Upgrade the firmware SBOM from analysis-only to a full reproducible build: run
tramiton's NixBackend (`seal_and_build`) over the ingested source to produce a
sealed lock whose libraries are pinned and whose firmware artifact carries a
content hash, then render the SBOM from the lock plus deep binary SCA of any
pre-compiled inputs — the complete bill of materials (toolchain + every fetched
library + the firmware image), mapped into `SbomEntry` rows.
Graceful by design: when no nix backend is available (or the build fails / times
out at 15m), it falls back to the analysis-only components (toolchain +
resolvable libraries), so a nix that can't run in the deployment never breaks a
scan.
Infra: the agent image now installs `nix-portable` (rootless, single binary;
best-effort — a failed download just leaves the analysis-only path). The nix
store lives under `NP_LOCATION=/data/compliance-scanner` — mount a PERSISTENT
volume there in the deployment, otherwise every firmware scan re-fetches
nixpkgs + cross toolchains.
Adds the `tramiton-sbom` dependency.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.
Dashboard: OAuth2/OIDC login flow with PKCE, session-based auth middleware
protecting all server function endpoints, check-auth server function for
frontend auth state, login page gate in AppShell, user info in sidebar.
Agent API: JWT validation middleware using Keycloak JWKS endpoint,
conditionally enabled when KEYCLOAK_URL and KEYCLOAK_REALM are set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #2
Add DAST scanning and code knowledge graph features across the stack:
- compliance-dast and compliance-graph workspace crates
- Agent API handlers and routes for DAST targets/scans and graph builds
- Core models and traits for DAST and graph domains
- Dashboard pages for DAST targets/findings/overview and graph explorer/impact
- Toast notification system with auto-dismiss for async action feedback
- Button click animations and disabled states for better UX
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Feature-gate mongodb in compliance-core (optional, default on) so wasm
builds don't pull in tokio/mio via mongodb
- Use bson v2 directly for ObjectId types (wasm-compatible)
- Restructure dashboard infrastructure/mod.rs: server function modules
always compiled (for RPC stubs), server-only modules cfg-gated
- Remove reqwest from dashboard web feature (not needed, data flows
through server functions)
- Add .gitignore
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sharang