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
|
||||
//! in the region, and the line is recomputed from that match — the model's own
|
||||
//! line number is never trusted ([`ground`]);
|
||||
//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
|
||||
//!
|
||||
//! The LLM supplies cross-language / cross-stack pattern recognition; this module
|
||||
//! supplies the determinism.
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
use crate::models::finding::{Finding, Severity};
|
||||
use crate::models::scan::ScanType;
|
||||
|
||||
/// A control rendered as a check the LLM judges code against.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlCheckSpec {
|
||||
/// Stable control id, e.g. `"cra-ai-8"`.
|
||||
pub control_id: String,
|
||||
/// Short control title (used in the finding title).
|
||||
pub title: String,
|
||||
/// The requirement text the LLM judges against (control objective/statement).
|
||||
pub requirement: String,
|
||||
/// CWE to fall back to when the model doesn't supply one.
|
||||
pub default_cwe: Option<String>,
|
||||
/// Severity for findings raised from this control.
|
||||
pub severity: Severity,
|
||||
}
|
||||
|
||||
/// A retrieved code region the LLM judges — never the whole repo.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct CandidateRegion {
|
||||
/// Repo-relative path.
|
||||
pub file: String,
|
||||
/// 1-based line number of the region's first line in `file`.
|
||||
pub start_line: u32,
|
||||
/// The region's source text.
|
||||
pub content: String,
|
||||
}
|
||||
|
||||
/// The LLM's structured verdict for one (control, region). `snippet` is the
|
||||
/// verbatim code the model claims proves the violation — it is the anchor the
|
||||
/// grounding gate checks.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct LlmVerdict {
|
||||
pub violates: bool,
|
||||
pub snippet: String,
|
||||
pub cwe: Option<String>,
|
||||
pub confidence: f64,
|
||||
}
|
||||
|
||||
/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
|
||||
/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
|
||||
/// finding's line is computed from the match, so a fabricated or mis-located
|
||||
/// snippet is dropped. Pure — no LLM, no I/O.
|
||||
pub fn ground(
|
||||
spec: &ControlCheckSpec,
|
||||
region: &CandidateRegion,
|
||||
verdict: &LlmVerdict,
|
||||
repo_id: &str,
|
||||
) -> Option<Finding> {
|
||||
if !verdict.violates {
|
||||
return None;
|
||||
}
|
||||
let snippet = verdict.snippet.trim();
|
||||
if snippet.is_empty() {
|
||||
return None;
|
||||
}
|
||||
// Grounding: the quoted snippet must literally exist in the retrieved region.
|
||||
let pos = region.content.find(snippet)?;
|
||||
// Recompute the real line from the match — never trust the model's number.
|
||||
let newlines_before = region.content[..pos].matches('\n').count();
|
||||
let line = region.start_line + newlines_before as u32;
|
||||
|
||||
let mut finding = Finding::new(
|
||||
repo_id.to_string(),
|
||||
control_finding_fingerprint(&spec.control_id, ®ion.file, snippet),
|
||||
"control-check".to_string(),
|
||||
ScanType::CodeReview,
|
||||
format!("{}: {}", spec.control_id, spec.title),
|
||||
format!(
|
||||
"Control {} appears violated ({}) at {}:{line}",
|
||||
spec.control_id, spec.requirement, region.file
|
||||
),
|
||||
spec.severity.clone(),
|
||||
);
|
||||
finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
|
||||
finding.file_path = Some(region.file.clone());
|
||||
finding.line_number = Some(line);
|
||||
finding.code_snippet = Some(snippet.to_string());
|
||||
finding.confidence = Some(verdict.confidence);
|
||||
// Carry the control reference on the finding.
|
||||
finding.control_refs = vec![spec.control_id.clone()];
|
||||
Some(finding)
|
||||
}
|
||||
|
||||
/// Deterministic cache key for a (control, region, model, prompt-version) verdict
|
||||
/// so identical inputs reproduce the same verdict without another LLM call.
|
||||
pub fn cache_key(
|
||||
control_id: &str,
|
||||
region_content: &str,
|
||||
model: &str,
|
||||
prompt_version: &str,
|
||||
) -> String {
|
||||
hash_parts(&[control_id, region_content, model, prompt_version])
|
||||
}
|
||||
|
||||
fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
|
||||
hash_parts(&[control_id, file, snippet])
|
||||
}
|
||||
|
||||
fn hash_parts(parts: &[&str]) -> String {
|
||||
let mut hasher = Sha256::new();
|
||||
for part in parts {
|
||||
hasher.update(part.as_bytes());
|
||||
hasher.update([0u8]); // domain separator between parts
|
||||
}
|
||||
hex::encode(hasher.finalize())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "Products must not ship default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
fn region() -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 10,
|
||||
content: "def login():\n PASSWORD = \"admin123\"\n return PASSWORD\n".into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn grounds_real_snippet_with_recomputed_line() {
|
||||
let v = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
let f = ground(&spec(), ®ion(), &v, "repo").expect("should ground");
|
||||
assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
|
||||
assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
|
||||
assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
|
||||
assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
|
||||
assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn drops_fabricated_snippet_not_in_region() {
|
||||
let v = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "SECRET = \"totally-made-up\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.99,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &v, "repo").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn drops_non_violation_and_empty_snippet() {
|
||||
let no = LlmVerdict {
|
||||
violates: false,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &no, "repo").is_none());
|
||||
let empty = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: " ".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &empty, "repo").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn cache_key_and_fingerprint_are_deterministic() {
|
||||
assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
|
||||
assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
|
||||
assert_eq!(
|
||||
control_finding_fingerprint("c", "f", "s"),
|
||||
control_finding_fingerprint("c", "f", "s")
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,5 +1,4 @@
|
||||
pub mod config;
|
||||
pub mod control_check;
|
||||
pub mod db;
|
||||
pub mod error;
|
||||
pub mod models;
|
||||
|
||||
@@ -76,10 +76,6 @@ pub struct Finding {
|
||||
pub triage_rationale: Option<String>,
|
||||
/// Developer feedback on finding quality
|
||||
pub developer_feedback: Option<String>,
|
||||
/// Compliance control ids this finding is evidence for (stamped by control
|
||||
/// triage against the `control-map` LUT). Empty when unmapped.
|
||||
#[serde(default)]
|
||||
pub control_refs: Vec<String>,
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
pub created_at: DateTime<Utc>,
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
@@ -122,7 +118,6 @@ impl Finding {
|
||||
triage_action: None,
|
||||
triage_rationale: None,
|
||||
developer_feedback: None,
|
||||
control_refs: Vec::new(),
|
||||
created_at: now,
|
||||
updated_at: now,
|
||||
}
|
||||
|
||||
@@ -10,8 +10,6 @@ pub mod mcp;
|
||||
pub mod mcp_token;
|
||||
pub mod notification;
|
||||
pub mod onboarding;
|
||||
pub mod oscal;
|
||||
pub mod oscal_assessment;
|
||||
pub mod pentest;
|
||||
pub mod repository;
|
||||
pub mod sbom;
|
||||
@@ -41,8 +39,6 @@ pub use onboarding::{
|
||||
GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
|
||||
TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
|
||||
};
|
||||
pub use oscal::OscalDocument;
|
||||
pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
|
||||
pub use pentest::{
|
||||
AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
|
||||
PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
|
||||
@@ -53,7 +49,6 @@ pub use repository::ScanTrigger;
|
||||
pub use sbom::{SbomEntry, VulnRef};
|
||||
pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
|
||||
pub use werkbank::{
|
||||
CompleteRequest, CompleteResponse, DastCollect, Executor, HeartbeatAck, HeartbeatRequest,
|
||||
InputRef, Job, JobCollect, JobRecord, JobResult, JobRuntime, JobStatus, JobType, LeaseRequest,
|
||||
LeasedJob,
|
||||
DastCollect, Executor, HeartbeatAck, InputRef, Job, JobCollect, JobRecord, JobResult,
|
||||
JobRuntime, JobStatus, JobType, LeasedJob,
|
||||
};
|
||||
|
||||
@@ -1,250 +0,0 @@
|
||||
//! OSCAL 1.1 catalog types + mapping into the controls corpus.
|
||||
//!
|
||||
//! Deserialises the OSCAL catalog served by breakpilot-compliance
|
||||
//! (`GET /api/compliance/v1/oscal/catalog`) and maps its controls into the
|
||||
//! framework-agnostic [`crate::traits::Control`] that the mapping engine consumes.
|
||||
//! Only the fields we use are modelled; unknown OSCAL fields are ignored so the
|
||||
//! producer can add detail without breaking us.
|
||||
//!
|
||||
//! Scope boundary: this is the *catalog* (domain content). Assessment objectives
|
||||
//! and scanner routing live in our assessment layer, not here — see
|
||||
//! [`crate::traits::ControlsProvider`].
|
||||
|
||||
use serde::Deserialize;
|
||||
|
||||
use crate::models::onboarding::ComplianceFramework;
|
||||
use crate::traits::Control as CorpusControl;
|
||||
|
||||
/// A parsed OSCAL catalog document (`{"catalog": {...}}`).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct OscalDocument {
|
||||
pub catalog: Catalog,
|
||||
}
|
||||
|
||||
/// An OSCAL catalog: metadata + a tree of control groups.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Catalog {
|
||||
pub uuid: String,
|
||||
pub metadata: Metadata,
|
||||
#[serde(default)]
|
||||
pub groups: Vec<Group>,
|
||||
#[serde(rename = "back-matter", default)]
|
||||
pub back_matter: Option<BackMatter>,
|
||||
}
|
||||
|
||||
/// Catalog metadata (title/version + provenance props).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Metadata {
|
||||
pub title: String,
|
||||
pub version: String,
|
||||
#[serde(rename = "oscal-version")]
|
||||
pub oscal_version: String,
|
||||
#[serde(default)]
|
||||
pub props: Vec<Prop>,
|
||||
}
|
||||
|
||||
/// A name/value property, optionally namespaced.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Prop {
|
||||
pub name: String,
|
||||
pub value: String,
|
||||
#[serde(default)]
|
||||
pub ns: Option<String>,
|
||||
}
|
||||
|
||||
/// A control group (may nest sub-groups and controls).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Group {
|
||||
#[serde(default)]
|
||||
pub id: String,
|
||||
#[serde(default)]
|
||||
pub title: String,
|
||||
#[serde(default)]
|
||||
pub controls: Vec<Control>,
|
||||
#[serde(default)]
|
||||
pub groups: Vec<Group>,
|
||||
}
|
||||
|
||||
/// An OSCAL control (may nest enhancement controls).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Control {
|
||||
pub id: String,
|
||||
#[serde(default)]
|
||||
pub title: String,
|
||||
#[serde(default)]
|
||||
pub props: Vec<Prop>,
|
||||
#[serde(default)]
|
||||
pub parts: Vec<Part>,
|
||||
#[serde(default)]
|
||||
pub links: Vec<Link>,
|
||||
#[serde(default)]
|
||||
pub controls: Vec<Control>,
|
||||
}
|
||||
|
||||
/// A control part (e.g. the `statement`), may nest sub-parts.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Part {
|
||||
#[serde(default)]
|
||||
pub name: String,
|
||||
#[serde(default)]
|
||||
pub prose: Option<String>,
|
||||
#[serde(default)]
|
||||
pub parts: Vec<Part>,
|
||||
}
|
||||
|
||||
/// A link, e.g. a `reference` to a back-matter resource.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Link {
|
||||
pub href: String,
|
||||
#[serde(default)]
|
||||
pub rel: Option<String>,
|
||||
}
|
||||
|
||||
/// Back-matter holding referenced resources (e.g. the CRA measures).
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct BackMatter {
|
||||
#[serde(default)]
|
||||
pub resources: Vec<Resource>,
|
||||
}
|
||||
|
||||
/// A back-matter resource referenced by control links.
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
pub struct Resource {
|
||||
pub uuid: String,
|
||||
#[serde(default)]
|
||||
pub title: Option<String>,
|
||||
#[serde(default)]
|
||||
pub description: Option<String>,
|
||||
}
|
||||
|
||||
impl Metadata {
|
||||
/// First prop value with the given name.
|
||||
pub fn prop(&self, name: &str) -> Option<&str> {
|
||||
self.props
|
||||
.iter()
|
||||
.find(|p| p.name == name)
|
||||
.map(|p| p.value.as_str())
|
||||
}
|
||||
}
|
||||
|
||||
impl Control {
|
||||
/// First prop value with the given name.
|
||||
pub fn prop(&self, name: &str) -> Option<&str> {
|
||||
self.props
|
||||
.iter()
|
||||
.find(|p| p.name == name)
|
||||
.map(|p| p.value.as_str())
|
||||
}
|
||||
|
||||
/// The control's `statement` prose, if present.
|
||||
pub fn statement(&self) -> Option<&str> {
|
||||
self.parts
|
||||
.iter()
|
||||
.find(|p| p.name == "statement")
|
||||
.and_then(|p| p.prose.as_deref())
|
||||
}
|
||||
}
|
||||
|
||||
impl OscalDocument {
|
||||
/// The framework this catalog declares (`metadata.props[name="framework"]`).
|
||||
pub fn framework(&self) -> Option<ComplianceFramework> {
|
||||
framework_from_str(self.catalog.metadata.prop("framework")?)
|
||||
}
|
||||
|
||||
/// The catalog `content-hash` prop — consumers pin this to snapshot/detect drift.
|
||||
pub fn content_hash(&self) -> Option<&str> {
|
||||
self.catalog.metadata.prop("content-hash")
|
||||
}
|
||||
|
||||
/// Flatten the catalog into the corpus controls the mapping engine consumes.
|
||||
pub fn to_controls(&self) -> Vec<CorpusControl> {
|
||||
let framework = self.framework().unwrap_or(ComplianceFramework::Cra);
|
||||
let source_label = self.catalog.metadata.title.as_str();
|
||||
let mut out = Vec::new();
|
||||
for group in &self.catalog.groups {
|
||||
collect_group(group, framework, source_label, &mut out);
|
||||
}
|
||||
out
|
||||
}
|
||||
}
|
||||
|
||||
/// Map an OSCAL framework token (e.g. `"cra"`) to [`ComplianceFramework`] via its
|
||||
/// serde snake_case representation.
|
||||
fn framework_from_str(raw: &str) -> Option<ComplianceFramework> {
|
||||
serde_json::from_value(serde_json::Value::String(raw.to_string())).ok()
|
||||
}
|
||||
|
||||
fn collect_group(
|
||||
group: &Group,
|
||||
framework: ComplianceFramework,
|
||||
source_label: &str,
|
||||
out: &mut Vec<CorpusControl>,
|
||||
) {
|
||||
for control in &group.controls {
|
||||
collect_control(control, framework, source_label, out);
|
||||
}
|
||||
for sub in &group.groups {
|
||||
collect_group(sub, framework, source_label, out);
|
||||
}
|
||||
}
|
||||
|
||||
fn collect_control(
|
||||
control: &Control,
|
||||
framework: ComplianceFramework,
|
||||
source_label: &str,
|
||||
out: &mut Vec<CorpusControl>,
|
||||
) {
|
||||
let source = match control.prop("annex-anchor") {
|
||||
Some(anchor) => Some(format!("{source_label} · {anchor}")),
|
||||
None => Some(source_label.to_string()),
|
||||
};
|
||||
out.push(CorpusControl {
|
||||
id: control.id.clone(),
|
||||
framework,
|
||||
title: control.title.clone(),
|
||||
text: control.statement().unwrap_or_default().to_string(),
|
||||
source,
|
||||
});
|
||||
for enhancement in &control.controls {
|
||||
collect_control(enhancement, framework, source_label, out);
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
const CATALOG: &str = include_str!("../../tests/data/cra_catalog.json");
|
||||
|
||||
fn parse() -> OscalDocument {
|
||||
serde_json::from_str(CATALOG).unwrap()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_full_catalog() {
|
||||
let doc = parse();
|
||||
assert_eq!(doc.catalog.metadata.oscal_version, "1.1.2");
|
||||
assert!(!doc.catalog.groups.is_empty());
|
||||
assert!(doc.catalog.back_matter.is_some());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn maps_all_controls_to_corpus() {
|
||||
let doc = parse();
|
||||
let controls = doc.to_controls();
|
||||
assert_eq!(controls.len(), 40);
|
||||
assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
|
||||
|
||||
let c8 = controls.iter().find(|c| c.id == "cra-ai-8").unwrap();
|
||||
assert_eq!(c8.framework, ComplianceFramework::Cra);
|
||||
assert!(!c8.title.is_empty());
|
||||
assert!(!c8.text.is_empty(), "statement prose should map into text");
|
||||
assert!(c8.source.as_deref().unwrap_or_default().contains("Annex I"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn exposes_content_hash_for_snapshotting() {
|
||||
assert_eq!(parse().content_hash().map(str::len), Some(64));
|
||||
}
|
||||
}
|
||||
@@ -1,424 +0,0 @@
|
||||
//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
|
||||
//!
|
||||
//! The catalog (domain content) comes from the producer; the **assessment** is
|
||||
//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
|
||||
//! standard OSCAL assessment-results document: an observation per linked finding,
|
||||
//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
|
||||
//! records the full catalog set we considered.
|
||||
//!
|
||||
//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
|
||||
//! timestamp. Pure — no DB, no network.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use chrono::{DateTime, Utc};
|
||||
use serde::Serialize;
|
||||
use uuid::Uuid;
|
||||
|
||||
use crate::models::finding::{Finding, FindingStatus};
|
||||
|
||||
const OSCAL_VERSION: &str = "1.1.2";
|
||||
/// Same namespace as the catalog exporter, so ids are stable and correlatable.
|
||||
const NAMESPACE: Uuid = Uuid::from_bytes([
|
||||
0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
|
||||
]);
|
||||
|
||||
fn det_uuid(name: &str) -> String {
|
||||
Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
|
||||
}
|
||||
|
||||
/// Links findings to the catalog control-ids they provide evidence for.
|
||||
pub struct ControlLinker {
|
||||
cwe_to_controls: HashMap<u32, Vec<String>>,
|
||||
}
|
||||
|
||||
impl ControlLinker {
|
||||
/// Build a linker from an explicit CWE → control-id map.
|
||||
pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
|
||||
Self { cwe_to_controls }
|
||||
}
|
||||
|
||||
/// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
|
||||
/// `_CWE_TO_REQ`; extend as scanner coverage grows).
|
||||
pub fn cra_seed() -> Self {
|
||||
let pairs: &[(u32, &str)] = &[
|
||||
(798, "cra-ai-8"),
|
||||
(259, "cra-ai-8"),
|
||||
(1392, "cra-ai-8"),
|
||||
(327, "cra-ai-13"),
|
||||
(326, "cra-ai-13"),
|
||||
(319, "cra-ai-15"),
|
||||
(311, "cra-ai-15"),
|
||||
(89, "cra-ai-20"),
|
||||
(79, "cra-ai-20"),
|
||||
(78, "cra-ai-20"),
|
||||
(22, "cra-ai-20"),
|
||||
];
|
||||
let mut map: HashMap<u32, Vec<String>> = HashMap::new();
|
||||
for (cwe, id) in pairs {
|
||||
map.entry(*cwe).or_default().push((*id).to_string());
|
||||
}
|
||||
Self::new(map)
|
||||
}
|
||||
|
||||
/// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
|
||||
fn parse_cwe(raw: &str) -> Option<u32> {
|
||||
raw.trim_start_matches(|c: char| !c.is_ascii_digit())
|
||||
.split(|c: char| !c.is_ascii_digit())
|
||||
.next()
|
||||
.filter(|s| !s.is_empty())
|
||||
.and_then(|s| s.parse().ok())
|
||||
}
|
||||
|
||||
/// The control-ids a finding provides evidence for (via its CWE).
|
||||
pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
|
||||
finding
|
||||
.cwe
|
||||
.as_deref()
|
||||
.and_then(Self::parse_cwe)
|
||||
.and_then(|cwe| self.cwe_to_controls.get(&cwe))
|
||||
.cloned()
|
||||
.unwrap_or_default()
|
||||
}
|
||||
}
|
||||
|
||||
/// Build a standard OSCAL assessment-results document from `findings`, using each
|
||||
/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
|
||||
/// finding is emitted as an observation — mapped findings additionally produce a
|
||||
/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
|
||||
/// (an observation carrying their CWE/tool/severity, with no control target) so
|
||||
/// nothing is lost. `at` is the assessment timestamp.
|
||||
pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
|
||||
let ts = at.to_rfc3339();
|
||||
|
||||
let mut observations = Vec::new();
|
||||
let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
|
||||
let mut mapped = 0usize;
|
||||
let mut unmapped = 0usize;
|
||||
|
||||
for finding in findings {
|
||||
if finding.status == FindingStatus::FalsePositive {
|
||||
continue; // flagged tool false positive — excluded from the report
|
||||
}
|
||||
let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
|
||||
let location = match (&finding.file_path, finding.line_number) {
|
||||
(Some(f), Some(l)) => Some(format!("{f}:{l}")),
|
||||
(Some(f), None) => Some(f.clone()),
|
||||
_ => None,
|
||||
};
|
||||
let is_mapped = !finding.control_refs.is_empty();
|
||||
if is_mapped {
|
||||
mapped += 1;
|
||||
} else {
|
||||
unmapped += 1;
|
||||
}
|
||||
let mut props = vec![
|
||||
ObsProp::new("tool", &finding.scanner),
|
||||
ObsProp::new("severity", &finding.severity.to_string()),
|
||||
ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
|
||||
];
|
||||
if let Some(cwe) = &finding.cwe {
|
||||
props.push(ObsProp::new("cwe", cwe));
|
||||
}
|
||||
observations.push(Observation {
|
||||
uuid: obs_uuid.clone(),
|
||||
title: finding.title.clone(),
|
||||
description: finding.description.clone(),
|
||||
methods: vec!["TEST".to_string()],
|
||||
collected: ts.clone(),
|
||||
props,
|
||||
relevant_evidence: vec![RelevantEvidence {
|
||||
href: location.map(|l| format!("file://{l}")),
|
||||
description: format!("[{}] {}", finding.scanner, finding.title),
|
||||
}],
|
||||
});
|
||||
for control_id in &finding.control_refs {
|
||||
obs_by_control
|
||||
.entry(control_id.clone())
|
||||
.or_default()
|
||||
.push(obs_uuid.clone());
|
||||
}
|
||||
}
|
||||
|
||||
let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
|
||||
hit_controls.sort();
|
||||
let ar_findings: Vec<ArFinding> = hit_controls
|
||||
.iter()
|
||||
.map(|control_id| ArFinding {
|
||||
uuid: det_uuid(&format!("finding:{control_id}")),
|
||||
title: format!("Findings affect {control_id}"),
|
||||
target: FindingTarget {
|
||||
target_type: "statement-id".to_string(),
|
||||
target_id: format!("{control_id}_smt"),
|
||||
status: TargetStatus {
|
||||
state: "not-satisfied".to_string(),
|
||||
},
|
||||
},
|
||||
related_observations: obs_by_control[*control_id]
|
||||
.iter()
|
||||
.map(|u| RelatedObservation {
|
||||
observation_uuid: u.clone(),
|
||||
})
|
||||
.collect(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
let include_controls: Vec<SelectControlById> = hit_controls
|
||||
.iter()
|
||||
.map(|c| SelectControlById {
|
||||
control_id: (*c).clone(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
let result = ArResult {
|
||||
uuid: det_uuid("result:cra"),
|
||||
title: "Automated code-compliance assessment".to_string(),
|
||||
description: format!(
|
||||
"{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
|
||||
observations.len(),
|
||||
include_controls.len()
|
||||
),
|
||||
start: ts.clone(),
|
||||
reviewed_controls: ReviewedControls {
|
||||
control_selections: vec![ControlSelection { include_controls }],
|
||||
},
|
||||
observations,
|
||||
findings: ar_findings,
|
||||
};
|
||||
|
||||
AssessmentResultsDoc {
|
||||
assessment_results: AssessmentResults {
|
||||
uuid: det_uuid("assessment-results:cra"),
|
||||
metadata: ArMetadata {
|
||||
title: "Compliance scanner — OSCAL assessment results".to_string(),
|
||||
last_modified: ts,
|
||||
version: "1.0.0".to_string(),
|
||||
oscal_version: OSCAL_VERSION.to_string(),
|
||||
},
|
||||
import_ap: ImportAp {
|
||||
href: "#cra-annex-i".to_string(),
|
||||
},
|
||||
results: vec![result],
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// ── OSCAL assessment-results document (serialise) ────────────────────────────
|
||||
|
||||
/// The root OSCAL assessment-results document.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct AssessmentResultsDoc {
|
||||
#[serde(rename = "assessment-results")]
|
||||
pub assessment_results: AssessmentResults,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct AssessmentResults {
|
||||
pub uuid: String,
|
||||
pub metadata: ArMetadata,
|
||||
#[serde(rename = "import-ap")]
|
||||
pub import_ap: ImportAp,
|
||||
pub results: Vec<ArResult>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArMetadata {
|
||||
pub title: String,
|
||||
#[serde(rename = "last-modified")]
|
||||
pub last_modified: String,
|
||||
pub version: String,
|
||||
#[serde(rename = "oscal-version")]
|
||||
pub oscal_version: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ImportAp {
|
||||
pub href: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArResult {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub description: String,
|
||||
pub start: String,
|
||||
#[serde(rename = "reviewed-controls")]
|
||||
pub reviewed_controls: ReviewedControls,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub observations: Vec<Observation>,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub findings: Vec<ArFinding>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ReviewedControls {
|
||||
#[serde(rename = "control-selections")]
|
||||
pub control_selections: Vec<ControlSelection>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ControlSelection {
|
||||
#[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
|
||||
pub include_controls: Vec<SelectControlById>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct SelectControlById {
|
||||
#[serde(rename = "control-id")]
|
||||
pub control_id: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct Observation {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub description: String,
|
||||
pub methods: Vec<String>,
|
||||
pub collected: String,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub props: Vec<ObsProp>,
|
||||
#[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
|
||||
pub relevant_evidence: Vec<RelevantEvidence>,
|
||||
}
|
||||
|
||||
/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
|
||||
/// unmapped finding be reported fully as-is.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ObsProp {
|
||||
pub name: String,
|
||||
pub value: String,
|
||||
}
|
||||
|
||||
impl ObsProp {
|
||||
fn new(name: &str, value: &str) -> Self {
|
||||
Self {
|
||||
name: name.to_string(),
|
||||
value: value.to_string(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct RelevantEvidence {
|
||||
#[serde(skip_serializing_if = "Option::is_none")]
|
||||
pub href: Option<String>,
|
||||
pub description: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArFinding {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub target: FindingTarget,
|
||||
#[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
|
||||
pub related_observations: Vec<RelatedObservation>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct FindingTarget {
|
||||
#[serde(rename = "type")]
|
||||
pub target_type: String,
|
||||
#[serde(rename = "target-id")]
|
||||
pub target_id: String,
|
||||
pub status: TargetStatus,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct TargetStatus {
|
||||
pub state: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct RelatedObservation {
|
||||
#[serde(rename = "observation-uuid")]
|
||||
pub observation_uuid: String,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::models::finding::Severity;
|
||||
use crate::models::scan::ScanType;
|
||||
|
||||
fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
fp.into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"hardcoded credential".into(),
|
||||
"desc".into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.cwe = cwe.map(Into::into);
|
||||
f.file_path = Some("src/auth.rs".into());
|
||||
f.line_number = Some(42);
|
||||
f.control_refs = refs.iter().map(|s| s.to_string()).collect();
|
||||
f
|
||||
}
|
||||
|
||||
fn at() -> DateTime<Utc> {
|
||||
DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
|
||||
.unwrap()
|
||||
.with_timezone(&Utc)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mapped_finding_becomes_control_finding() {
|
||||
let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
|
||||
let r = &doc.assessment_results.results[0];
|
||||
assert_eq!(r.observations.len(), 1);
|
||||
assert_eq!(r.findings.len(), 1);
|
||||
assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
|
||||
assert_eq!(r.findings[0].target.status.state, "not-satisfied");
|
||||
assert_eq!(
|
||||
r.reviewed_controls.control_selections[0]
|
||||
.include_controls
|
||||
.len(),
|
||||
1
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unmapped_finding_is_reported_as_is() {
|
||||
let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
|
||||
let r = &doc.assessment_results.results[0];
|
||||
assert_eq!(r.observations.len(), 1); // still emitted...
|
||||
assert!(r.findings.is_empty()); // ...but no control finding
|
||||
assert!(r.reviewed_controls.control_selections[0]
|
||||
.include_controls
|
||||
.is_empty());
|
||||
let props: Vec<(&str, &str)> = r.observations[0]
|
||||
.props
|
||||
.iter()
|
||||
.map(|p| (p.name.as_str(), p.value.as_str()))
|
||||
.collect();
|
||||
assert!(props.contains(&("mapping", "unmapped")));
|
||||
assert!(props.contains(&("cwe", "CWE-319")));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn false_positive_is_excluded() {
|
||||
let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
|
||||
f.status = FindingStatus::FalsePositive;
|
||||
let doc = assess(&[f], at());
|
||||
assert!(doc.assessment_results.results[0].observations.is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn deterministic_and_valid_oscal() {
|
||||
let mk = || {
|
||||
vec![
|
||||
finding("f1", Some("CWE-798"), &["cra-ai-8"]),
|
||||
finding("f2", Some("CWE-319"), &[]),
|
||||
]
|
||||
};
|
||||
let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
|
||||
let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
|
||||
assert_eq!(a, b);
|
||||
assert!(a.contains("\"oscal-version\":\"1.1.2\""));
|
||||
assert!(a.contains("\"not-satisfied\""));
|
||||
assert!(a.contains("\"mapping\""));
|
||||
}
|
||||
}
|
||||
@@ -349,59 +349,6 @@ pub struct HeartbeatAck {
|
||||
pub cancelled: bool,
|
||||
}
|
||||
|
||||
// --- Runner ↔ control-plane transport (the pull API wire types) ---------------
|
||||
// Shared so the runner (client) and the control plane (server) agree on shapes.
|
||||
|
||||
/// Runner → control plane: lease the oldest runnable job for this runner.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct LeaseRequest {
|
||||
/// The tenant queue to lease from.
|
||||
pub tenant: String,
|
||||
/// The runner id (advertised for attribution).
|
||||
pub runner_id: String,
|
||||
/// The executor this runner provides.
|
||||
pub executor: Executor,
|
||||
/// The capability labels this runner advertises.
|
||||
#[serde(default)]
|
||||
pub labels: Vec<String>,
|
||||
/// Requested lease lifetime (the visibility timeout), in seconds.
|
||||
pub lease_ttl_secs: u64,
|
||||
}
|
||||
|
||||
/// Runner → control plane: prove lease ownership and extend it.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct HeartbeatRequest {
|
||||
/// The tenant queue.
|
||||
pub tenant: String,
|
||||
/// The job being worked.
|
||||
pub job_id: String,
|
||||
/// The lease token from the [`LeasedJob`].
|
||||
pub lease_token: String,
|
||||
/// Lease lifetime to extend to, in seconds.
|
||||
pub lease_ttl_secs: u64,
|
||||
}
|
||||
|
||||
/// Runner → control plane: record a job's terminal result.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct CompleteRequest {
|
||||
/// The tenant queue.
|
||||
pub tenant: String,
|
||||
/// The job being completed.
|
||||
pub job_id: String,
|
||||
/// The lease token proving ownership.
|
||||
pub lease_token: String,
|
||||
/// The result to record.
|
||||
pub result: JobResult,
|
||||
}
|
||||
|
||||
/// Control plane → runner: whether the completion was recorded (false if the
|
||||
/// lease was already lost — token mismatch or the job had become terminal).
|
||||
#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
|
||||
pub struct CompleteResponse {
|
||||
/// Whether the result was recorded.
|
||||
pub recorded: bool,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::expect_used, clippy::unwrap_used)]
|
||||
mod tests {
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -42,19 +42,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
|
||||
|
||||
let pool_for_factory = pool.clone();
|
||||
let service = StreamableHttpService::new(
|
||||
move || {
|
||||
// The factory runs in the request task, still inside the bearer
|
||||
// middleware's `TENANT_ID` scope, and BEFORE rmcp spawns the
|
||||
// session task (which would lose the task_local). So bind the
|
||||
// tenant into the session's server instance here, once.
|
||||
let tenant_id = auth::current_tenant_id().ok_or_else(|| {
|
||||
std::io::Error::other("no tenant context when creating MCP session")
|
||||
})?;
|
||||
Ok(ComplianceMcpServer::new(
|
||||
pool_for_factory.clone(),
|
||||
tenant_id,
|
||||
))
|
||||
},
|
||||
move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
|
||||
Arc::new(LocalSessionManager::default()),
|
||||
StreamableHttpServerConfig::default(),
|
||||
);
|
||||
@@ -81,11 +69,16 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
|
||||
tenant_id = %synth_tenant,
|
||||
"stdio transport — using synthetic tenant id; DO NOT use in production"
|
||||
);
|
||||
let server = ComplianceMcpServer::new(pool, synth_tenant);
|
||||
let server = ComplianceMcpServer::new(pool);
|
||||
let transport = rmcp::transport::stdio();
|
||||
use rmcp::ServiceExt;
|
||||
let handle = server.serve(transport).await?;
|
||||
handle.waiting().await?;
|
||||
auth::TENANT_ID
|
||||
.scope(synth_tenant, async {
|
||||
let handle = server.serve(transport).await?;
|
||||
handle.waiting().await?;
|
||||
Ok::<_, Box<dyn std::error::Error>>(())
|
||||
})
|
||||
.await?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
|
||||
@@ -2,33 +2,37 @@ use rmcp::{
|
||||
handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
|
||||
};
|
||||
|
||||
use crate::auth::current_tenant_id;
|
||||
use crate::database::{Database, DatabasePool};
|
||||
use crate::tools::{dast, findings, oscal, pentest, sbom};
|
||||
use crate::tools::{dast, findings, pentest, sbom};
|
||||
|
||||
pub struct ComplianceMcpServer {
|
||||
pool: DatabasePool,
|
||||
/// Tenant this session serves. Bound once at session creation (the HTTP
|
||||
/// factory reads the bearer-set tenant while still in the request scope;
|
||||
/// stdio passes a synthetic id) — NOT a per-request `task_local`, which is
|
||||
/// lost across the `tokio::spawn` that runs the Streamable-HTTP session.
|
||||
tenant_id: String,
|
||||
#[allow(dead_code)]
|
||||
tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
|
||||
}
|
||||
|
||||
impl ComplianceMcpServer {
|
||||
/// The per-tenant `Database` for this session.
|
||||
/// Resolve the per-tenant `Database` from the bearer-set
|
||||
/// `task_local`. Every tool handler calls this; missing context
|
||||
/// surfaces as `internal_error` because it means the auth
|
||||
/// middleware was misconfigured (handler ran without scope).
|
||||
fn tenant_db(&self) -> Result<Database, rmcp::ErrorData> {
|
||||
Ok(self.pool.for_tenant_id(&self.tenant_id))
|
||||
let tenant_id = current_tenant_id().ok_or_else(|| {
|
||||
rmcp::ErrorData::internal_error(
|
||||
"no tenant context — bearer middleware not in chain".to_string(),
|
||||
None,
|
||||
)
|
||||
})?;
|
||||
Ok(self.pool.for_tenant_id(&tenant_id))
|
||||
}
|
||||
}
|
||||
|
||||
#[tool_router]
|
||||
impl ComplianceMcpServer {
|
||||
pub fn new(pool: DatabasePool, tenant_id: String) -> Self {
|
||||
pub fn new(pool: DatabasePool) -> Self {
|
||||
Self {
|
||||
pool,
|
||||
tenant_id,
|
||||
tool_router: Self::tool_router(),
|
||||
}
|
||||
}
|
||||
@@ -64,17 +68,6 @@ impl ComplianceMcpServer {
|
||||
findings::findings_summary(&db, params).await
|
||||
}
|
||||
|
||||
#[tool(
|
||||
description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
|
||||
)]
|
||||
async fn oscal_assessment(
|
||||
&self,
|
||||
Parameters(params): Parameters<oscal::OscalAssessmentParams>,
|
||||
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||
let db = self.tenant_db()?;
|
||||
oscal::oscal_assessment(&db, params).await
|
||||
}
|
||||
|
||||
// ── SBOM ──────────────────────────────────────────────
|
||||
|
||||
#[tool(
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
pub mod dast;
|
||||
pub mod findings;
|
||||
pub mod oscal;
|
||||
pub mod pentest;
|
||||
pub mod sbom;
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
//! OSCAL assessment MCP tool.
|
||||
//!
|
||||
//! Emits a standard OSCAL assessment-results document for a repo's findings —
|
||||
//! what breakpilot's scanner MCP client pulls. Mapped findings target their
|
||||
//! compliance controls (via the stamped `control_refs`); unmapped findings are
|
||||
//! reported as-is, so nothing is lost.
|
||||
|
||||
use mongodb::bson::doc;
|
||||
use rmcp::{model::*, ErrorData as McpError};
|
||||
use schemars::JsonSchema;
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::models::oscal_assessment::assess;
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use crate::database::Database;
|
||||
|
||||
#[derive(Debug, Deserialize, JsonSchema)]
|
||||
pub struct OscalAssessmentParams {
|
||||
/// Repository / target id to assess.
|
||||
pub repo_id: String,
|
||||
}
|
||||
|
||||
pub async fn oscal_assessment(
|
||||
db: &Database,
|
||||
params: OscalAssessmentParams,
|
||||
) -> Result<CallToolResult, McpError> {
|
||||
let mut cursor = db
|
||||
.findings()
|
||||
.find(doc! { "repo_id": ¶ms.repo_id })
|
||||
.await
|
||||
.map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
|
||||
|
||||
let mut findings: Vec<Finding> = Vec::new();
|
||||
while cursor
|
||||
.advance()
|
||||
.await
|
||||
.map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
|
||||
{
|
||||
findings.push(
|
||||
cursor
|
||||
.deserialize_current()
|
||||
.map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
|
||||
);
|
||||
}
|
||||
|
||||
let document = assess(&findings, chrono::Utc::now());
|
||||
let json = serde_json::to_string_pretty(&document)
|
||||
.map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
|
||||
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
[package]
|
||||
name = "control-map"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
serde = { workspace = true }
|
||||
serde_json = { workspace = true }
|
||||
thiserror = { workspace = true }
|
||||
@@ -1,496 +0,0 @@
|
||||
{
|
||||
"version": "1.0",
|
||||
"framework": "cra",
|
||||
"controls": [
|
||||
{
|
||||
"control": "cra-ai-1",
|
||||
"title": "Secure-by-Default-Konfiguration",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-1-flask-debug-enabled",
|
||||
"cra-ai-1-django-debug-true",
|
||||
"cra-ai-1-tls-verify-disabled",
|
||||
"cra-ai-1-cors-wildcard"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-2",
|
||||
"title": "Minimale Angriffsflaeche",
|
||||
"scans": [],
|
||||
"note": "design property (minimal attack surface) — not derivable from local code patterns; architecture/threat-model review",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-3",
|
||||
"title": "Sichere Systemarchitektur",
|
||||
"scans": [],
|
||||
"note": "design property (secure system architecture) — architecture review, not statically code-checkable",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-4",
|
||||
"title": "Least-Privilege-Prinzip",
|
||||
"scans": [],
|
||||
"note": "design property (least-privilege) — deployment/IAM & architecture review, not a local code pattern",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-5",
|
||||
"title": "Manipulationsschutz",
|
||||
"scans": [],
|
||||
"note": "design property (tamper protection) — hardware/runtime & operational control, not statically code-checkable",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-6",
|
||||
"title": "Integritaetspruefung",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-7",
|
||||
"title": "Starke Authentifizierung",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-7-weak-password-hash"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-8",
|
||||
"title": "Keine Default-Passwoerter",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-259"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-9",
|
||||
"title": "Sicheres Credential-Management",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-522"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-10",
|
||||
"title": "Sitzungsmanagement",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-10-session-cookie-insecure",
|
||||
"cra-ai-10-express-cookie-insecure"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-11",
|
||||
"title": "Brute-Force-Schutz",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-12",
|
||||
"title": "Rollenbasierte Autorisierung",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-13",
|
||||
"title": "Verschluesselung sensibler Daten",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-327",
|
||||
"CWE-326"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-14",
|
||||
"title": "Speicher-Schutz (Data at Rest)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [],
|
||||
"rules": [
|
||||
"cra-ai-14-python-weak-cipher",
|
||||
"cra-ai-14-node-weak-cipher"
|
||||
]
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-15",
|
||||
"title": "Transport-Schutz (Data in Transit)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-319",
|
||||
"CWE-311"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-16",
|
||||
"title": "Sicheres Schluesselmanagement",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-321"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-17",
|
||||
"title": "Datenminimierung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-18",
|
||||
"title": "Strukturierter SSDLC",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-19",
|
||||
"title": "Systematische Code Reviews",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-20",
|
||||
"title": "Automatisierte Sicherheitstests",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-89",
|
||||
"CWE-78",
|
||||
"CWE-79",
|
||||
"CWE-22"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-21",
|
||||
"title": "Supply-Chain-Security",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-22",
|
||||
"title": "Dependency-Monitoring",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "osv",
|
||||
"scan_type": "cve",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-23",
|
||||
"title": "Software Bill of Materials (SBOM)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-24",
|
||||
"title": "Security-Logging",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-25",
|
||||
"title": "Ereignis-Monitoring",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-26",
|
||||
"title": "Anomalie-Erkennung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-27",
|
||||
"title": "Log-Integritaet und -Aufbewahrung",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-28",
|
||||
"title": "Sichere Update-Mechanismen",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-29",
|
||||
"title": "Update-Authentizitaet",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-30",
|
||||
"title": "Update-Integritaet",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "grounded-control-check",
|
||||
"scan_type": "code_review",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": "covered by the grounded surface check (retrieve code surface + grounded LLM judge decides presence/absence); validated live",
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-31",
|
||||
"title": "Lifecycle-Support",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-32",
|
||||
"title": "Schwachstellen-Identifikation",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-33",
|
||||
"title": "SBOM-Pflege und Analyse",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "osv",
|
||||
"scan_type": "cve",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-34",
|
||||
"title": "Risikobasierte Priorisierung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-35",
|
||||
"title": "Coordinated Vulnerability Disclosure",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-36",
|
||||
"title": "Incident-Response-Prozess",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-37",
|
||||
"title": "Fruehwarnung (24h)",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-38",
|
||||
"title": "Detaillierter Vorfallsbericht (72h)",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-39",
|
||||
"title": "Patch-Bereitstellung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-40",
|
||||
"title": "Dokumentation und Nachbereitung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,254 +0,0 @@
|
||||
//! `control-map` — the deterministic control → scan lookup table (LUT).
|
||||
//!
|
||||
//! The "transcribing" layer: it maps each compliance control to the static-scan
|
||||
//! step(s) that check it, or marks it as needing custom tooling, or as not
|
||||
//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
|
||||
//! decides coverage. The LLM only enters later, downstream, to triage/ground the
|
||||
//! *tool's* findings (that lives in the agent, not here).
|
||||
//!
|
||||
//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
|
||||
//! + query helpers.
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
/// Coverage bucket for a control under static (SAST-family) scanning.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub enum Coverage {
|
||||
/// An existing tool's scan surfaces findings for this control.
|
||||
Covered,
|
||||
/// Code-checkable, but no existing tool digs it out — we must write tooling.
|
||||
NeedsTooling,
|
||||
/// Process / document control — out of static-scan scope.
|
||||
NotCodeCheckable,
|
||||
}
|
||||
|
||||
/// One tool binding: a scan step that (at least partially) checks a control.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ScanBinding {
|
||||
/// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
|
||||
pub tool: String,
|
||||
/// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
|
||||
pub scan_type: String,
|
||||
/// CWEs whose findings map to this control (used to attach findings back).
|
||||
#[serde(default)]
|
||||
pub cwe: Vec<String>,
|
||||
/// Optional specific rule ids this control keys on.
|
||||
#[serde(default)]
|
||||
pub rules: Vec<String>,
|
||||
}
|
||||
|
||||
/// One control's entry in the LUT.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlEntry {
|
||||
/// Control id, e.g. `"cra-ai-8"`.
|
||||
pub control: String,
|
||||
/// Human-readable title (for the reviewable view).
|
||||
#[serde(default)]
|
||||
pub title: String,
|
||||
/// Coverage bucket.
|
||||
pub status: Coverage,
|
||||
/// Tool bindings (empty unless `status == Covered`).
|
||||
#[serde(default)]
|
||||
pub scans: Vec<ScanBinding>,
|
||||
/// Reviewer note — why it needs tooling / isn't code-checkable.
|
||||
#[serde(default)]
|
||||
pub note: Option<String>,
|
||||
}
|
||||
|
||||
/// The control → scan lookup table for one framework.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlMap {
|
||||
pub version: String,
|
||||
pub framework: String,
|
||||
pub controls: Vec<ControlEntry>,
|
||||
}
|
||||
|
||||
const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
|
||||
|
||||
/// Whether an authored rule id `bound` matches a scanner's emitted rule id
|
||||
/// `actual`. semgrep prefixes local-rule check_ids with a path
|
||||
/// (`tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled`), so match the final
|
||||
/// id segment rather than requiring exact equality.
|
||||
fn rule_id_matches(bound: &str, actual: &str) -> bool {
|
||||
actual == bound || actual.ends_with(&format!(".{bound}"))
|
||||
}
|
||||
|
||||
impl ControlMap {
|
||||
/// Load the built-in CRA control map (the embedded, authored LUT).
|
||||
pub fn cra() -> Result<Self, MapError> {
|
||||
Ok(serde_json::from_str(CRA_MAP_JSON)?)
|
||||
}
|
||||
|
||||
/// The coverage entry for a control id, if present.
|
||||
pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
|
||||
self.controls.iter().find(|c| c.control == control_id)
|
||||
}
|
||||
|
||||
/// Controls whose bindings include the given `tool` + `cwe` — used to attach a
|
||||
/// raw tool finding back to the control(s) it's evidence for.
|
||||
pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
|
||||
self.controls_for_finding(tool, Some(cwe), None)
|
||||
}
|
||||
|
||||
/// Controls a tool finding is evidence for, matched by CWE and/or the specific
|
||||
/// rule id that fired. Off-the-shelf findings bind by CWE; our custom detectors
|
||||
/// bind by rule id (precise — a broad CWE would over-attribute and then the
|
||||
/// grounded judge could drop a genuine finding as a control false positive).
|
||||
pub fn controls_for_finding(
|
||||
&self,
|
||||
tool: &str,
|
||||
cwe: Option<&str>,
|
||||
rule_id: Option<&str>,
|
||||
) -> Vec<&ControlEntry> {
|
||||
self.controls
|
||||
.iter()
|
||||
.filter(|c| {
|
||||
c.scans.iter().any(|s| {
|
||||
s.tool == tool
|
||||
&& (cwe.is_some_and(|w| s.cwe.iter().any(|x| x == w))
|
||||
|| rule_id
|
||||
.is_some_and(|r| s.rules.iter().any(|b| rule_id_matches(b, r))))
|
||||
})
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Count of controls in each coverage bucket.
|
||||
pub fn summary(&self) -> CoverageSummary {
|
||||
let mut s = CoverageSummary::default();
|
||||
for c in &self.controls {
|
||||
match c.status {
|
||||
Coverage::Covered => s.covered += 1,
|
||||
Coverage::NeedsTooling => s.needs_tooling += 1,
|
||||
Coverage::NotCodeCheckable => s.not_code_checkable += 1,
|
||||
}
|
||||
}
|
||||
s
|
||||
}
|
||||
}
|
||||
|
||||
/// Coverage bucket counts.
|
||||
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
|
||||
pub struct CoverageSummary {
|
||||
pub covered: usize,
|
||||
pub needs_tooling: usize,
|
||||
pub not_code_checkable: usize,
|
||||
}
|
||||
|
||||
impl CoverageSummary {
|
||||
pub fn total(&self) -> usize {
|
||||
self.covered + self.needs_tooling + self.not_code_checkable
|
||||
}
|
||||
}
|
||||
|
||||
/// Errors loading a control map.
|
||||
#[derive(Debug, thiserror::Error)]
|
||||
pub enum MapError {
|
||||
#[error("failed to parse control map: {0}")]
|
||||
Parse(#[from] serde_json::Error),
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn cra_map_loads_all_40_controls() {
|
||||
let map = ControlMap::cra().expect("CRA map should parse");
|
||||
assert_eq!(map.framework, "cra");
|
||||
assert_eq!(map.controls.len(), 40);
|
||||
assert_eq!(map.summary().total(), 40);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn hardcoded_password_control_is_tool_covered() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
|
||||
assert_eq!(c.status, Coverage::Covered);
|
||||
assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
|
||||
assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn finding_attaches_back_to_control_via_tool_and_cwe() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
let hits = map.controls_for("semgrep", "CWE-798");
|
||||
assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn covered_and_not_checkable_are_populated() {
|
||||
let s = ControlMap::cra().unwrap().summary();
|
||||
assert!(s.covered > 0);
|
||||
assert!(s.not_code_checkable > 0);
|
||||
// needs_tooling is now empty: every code-checkable control is either
|
||||
// tool-covered or covered by the grounded surface pass.
|
||||
assert_eq!(s.needs_tooling, 0);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rule_id_matching_handles_semgrep_path_prefix() {
|
||||
let bound = "cra-ai-1-flask-debug-enabled";
|
||||
assert!(rule_id_matches(bound, bound)); // exact
|
||||
assert!(rule_id_matches(
|
||||
bound,
|
||||
"tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled"
|
||||
)); // semgrep path prefix
|
||||
assert!(!rule_id_matches(
|
||||
bound,
|
||||
"cra-ai-1-flask-debug-enabled-extra"
|
||||
)); // not a suffix segment
|
||||
assert!(!rule_id_matches(
|
||||
bound,
|
||||
"python.lang.security.exec-detected"
|
||||
)); // unrelated
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn custom_rule_finding_attaches_to_control_by_rule_id() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
// cra-ai-1 is now tool-covered by custom rules.
|
||||
assert_eq!(map.coverage("cra-ai-1").unwrap().status, Coverage::Covered);
|
||||
// A prefixed check_id still maps back to cra-ai-1 by rule id.
|
||||
let hits =
|
||||
map.controls_for_finding("semgrep", None, Some("tmp.x.cra-ai-1-tls-verify-disabled"));
|
||||
assert!(hits.iter().any(|c| c.control == "cra-ai-1"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn coverage_after_grounded_promotion() {
|
||||
let s = ControlMap::cra().unwrap().summary();
|
||||
// 9 off-the-shelf + 4 custom-semgrep + 8 grounded surface controls (promoted
|
||||
// after the grounded path was validated live).
|
||||
assert_eq!(s.covered, 21);
|
||||
// Nothing left as needs_tooling — every code-checkable control is covered.
|
||||
assert_eq!(s.needs_tooling, 0);
|
||||
// The 4 pure-architectural controls remain not code-checkable.
|
||||
assert_eq!(s.not_code_checkable, 19);
|
||||
assert_eq!(s.total(), 40);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn architectural_controls_are_not_code_checkable() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
for id in ["cra-ai-2", "cra-ai-3", "cra-ai-4", "cra-ai-5"] {
|
||||
let c = map.coverage(id).unwrap();
|
||||
assert_eq!(c.status, Coverage::NotCodeCheckable, "{id}");
|
||||
assert!(c.scans.is_empty(), "{id} should carry no scan bindings");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn custom_rule_controls_do_not_bind_by_broad_cwe() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
// cra-ai-1 rules emit CWE-489 in metadata, but the LUT binds by rule id
|
||||
// only (cwe: []) — so a stray CWE-489 finding must NOT attach to it.
|
||||
assert!(map.controls_for("semgrep", "CWE-489").is_empty());
|
||||
// The CWE path for off-the-shelf findings is unchanged.
|
||||
assert!(map
|
||||
.controls_for("semgrep", "CWE-798")
|
||||
.iter()
|
||||
.any(|c| c.control == "cra-ai-8"));
|
||||
}
|
||||
}
|
||||
@@ -36,7 +36,6 @@ export default withMermaid(defineConfig({
|
||||
{ text: 'Pentest Architecture', link: '/features/pentest-architecture' },
|
||||
{ text: 'AI Chat', link: '/features/ai-chat' },
|
||||
{ text: 'Code Knowledge Graph', link: '/features/graph' },
|
||||
{ text: 'Compliance Control Mapping', link: '/features/control-mapping' },
|
||||
{ text: 'MCP Integration', link: '/features/mcp-server' },
|
||||
],
|
||||
},
|
||||
|
||||
@@ -1,136 +0,0 @@
|
||||
# Compliance Control Mapping
|
||||
|
||||
Control mapping connects the scanner's raw output — deterministic tool findings and the code itself — to the **compliance controls** each piece of evidence supports. A hardcoded credential stops being just "CWE-798 from semgrep" and becomes evidence for *"cra-ai-8: no default passwords"* and, at scale, master control *`mc-31761` hardcoded_secrets_detection*. Findings carry those references (`control_refs`) into the dashboard and out over the MCP server as OSCAL, so the compliance report is built from real, grounded findings rather than a questionnaire.
|
||||
|
||||
## The core principle: tools detect, the LLM judges
|
||||
|
||||
The design has one rule, borrowed from the ZeroFalse / IRIS line of research: **deterministic tools are the detectors; the LLM is only ever a grounded false-positive filter, never the thing that finds the issue.**
|
||||
|
||||
- A tool (semgrep, gitleaks, syft/osv, the PLC linter; the DAST agents today, with **Nuclei and ZAP planned** as deterministic web/OT detectors underneath them — see [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code)) detects.
|
||||
- An **authored, human-reviewed lookup table** (`control-map`) maps that detection to the control(s) it's evidence for.
|
||||
- The LLM enters last, to *confirm or refute* the mapping against the actual code — and every surviving verdict is anchored to a verbatim snippet by the grounding gate.
|
||||
|
||||
This keeps hallucination out of detection. The LLM supplies cross-language, cross-stack pattern *recognition*; the surrounding machinery supplies determinism.
|
||||
|
||||
## Coverage model
|
||||
|
||||
Every control lands in one of three buckets, recorded in the `control-map` LUT (`control-map/data/cra_control_map.json`) and never decided by an LLM:
|
||||
|
||||
| Bucket | Meaning |
|
||||
| --- | --- |
|
||||
| `covered` | An existing tool's scan surfaces findings for this control |
|
||||
| `needs_tooling` | Code-checkable, but no off-the-shelf tool digs it out — we author a detector or use the grounded surface check |
|
||||
| `not_code_checkable` | A design/process property — out of static-scan scope |
|
||||
|
||||
For the **CRA** framework (40 controls) the split is **13 covered · 8 needs_tooling · 19 not_code_checkable**. The 16 originally-uncovered controls were resolved as a hybrid:
|
||||
|
||||
- **4 custom semgrep detectors** (`cra-ai-1`, `7`, `10`, `14`) — secure-by-default, weak password hashing, insecure session cookies, weak data-at-rest ciphers. Shipped in the binary and matched back to controls **by rule id** so a broad CWE can't over-attribute.
|
||||
- **8 grounded surface checks** (`cra-ai-6`, `11`, `12`, `24`, `27`, `28`, `29`, `30`) — the absence-based controls (no rate limiting, no security logging, no update-signature check…) that have no syntactic pattern.
|
||||
- **4 marked not_code_checkable** (`cra-ai-2`, `3`, `4`, `5`) — minimal attack surface, secure architecture, least privilege, tamper protection.
|
||||
|
||||
At scale, the **master-controls** corpus (breakpilot's deduped clusters, exported as OSCAL) currently provides **~2,882 code-checkable controls** (2,143 `network` + 739 `source_code`), matched semantically.
|
||||
|
||||
## The three mapping paths
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
T[Deterministic tools\nsemgrep · gitleaks · syft/osv · DAST · PLC linter] --> F[Findings]
|
||||
F --> B["Stage 5b — LUT triage\ncontrols_for(tool, cwe / rule_id)"]
|
||||
F --> C["Stage 5c — Semantic\nembed region+intent → top-K master controls"]
|
||||
R[Repo source] --> D["Stage 5d — Grounded surface\nretrieve surface for absence-based controls"]
|
||||
B --> J{{Grounded LLM judge\ntemp 0 · verbatim snippet}}
|
||||
C --> J
|
||||
D --> J
|
||||
J -->|snippet grounds in region| S[Stamp control_refs]
|
||||
J -->|refuted / ungrounded| X[Dropped]
|
||||
```
|
||||
|
||||
All three paths converge on the same **grounded judge** and the same **grounding gate**. They differ only in how candidate (finding/region, control) pairs are produced.
|
||||
|
||||
### Stage 5b — deterministic LUT triage
|
||||
|
||||
The default path. A tool finding is matched to controls via `control_map.controls_for_finding(tool, cwe, rule_id)`; the judge then confirms each mapped control against the code region. Outcomes: `Confirmed([ids])` (stamp them), `FalsePositive` (drop the finding), or `Unmapped` (keep it untagged). Runs whenever `BREAKPILOT_BASE_URL` is set.
|
||||
|
||||
### Stage 5c — semantic retrieval (master-controls scale)
|
||||
|
||||
Master controls carry no CWE, so they can't be LUT-mapped. Instead we map by *similarity*: embed every control's requirement text once (cached), then for each finding retrieve the top-K nearest controls and hand them to the judge. Gated behind `BREAKPILOT_SEMANTIC_MAPPING` (default off). See [Semantic retrieval](#semantic-retrieval-in-detail).
|
||||
|
||||
### Stage 5d — grounded surface checks (absence-based controls)
|
||||
|
||||
Some controls are violated by an *absence* — no rate limiting on login, no security logging, no signature check on an update. There's no pattern for semgrep to match, so we deterministically retrieve the code **surface** the control governs (a login route, a logging setup, update/download code) by identifier/route terms, and let the judge decide whether the control holds there. Produces net-new, already-grounded findings. Gated behind `BREAKPILOT_GROUNDED_CHECKS` (default off).
|
||||
|
||||
## The grounding gate
|
||||
|
||||
No matter the path, a verdict becomes a finding only if it survives `compliance_core::control_check::ground`:
|
||||
|
||||
1. The judge runs at **temperature 0** with a closed prompt and must quote the offending code **verbatim** into `snippet`.
|
||||
2. That snippet must appear **literally** in the retrieved region — otherwise the verdict is dropped.
|
||||
3. The finding's line is **recomputed from the match**; the model's own line number is never trusted.
|
||||
4. Verdicts are cached by content hash, so re-scans reproduce.
|
||||
|
||||
The model is allowed to be smart; it is never trusted.
|
||||
|
||||
## Semantic retrieval in detail
|
||||
|
||||
1. **Embed the corpus once.** Each control's requirement text is embedded with `bge-multilingual-gemma2` (3584-dim — multilingual matters, the master controls are in German while code is English). The embedding backend caps input arrays at 25 per request, so `embed()` chunks at 16; the whole `ControlIndex` is persisted to `snapshot_dir` keyed by a **corpus hash**, so only the first scan after a catalog change pays the embedding cost.
|
||||
2. **Build the query from the finding's intent, not just the code.** The retrieval query is `finding.title + finding.description + region`, not the raw region. This is the single most important tuning: two findings in one file share overlapping windows and, on the code alone, embed alike and collapse onto the same controls. The finding's own words ("brute-force protection" vs "weak hash") carry the discriminating signal. The raw region still goes to the judge for grounding.
|
||||
3. **Retrieve → judge → ground.** Top-K nearest by cosine, each judged against the region, each grounded.
|
||||
|
||||
## Worked examples
|
||||
|
||||
Both examples are from the live end-to-end verification (`c5_semantic_live.rs`) against the real ~2,882-control corpus.
|
||||
|
||||
### Example 1 — a small auth file (the tuning story)
|
||||
|
||||
Two findings in one `auth.py`: a weak `hashlib.md5(password)` hash and a login endpoint with no brute-force protection.
|
||||
|
||||
| Finding | Region-only retrieval | Intent-enriched retrieval |
|
||||
| --- | --- | --- |
|
||||
| Weak md5 hash | 19874, 20683, 23149, 29985 | **`mc-23149`** (eliminate weak unsalted hashes) at rank 1, + `mc-21634` salted hashing |
|
||||
| Login w/o brute-force protection | *identical 4, reordered* | newly surfaces **`mc-19984`** brute_force_protection + **`mc-23186`** account_lockout |
|
||||
|
||||
Region-only retrieval gave both findings the *same* four password-hashing controls — the brute-force finding never found its real controls because its window is saturated with `password` tokens. Enriching the query with the finding's intent fixed it: the brute-force finding now pulls the correct rate-limiting / lockout controls out of the 2,882.
|
||||
|
||||
### Example 2 — four topically distinct vulnerabilities
|
||||
|
||||
| Finding | Top matched controls | Family |
|
||||
| --- | --- | --- |
|
||||
| SQL injection (string-concat query) | `sql_injection_prevention`, `sql_injection`, `parameterized_queries`, input_sanitization | input-validation ✓ |
|
||||
| Hardcoded API credential | `hardcoded_secrets_detection`, credential_scanning, secrets_detection | credentials ✓ |
|
||||
| TLS verification disabled (`verify=False`) | `https_enforcement`, `configuration_verification`, transport config | transport-encryption ✓ |
|
||||
| Insecure deserialization (`pickle.loads`) | `deserialization`, `deserialization_testing`, `deserialization_security` | deserialization ✓ |
|
||||
|
||||
Every finding maps to its exact control family, with the most specific control often at the top, and the four sets are distinct.
|
||||
|
||||
## Known limitations
|
||||
|
||||
- **Absence findings are weak for semantic retrieval.** Similarity matches what code *is about*, not what it *lacks*; a "missing rate limiting" finding embeds like login code. This is exactly why the grounded surface path (Stage 5d) exists — it decides presence/absence at a retrieved surface rather than by embedding distance.
|
||||
- **Generic catch-all controls co-occur.** `mc-20890 secure_development_security_code_review` appears in the top-K for many code-security findings because it is semantically near almost all of them. It's harmless (the judge grounds it, and it never crowds out the specific controls — the SQLi example didn't get it) but is a candidate for future down-weighting.
|
||||
- **Corpus classification noise.** The master-controls `verification_method` classification is imperfect — e.g. a documentation control (`eu_declaration_accuracy`) is currently tagged `source_code`. That's a corpus-side data-quality issue, separate from the mapping engine.
|
||||
|
||||
## Emitting over MCP — closing the loop
|
||||
|
||||
Findings don't just land in the dashboard; they flow to breakpilot-compliance as OSCAL over the scanner's MCP server, so the compliance report is assembled from real, control-tagged findings.
|
||||
|
||||
- The MCP server exposes an **`oscal_assessment`** tool: given a `repo_id`, it emits a standard OSCAL 1.1 assessment-results document for that repo's findings — mapped findings target their controls via the stamped `control_refs`, and unmapped findings are reported **as-is** (as observations), so nothing is lost.
|
||||
- breakpilot pulls it: `POST /v1/cra/oscal-from-scanner` calls `oscal_assessment` over MCP (Streamable HTTP + bearer) and consumes the pre-computed OSCAL — rather than pulling raw findings and re-assessing.
|
||||
|
||||
**Operational note — tenant context over HTTP.** The MCP server is multi-tenant; the bearer token resolves a tenant whose per-tenant database the tools query. rmcp's Streamable HTTP transport runs each session's tool calls in a `tokio::spawn`ed task, and `task_local`s do **not** cross a spawn — so binding the tenant in a per-request middleware `task_local` leaves tool handlers with no context (every call fails `no tenant context`). The fix is to bind the tenant to the **per-session server instance** at creation (the factory runs in the request scope before the spawn), not to a per-request task_local. Until this was fixed, the loop silently failed over HTTP and consumers fell back to demo data.
|
||||
|
||||
## Configuration
|
||||
|
||||
| Variable | Effect |
|
||||
| --- | --- |
|
||||
| `BREAKPILOT_BASE_URL` | breakpilot-compliance root; enables control ingest + all mapping passes. **Unset disables all control mapping** — findings are produced without `control_refs`. |
|
||||
| `BREAKPILOT_SEMANTIC_MAPPING` | Stage 5c (semantic master-controls mapping). **Default on** (validated live). |
|
||||
| `BREAKPILOT_GROUNDED_CHECKS` | Stage 5d (grounded surface checks). **Default on** (validated live). |
|
||||
| `BREAKPILOT_SNAPSHOT_DIR` | Where OSCAL catalog snapshots and the cached control-embedding index live. |
|
||||
|
||||
The semantic and grounded passes default **on** now that both are validated live; each is still a no-op if `BREAKPILOT_BASE_URL` is unset or the catalog is unreachable, so they only ever add coverage. The live verifications live in `compliance-agent/tests/c5_semantic_live.rs` and `grounded_surface_live.rs` (ignored; run with `--ignored`).
|
||||
|
||||
## Appendix — the master-controls data pipeline
|
||||
|
||||
The master-controls corpus is produced by breakpilot-compliance and pulled as an OSCAL catalog from `GET /api/compliance/v1/oscal/catalog?framework=master-controls`. Two operational lessons are worth recording, because they cost real time to diagnose:
|
||||
|
||||
- **The catalog is served from `breakpilot_db`, not `postgres`.** Diagnostics run against the wrong database will look clean while the app serves something else entirely. Confirm the app's datname (`pg_stat_activity`) before trusting any count or `EXPLAIN`.
|
||||
- **A constraint-less dump triplicated the master-control tables.** Restored without their PK/unique constraints, `master_controls` / `mc_verification` / `master_control_members` accumulated identical rows 3× (the same artifact migration `158` fixed for `doc_check_controls`). That inflated the catalog to ~26k dup'd controls and, with the indexes also missing, drove the export query to a >120s / 502. The fix (breakpilot migration `160`) ctid-dedups each table by its natural key and restores the constraints + indexes so it can't recur; the export query was also rewritten set-based (a single windowed pass instead of a per-row correlated subquery). After dedup: 41,850 → 13,950 master controls, catalog **25,938 → 2,882** code-checkable, endpoint **502 → 200 in ~3s**.
|
||||
@@ -92,7 +92,3 @@ Filters can be combined. A count indicator shows how many findings match the cur
|
||||
::: tip
|
||||
Findings marked as **Confirmed** exploitable were verified with a successful attack payload. **Unconfirmed** findings show suspicious behavior that may indicate a vulnerability but could not be fully exploited.
|
||||
:::
|
||||
|
||||
## Deterministic detectors (planned)
|
||||
|
||||
The DAST engine above is agentic: an LLM drives crawler, browser and testing tools and decides what to try next. That gives depth and code-aware exploitation, but not run-to-run reproducibility. The next step (decided 2026-08-31, not yet implemented) adds two deterministic open-source detectors **under** the agents: **Nuclei** (template checks incl. ICS/OT and default-credential templates) first, then an **OWASP ZAP** baseline scan. Their findings will appear alongside agent findings, carry CWE + compliance `control_refs`, and seed the agent's context so it verifies and chains instead of rediscovering. See [Tools & Scanners](/reference/tools#planned-integrations-decided-2026-08-31-not-yet-in-the-code).
|
||||
@@ -26,7 +26,7 @@ Filters can be combined. Results are paginated with 20 findings per page.
|
||||
| Severity | Color-coded badge: Critical (red), High (orange), Medium (yellow), Low (green), Info (blue) |
|
||||
| Title | Short description of the vulnerability (clickable) |
|
||||
| Type | SAST, SBOM, CVE, GDPR, OAuth, Secrets, or Code Review |
|
||||
| Scanner | Tool that found the issue (e.g. Semgrep, Syft/OSV) |
|
||||
| Scanner | Tool that found the issue (e.g. Semgrep, Grype) |
|
||||
| File | Source file path where the issue was found |
|
||||
| Status | Current triage status |
|
||||
|
||||
@@ -73,7 +73,7 @@ If the finding has been pushed to an issue tracker (GitHub, GitLab, Gitea, Jira)
|
||||
| Type | Source | Description |
|
||||
|------|--------|-------------|
|
||||
| **SAST** | Semgrep | Code-level vulnerabilities found through static analysis |
|
||||
| **SBOM** | Syft + OSV.dev/NVD | Vulnerable dependencies identified in your software bill of materials |
|
||||
| **SBOM** | Syft + Grype | Vulnerable dependencies identified in your software bill of materials |
|
||||
| **CVE** | NVD | Known CVEs matching your dependency versions |
|
||||
| **GDPR** | Custom rules | Personal data handling and consent issues |
|
||||
| **OAuth** | Custom rules | OAuth/OIDC misconfigurations and insecure token handling |
|
||||
|
||||
+1
-1
@@ -6,7 +6,7 @@ The SBOM (Software Bill of Materials) feature provides a complete inventory of a
|
||||
|
||||
A Software Bill of Materials is a list of every component (library, package, framework) that your software depends on, along with version numbers, licenses, and known vulnerabilities. SBOMs are increasingly required for compliance audits, customer security questionnaires, and supply chain transparency.
|
||||
|
||||
Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and OSV.dev + NVD for vulnerability matching.
|
||||
Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and Grype for vulnerability matching.
|
||||
|
||||
## Packages Tab
|
||||
|
||||
|
||||
@@ -8,7 +8,7 @@ When a scan is triggered, Certifai runs through these phases in order:
|
||||
|
||||
1. **Clone** -- pulls the latest code from the Git remote (or clones it for the first time)
|
||||
2. **SAST** -- runs static analysis using Semgrep with rules covering OWASP, GDPR, OAuth, secrets, and general security patterns
|
||||
3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via OSV.dev + NVD
|
||||
3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via Grype
|
||||
4. **CVE Check** -- cross-references dependencies against the NVD database for known CVEs
|
||||
5. **Graph Build** -- parses the codebase to construct a code knowledge graph of functions, classes, and their relationships
|
||||
6. **AI Triage** -- new findings are reviewed by an LLM that assesses severity, considers blast radius using the code graph, and generates remediation guidance
|
||||
@@ -52,7 +52,7 @@ A full scan runs multiple analysis engines, each producing different types of fi
|
||||
| Scan Type | What It Detects | Scanner |
|
||||
|-----------|----------------|---------|
|
||||
| **SAST** | Code-level vulnerabilities (injection, XSS, insecure crypto, etc.) | Semgrep |
|
||||
| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + OSV.dev/NVD |
|
||||
| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + Grype |
|
||||
| **CVE** | Known CVEs in dependencies cross-referenced against NVD | NVD API |
|
||||
| **GDPR** | Personal data handling issues, consent violations | Custom rules |
|
||||
| **OAuth** | OAuth/OIDC misconfigurations, insecure token handling | Custom rules |
|
||||
|
||||
@@ -58,8 +58,8 @@ An open-source static analysis tool that finds bugs and enforces code standards
|
||||
**Syft**
|
||||
An open-source tool for generating SBOMs from container images and filesystems. Used by Certifai to extract dependency information.
|
||||
|
||||
**OSV.dev**
|
||||
Google's open distributed vulnerability database, queried by package URL. Certifai uses it (together with NVD) to match SBOM components against known vulnerabilities.
|
||||
**Grype**
|
||||
An open-source vulnerability scanner for container images and filesystems. Used by Certifai to match dependencies against known vulnerabilities.
|
||||
|
||||
## Protocols
|
||||
|
||||
|
||||
+6
-16
@@ -24,14 +24,15 @@ Semgrep produces SAST-type findings with file paths, line numbers, and rule desc
|
||||
|
||||
Syft output feeds into both the SBOM feature and the vulnerability scanning pipeline.
|
||||
|
||||
## OSV.dev + NVD -- Vulnerability Matching
|
||||
## Grype -- Vulnerability Scanning
|
||||
|
||||
Certifai matches every SBOM component directly against two public vulnerability sources (no separate scanner binary):
|
||||
[Grype](https://github.com/anchore/grype) is an open-source vulnerability scanner that matches your dependencies against known vulnerability databases. It takes Syft's SBOM output and cross-references it against:
|
||||
|
||||
- [OSV.dev](https://osv.dev/) -- batch queried by package URL (purl) for ecosystem advisories (npm, PyPI, crates.io, Go, Maven, ...)
|
||||
- [NVD](https://nvd.nist.gov/) -- queried per CVE for the CVSS v3.1 base score, and by CPE for CODESYS runtime versions found in PLC projects
|
||||
- National Vulnerability Database (NVD)
|
||||
- GitHub Advisory Database
|
||||
- OS-specific advisory databases
|
||||
|
||||
Matches are stored as CVE alerts with CVSS scores and re-checked hourly, so newly published CVEs against an unchanged dependency still raise a notification.
|
||||
Grype produces SBOM-type findings with CVE identifiers, severity ratings, and links to advisories.
|
||||
|
||||
## Custom OAuth Scanner
|
||||
|
||||
@@ -96,14 +97,3 @@ When you mark findings as false positives or provide developer feedback, this in
|
||||
::: tip
|
||||
The AI triage is a starting point, not a final verdict. Always review the rationale and code evidence before acting on a finding. See [Understanding Findings](/guide/findings#human-in-the-loop) for more on the human-in-the-loop workflow.
|
||||
:::
|
||||
|
||||
## Planned integrations (decided 2026-08-31, not yet in the code)
|
||||
|
||||
The product spec keeps an **OSS-only** tooling policy and a control-mapping rule of *tools detect, the LLM judges*. Two deterministic detectors are therefore being added **underneath** the agentic DAST/pentest layer — the agents stay on top for context-seeded exploitation, chaining and explanation:
|
||||
|
||||
| Tool | Role | Status |
|
||||
|------|------|--------|
|
||||
| [Nuclei](https://github.com/projectdiscovery/nuclei) | Template-driven checks (CVE probes, default credentials, exposed panels, misconfigurations) including ICS/OT templates for WebVisu / OpenPLC / HMI endpoints. Runs as a DAST phase and as a Werkbank job with vendored templates so it works on-prem. | Planned — tracked as an issue |
|
||||
| [OWASP ZAP](https://www.zaproxy.org/) | Baseline (passive) and, behind the destructive-tests flag, active scan for reproducible spider + rule coverage; results seed the pentest agent. | Planned — follows Nuclei |
|
||||
|
||||
Both feed the same `control-map` lookup table as Semgrep, so their findings receive compliance `control_refs` through the grounded judge. An **offline vulnerability database** (Trivy preferred, Grype as alternative) is planned for the on-prem Werkbank runner, which cannot reach the OSV.dev / NVD APIs. Until these land, DAST findings come exclusively from the in-house agents described above.
|
||||
Reference in New Issue
Block a user