feat(cra): Befund-Detail aufgeräumt + Rechts-Anker (source_article) sichtbar
Frontend (CRA/Cyber-Tab): - Erklär-Zwischensätze je Ebene (Befund -> CRA-Anforderung -> Best-Practice- Standard -> Maßnahmen) + "So liest du einen Befund"-Legende. - Kuratierte M-Maßnahmen und atom-grain "Regulatorische Breite" in EINE Sektion "Maßnahmen (wählbar)" zusammengeführt (statt zwei konkurrierender Listen). - Standalone "Empfohlene Maßnahmen (Sollzustand)" entfernt (jetzt je Befund). Backend: - Atom-Controls-Query liefert jetzt cpl.source_article (Artikel/Anhang/Erwägungs- grund-Anker) zusätzlich zu source_regulation; via LATERAL-Join. - enrich_findings_with_breadth trägt source_article in regulatory_breadth. - Daten waren schon ingestiert (682/691 CRA-Atome haben source_article) — wurden nur nicht selektiert/angezeigt. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
@@ -1,7 +1,7 @@
|
||||
'use client'
|
||||
|
||||
import { Fragment, useState } from 'react'
|
||||
import { CRADemo, CRAFinding } from '../_hooks/useCRADemo'
|
||||
import { CRADemo, CRAFinding, Measure } from '../_hooks/useCRADemo'
|
||||
|
||||
const RISK_BADGE: Record<string, string> = {
|
||||
CRITICAL: 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300',
|
||||
@@ -59,7 +59,7 @@ function EvidenceTag({ et }: { et?: string }) {
|
||||
)
|
||||
}
|
||||
|
||||
function FindingsTable({ findings }: { findings: CRAFinding[] }) {
|
||||
function FindingsTable({ findings, measuresById }: { findings: CRAFinding[]; measuresById: Record<string, Measure> }) {
|
||||
const [open, setOpen] = useState<Record<string, boolean>>({})
|
||||
const toggle = (id: string) => setOpen((o) => ({ ...o, [id]: !o[id] }))
|
||||
return (
|
||||
@@ -101,50 +101,79 @@ function FindingsTable({ findings }: { findings: CRAFinding[] }) {
|
||||
onClick={() => toggle(f.id)}
|
||||
className="text-[11px] text-purple-600 hover:underline whitespace-nowrap"
|
||||
>
|
||||
NIST/OWASP {open[f.id] ? '▲' : '▼'}
|
||||
Standard & Maßnahmen {open[f.id] ? '▲' : '▼'}
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
{open[f.id] && (
|
||||
<tr className="border-b border-gray-100 dark:border-gray-700/50 bg-gray-50/60 dark:bg-gray-900/30">
|
||||
<td colSpan={6} className="px-4 py-2">
|
||||
<p className="text-[10px] text-gray-400 mb-1">Best-Practice-Tiefe (Golden-Set-Crosswalk)</p>
|
||||
<div className="flex flex-wrap gap-1 items-center">
|
||||
<span className="text-[10px] text-gray-500 mr-1">NIST 800-53:</span>
|
||||
{f.nist_refs.map((n) => (
|
||||
<span key={n} className="inline-block rounded bg-slate-100 text-slate-600 dark:bg-slate-700 dark:text-slate-300 px-1.5 py-0.5 text-[10px] font-mono">{n}</span>
|
||||
))}
|
||||
<span className="text-[10px] text-gray-500 mx-1">OWASP:</span>
|
||||
{f.owasp_refs.map((o) => (
|
||||
<span key={o.code} className="inline-block rounded bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-300 px-1.5 py-0.5 text-[10px] font-medium">{o.code} · {o.label}</span>
|
||||
))}
|
||||
{f.iso27001_ref.length > 0 && (
|
||||
<>
|
||||
<span className="text-[10px] text-gray-500 mx-1">ISO 27001:</span>
|
||||
{f.iso27001_ref.map((iso) => (
|
||||
<span key={iso} className="inline-block rounded bg-gray-100 text-gray-500 dark:bg-gray-700 dark:text-gray-300 px-1.5 py-0.5 text-[10px]">{iso}</span>
|
||||
))}
|
||||
</>
|
||||
)}
|
||||
<td colSpan={6} className="px-4 py-3 space-y-3">
|
||||
{/* Best-Practice-Standard — der Maßstab (kein Code-Rezept) */}
|
||||
<div>
|
||||
<p className="text-[10px] text-gray-500 mb-1">
|
||||
<span className="font-semibold text-gray-600 dark:text-gray-300">Best-Practice-Standard</span>
|
||||
{' '}— woran „erfüllt" gemessen wird (Kontroll-Frameworks, noch kein Code-Rezept):
|
||||
</p>
|
||||
<div className="flex flex-wrap gap-1 items-center">
|
||||
<span className="text-[10px] text-gray-500 mr-1">NIST 800-53:</span>
|
||||
{f.nist_refs.map((n) => (
|
||||
<span key={n} className="inline-block rounded bg-slate-100 text-slate-600 dark:bg-slate-700 dark:text-slate-300 px-1.5 py-0.5 text-[10px] font-mono">{n}</span>
|
||||
))}
|
||||
<span className="text-[10px] text-gray-500 mx-1">OWASP:</span>
|
||||
{f.owasp_refs.map((o) => (
|
||||
<span key={o.code} className="inline-block rounded bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-300 px-1.5 py-0.5 text-[10px] font-medium">{o.code} · {o.label}</span>
|
||||
))}
|
||||
{f.iso27001_ref.length > 0 && (
|
||||
<>
|
||||
<span className="text-[10px] text-gray-500 mx-1">ISO 27001:</span>
|
||||
{f.iso27001_ref.map((iso) => (
|
||||
<span key={iso} className="inline-block rounded bg-gray-100 text-gray-500 dark:bg-gray-700 dark:text-gray-300 px-1.5 py-0.5 text-[10px]">{iso}</span>
|
||||
))}
|
||||
</>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
{f.regulatory_breadth && f.regulatory_breadth.length > 0 && (
|
||||
<div className="mt-2">
|
||||
<p className="text-[10px] text-gray-400 mb-1">
|
||||
Regulatorische Breite{f.sub_topic ? ` — ${f.sub_topic}` : ''} (CRA + NIST/OWASP/ENISA-Quellen)
|
||||
</p>
|
||||
|
||||
{/* Maßnahmen (wählbar) — kuratierte Kern-Maßnahme + belegte Optionen, zusammengeführt */}
|
||||
<div>
|
||||
<p className="text-[10px] text-gray-500 mb-1">
|
||||
<span className="font-semibold text-gray-600 dark:text-gray-300">Maßnahmen (wählbar)</span>
|
||||
{' '}— passend kombinieren, nicht alle abhaken. Das Risiko ist geschlossen, wenn die Pflicht real erfüllt ist.
|
||||
</p>
|
||||
{f.measures.length > 0 && (
|
||||
<ul className="space-y-1 mb-1.5">
|
||||
{f.measures.map((mid) => {
|
||||
const m = measuresById[mid]
|
||||
return (
|
||||
<li key={mid} className="text-[10px] text-gray-600 dark:text-gray-300">
|
||||
<span className="inline-block rounded bg-purple-100 text-purple-700 dark:bg-purple-900/40 dark:text-purple-300 px-1 py-0.5 text-[9px] mr-1">kuratiert</span>
|
||||
<span className="font-medium text-gray-700 dark:text-gray-200">{m ? m.name : mid}</span>
|
||||
{m && m.description ? <span className="text-gray-500"> — {m.description}</span> : null}
|
||||
{m && m.norm_refs && m.norm_refs.length > 0 ? <span className="text-gray-400"> · {m.norm_refs.join(', ')}</span> : null}
|
||||
</li>
|
||||
)
|
||||
})}
|
||||
</ul>
|
||||
)}
|
||||
{f.regulatory_breadth && f.regulatory_breadth.length > 0 && (
|
||||
<ul className="space-y-0.5">
|
||||
{f.regulatory_breadth.map((c) => (
|
||||
<li key={c.control_id} className="text-[10px] text-gray-600 dark:text-gray-300">
|
||||
{c.use_case && (
|
||||
<span className="inline-block rounded bg-gray-200 text-gray-600 dark:bg-gray-600 dark:text-gray-200 px-1 py-0.5 text-[9px] mr-1">{c.use_case}</span>
|
||||
)}
|
||||
<span className="inline-block rounded bg-gray-200 text-gray-600 dark:bg-gray-600 dark:text-gray-200 px-1 py-0.5 text-[9px] mr-1">{c.use_case || 'Option'}</span>
|
||||
<span className="font-mono text-gray-500">{c.control_id}</span> {c.title}
|
||||
<span className="text-gray-400"> · {c.source_regulation}</span>
|
||||
<span className="text-gray-400"> · {c.source_regulation}{c.source_article ? `, ${c.source_article}` : ''}</span>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
</div>
|
||||
)}
|
||||
)}
|
||||
{f.measures.length === 0 && (!f.regulatory_breadth || f.regulatory_breadth.length === 0) && (
|
||||
<p className="text-[10px] text-gray-400">Keine kuratierte Maßnahme hinterlegt — Standard (oben) + Code-Fix aus dem Scan nutzen.</p>
|
||||
)}
|
||||
</div>
|
||||
|
||||
<p className="text-[10px] text-gray-400 italic">
|
||||
Konkreter Code-Fix (Patch, z. B. Verschlüsselungsverfahren/Schlüssel) folgt aus dem Repo-Scan, sobald das Repository angebunden ist.
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
)}
|
||||
@@ -157,6 +186,9 @@ function FindingsTable({ findings }: { findings: CRAFinding[] }) {
|
||||
}
|
||||
|
||||
export function CRACyberView({ data }: { data: CRADemo }) {
|
||||
const measuresById: Record<string, Measure> = Object.fromEntries(
|
||||
data.open_measures.map((m) => [m.id, m]),
|
||||
)
|
||||
return (
|
||||
<div className="space-y-6">
|
||||
{/* Co-Pilot framing — advisory, not alarmist */}
|
||||
@@ -224,8 +256,15 @@ export function CRACyberView({ data }: { data: CRADemo }) {
|
||||
<div className="rounded-xl border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-800">
|
||||
<div className="px-4 py-3 border-b border-gray-100 dark:border-gray-700">
|
||||
<h2 className="text-sm font-semibold text-gray-800 dark:text-gray-200">Befunde → CRA-Anforderung</h2>
|
||||
<p className="text-[11px] text-gray-500 mt-1 leading-relaxed">
|
||||
So liest du einen Befund: <span className="font-medium text-gray-600 dark:text-gray-300">Cyber-Befund</span> (was der Scan sah)
|
||||
{' → '}<span className="font-medium text-gray-600 dark:text-gray-300">CRA-Anforderung</span> (was das Gesetz verlangt)
|
||||
{' → '}<span className="font-medium text-gray-600 dark:text-gray-300">Best-Practice-Standard</span> (woran „erfüllt" gemessen wird)
|
||||
{' → '}<span className="font-medium text-gray-600 dark:text-gray-300">Maßnahmen</span> (mögliche Umsetzungen — passend wählen, nicht alle).
|
||||
Klick „Standard & Maßnahmen" für die Details je Befund.
|
||||
</p>
|
||||
</div>
|
||||
<FindingsTable findings={data.findings} />
|
||||
<FindingsTable findings={data.findings} measuresById={measuresById} />
|
||||
</div>
|
||||
|
||||
{/* Quick wins — high impact, low effort (second view) */}
|
||||
@@ -247,33 +286,6 @@ export function CRACyberView({ data }: { data: CRADemo }) {
|
||||
</div>
|
||||
)}
|
||||
|
||||
{/* Recommended measures — full curated text + norm references */}
|
||||
<div className="rounded-xl border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-800 p-4">
|
||||
<h2 className="text-sm font-semibold text-gray-800 dark:text-gray-200 mb-1">Empfohlene Maßnahmen (Sollzustand)</h2>
|
||||
<p className="text-[11px] text-gray-400 mb-3">
|
||||
Kuratierte CRA-Maßnahmen mit Normverweisen — sie beschreiben den <span className="font-medium">umzubauenden Prozess / das Sollziel</span>,
|
||||
kein Auto-Fix. Konkrete Code-Fixes entstehen separat, wenn der Repo-Scan ein Source-Code-Risiko an einer
|
||||
Stelle sieht (Findings mit <span className="text-emerald-600 dark:text-emerald-400">„Code-nah"</span>).
|
||||
</p>
|
||||
<div className="space-y-3">
|
||||
{data.open_measures.map((me) => (
|
||||
<div key={me.id} className="rounded-lg border border-gray-100 dark:border-gray-700/60 p-3">
|
||||
<p className="text-sm font-medium text-gray-800 dark:text-gray-200">
|
||||
<span className="font-mono text-purple-600 dark:text-purple-400">{me.id}</span> — {me.name}
|
||||
</p>
|
||||
<p className="text-xs text-gray-600 dark:text-gray-300 mt-1">{me.description}</p>
|
||||
<div className="flex flex-wrap gap-1 mt-2">
|
||||
{me.norm_refs.map((nr) => (
|
||||
<span key={nr} className="inline-block rounded bg-gray-100 text-gray-500 dark:bg-gray-700 dark:text-gray-300 px-1.5 py-0.5 text-[10px]">
|
||||
{nr}
|
||||
</span>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{/* CRA deadlines */}
|
||||
<div className="rounded-xl border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-800 p-4">
|
||||
<h2 className="text-sm font-semibold text-gray-800 dark:text-gray-200 mb-2">CRA-Fristen</h2>
|
||||
|
||||
@@ -30,7 +30,7 @@ export interface CRAFinding {
|
||||
evidence_type?: string // code | process | hybrid | document — drives the remediation-class badge
|
||||
// regulatory breadth (atom-grain shared Controls-API: cra + code/network_security), live only
|
||||
sub_topic?: string
|
||||
regulatory_breadth?: { control_id: string; title: string; source_regulation: string; severity?: string; use_case?: string }[]
|
||||
regulatory_breadth?: { control_id: string; title: string; source_regulation: string; source_article?: string; severity?: string; use_case?: string }[]
|
||||
// priority layer (set live by the backend prioritizer; optional in the static fallback)
|
||||
priority_tier?: string
|
||||
priority_score?: number
|
||||
|
||||
Reference in New Issue
Block a user