Benjamin Admin
12fa179bfd
Deterministic prioritisation on top of the mapper (cra_prioritizer.py): a non-negotiable P0 floor (safety-function compromise / actively exploited / CRITICAL — customer weights cannot demote) plus a discretionary tier ranked by severity x the customer's weight (high/medium/low) for the 5 business objectives (access/data/network_api/supply_updates/monitoring). Quick-win flag (high impact, low effort) for a second view; each finding carries a short priority reason. Endpoint accepts weights + per-finding safety_impact/exploited. Rough pre-sort only (devs re-sort in Jira). No DB. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
46 lines
1.6 KiB
Python
46 lines
1.6 KiB
Python
"""Standalone CRA cyber risk-assessment endpoint.
|
|
|
|
POST /api/v1/cra/assess — takes the findings the external repo-scanner already
|
|
produced and returns the deterministic CRA assessment: each finding mapped to
|
|
the CRA Annex I requirement(s) it violates, a risk level, the curated CRA
|
|
measures, and the NIST 800-53 / OWASP Top 10 golden-set crosswalk.
|
|
|
|
Project-less by design: works standalone for ANY customer — including those with
|
|
no CE risk assessment and no FMEA yet (the mandatory baseline). Reuses the fully
|
|
tested mapper; no DB, no LLM, no RAG. Same logic the MCP server exposes.
|
|
"""
|
|
from typing import Dict, List, Optional
|
|
|
|
from fastapi import APIRouter
|
|
from pydantic import BaseModel
|
|
|
|
from compliance.services.cra_finding_mapper import assess_findings_payload
|
|
|
|
router = APIRouter(prefix="/v1/cra", tags=["cra"])
|
|
|
|
|
|
class FindingIn(BaseModel):
|
|
id: str
|
|
title: Optional[str] = ""
|
|
description: Optional[str] = ""
|
|
category: Optional[str] = ""
|
|
cwe: Optional[str] = ""
|
|
severity: Optional[str] = ""
|
|
cvss: Optional[float] = None
|
|
location: Optional[str] = ""
|
|
safety_impact: Optional[bool] = False
|
|
exploited: Optional[bool] = False
|
|
|
|
|
|
class AssessRequest(BaseModel):
|
|
findings: List[FindingIn]
|
|
# customer priorities for the discretionary tier: {objective: high|medium|low}.
|
|
# objectives: access | data | network_api | supply_updates | monitoring.
|
|
weights: Optional[Dict[str, str]] = None
|
|
|
|
|
|
@router.post("/assess")
|
|
async def assess(body: AssessRequest):
|
|
payload = {"findings": [f.model_dump() for f in body.findings], "weights": body.weights}
|
|
return assess_findings_payload(payload)
|