fix(onboarding): targets visibility + unified pipeline by default

The onboarding wizard created OnboardedTargets that were invisible in the dashboard, and triggering a scan failed with "Repository <id> not found": `/targets/{id}/scan` went through `run_scan`, which consulted the global `unified_pipeline` flag and fell to the legacy repository pipeline (reads `repositories`, not `onboarded_targets`). Agent - Add `ComplianceAgent::run_target_scan`, always dispatching to the unified `run_target` pipeline. The target-scan endpoint operates on `onboarded_targets` by construction, so it must not depend on the transition flag. `trigger_target_scan` now calls it. - Default `UNIFIED_PIPELINE` to on (no legacy `repositories` data in prod); set `UNIFIED_PIPELINE=0` to opt back to the legacy pipeline. - Scheduler now scans `onboarded_targets` (via `run_target_scan`) instead of the legacy `repositories` collection. Dashboard - New Targets page (`/targets`): lists onboarded targets with detected type, artifacts, findings count, applicable-scans matrix (on expand), plus Run scan and Delete. Sidebar "Repositories" nav becomes "Targets". - Remove the "Add Repository" form from the Repositories page — onboarding is the single entry point (private-repo auth + issue tracker move into the onboarding flow, revisable on the target). - Add `delete_target` server fn. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat(onboarding): scan-trigger endpoint + wizard Run-Scan button
2026-07-13 09:11:37 +02:00 · 2026-07-13 00:13:26 +02:00 · 2026-07-12 21:52:38 +00:00 · 2026-07-12 21:49:22 +00:00 · 2026-07-12 21:31:21 +00:00 · 2026-07-12 21:28:52 +00:00
64 changed files with 6846 additions and 327 deletions
@@ -7,4 +7,17 @@ ignore = [
    # not a realistic attack surface here. Revisit when mongodb bumps hickory.
    "RUSTSEC-2026-0118", # NSEC3 loop, no fix available upstream
    "RUSTSEC-2026-0119", # O(n²) name compression, fixed in hickory-proto >=0.26.1
    # rmcp 0.16.0 — DNS rebinding in Streamable HTTP server transport (missing
    # Host header validation). Patched in rmcp >= 1.4.0, which is a major API
    # version jump from our pin; rmcp shipped 0.x → 1.x → 2.x in three months
    # and the migration touches every tool handler + the auth middleware we
    # just landed in #92. Threat model in our deployment: the MCP server is
    # exposed at a public hostname (comp-mcp-dev.meghsakha.com) behind orca's
    # TLS-terminating ingress with per-tenant bearer auth — the attack model
    # (browser DNS-rebinding into localhost MCP server) doesn't directly apply.
    # Defense-in-depth Host-header check is still a worthwhile follow-up.
    # FOLLOW-UP: bump rmcp to 2.x in a dedicated PR (M7.3 follow-up, sized
    # multi-hour due to API surface change).
    "RUSTSEC-2026-0189",
 ]
@@ -9,10 +9,25 @@ on:
 env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
-  # sccache caches compilation artifacts within a job so that compiling
+  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
-  # both --features server and --features web shares common crate work.
+  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
  # and HETZNER_S3_SECRET_KEY.
  RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_DIR: /tmp/sccache
+  SCCACHE_BUCKET: breakpilot-sccache
  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
  SCCACHE_REGION: auto
  SCCACHE_S3_USE_SSL: "true"
  SCCACHE_S3_KEY_PREFIX: compliance-scanner
  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
  # compliance-agent depends on tramiton-core via git; use the system git so the
  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
  CARGO_NET_RETRY: "10"
  CARGO_HTTP_MULTIPLEXING: "false"
 # Cancel in-progress runs for the same branch/PR
 concurrency:
@@ -36,16 +51,44 @@ jobs:
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
      # replacement only applies to crates.io-sourced crates.
      - name: Use Kellnr crates.io mirror
        run: |
          : "${CARGO_HOME:=/usr/local/cargo}"
          mkdir -p "$CARGO_HOME"
          {
            echo '[source.crates-io]'
            echo 'replace-with = "kellnr"'
            echo '[registries.kellnr]'
            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
          } >> "$CARGO_HOME/config.toml"
        env:
          RUSTC_WRAPPER: ""
      - name: Install tools
        run: |
          rustup component add rustfmt clippy
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
          chmod +x /usr/local/bin/sccache
          cargo install cargo-audit --locked
        env:
          RUSTC_WRAPPER: ""
      # compliance-agent has a git dependency on tramiton-core (a private repo on
      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
      # with read:repository, owned by a user with access to sharang/tramiton).
      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
      - name: Configure git auth for private tramiton dependency
        run: |
          git config --global \
            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
            "ssh://git@gitea.meghsakha.com:22222/"
        env:
          RUSTC_WRAPPER: ""
      # Format (no compilation needed)
      - name: Format
        run: cargo fmt --all --check
@@ -148,13 +191,18 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
        env:
          # PAT for fetching the private tramiton-core git dependency during the
          # image build (injected as a BuildKit secret, never baked into a layer).
          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-agent
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -169,13 +217,16 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
        env:
          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-dashboard
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
            -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -211,13 +262,16 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
        env:
          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-mcp
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
            -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -676,6 +676,7 @@ dependencies = [
 "jsonwebtoken",
 "mongodb",
 "octocrab",
 "rand 0.9.2",
 "regex",
 "reqwest",
 "secrecy",
@@ -691,6 +692,7 @@ dependencies = [
 "tower-http",
 "tracing",
 "tracing-subscriber",
 "tramiton-core",
 "urlencoding",
 "uuid",
 "walkdir",
@@ -818,12 +820,15 @@ dependencies = [
 "bson",
 "chrono",
 "compliance-core",
 "dashmap",
 "dotenvy",
 "hex",
 "mongodb",
 "rmcp",
 "schemars 1.2.1",
 "serde",
 "serde_json",
 "sha2",
 "thiserror 2.0.18",
 "tokio",
 "tower-http",
@@ -1114,9 +1119,9 @@ dependencies = [
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
 "crossbeam-utils",
 ]
@@ -4193,7 +4198,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit",
+ "toml_edit 0.23.10+spec-1.0.0",
 ]
 [[package]]
@@ -4278,9 +4283,9 @@ dependencies = [
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
 "bytes",
 "getrandom 0.3.4",
@@ -4992,6 +4997,15 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "serde_spanned"
 version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
 dependencies = [
 "serde",
 ]
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5806,6 +5820,27 @@ dependencies = [
 "tokio",
 ]
 [[package]]
 name = "toml"
 version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 dependencies = [
 "serde",
 "serde_spanned",
 "toml_datetime 0.6.11",
 "toml_edit 0.22.27",
 ]
 [[package]]
 name = "toml_datetime"
 version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
 dependencies = [
 "serde",
 ]
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5815,6 +5850,20 @@ dependencies = [
 "serde_core",
 ]
 [[package]]
 name = "toml_edit"
 version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
 "indexmap 2.13.0",
 "serde",
 "serde_spanned",
 "toml_datetime 0.6.11",
 "toml_write",
 "winnow",
 ]
 [[package]]
 name = "toml_edit"
 version = "0.23.10+spec-1.0.0"
@@ -5822,7 +5871,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
 dependencies = [
 "indexmap 2.13.0",
- "toml_datetime",
+ "toml_datetime 0.7.5+spec-1.1.0",
 "toml_parser",
 "winnow",
 ]
@@ -5836,6 +5885,12 @@ dependencies = [
 "winnow",
 ]
 [[package]]
 name = "toml_write"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 [[package]]
 name = "tonic"
 version = "0.12.3"
@@ -6082,6 +6137,18 @@ dependencies = [
 "wasm-bindgen",
 ]
 [[package]]
 name = "tramiton-core"
 version = "0.4.0"
 source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
 dependencies = [
 "serde",
 "tempfile",
 "thiserror 1.0.69",
 "toml",
 "walkdir",
 ]
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -34,3 +34,5 @@ zip = { version = "2", features = ["aes-crypto", "deflate"] }
 dashmap = "6"
 tokio-stream = { version = "0.1", features = ["sync"] }
 aes-gcm = "0.10"
 rand = "0.9"
 base64 = "0.22"
@@ -2,7 +2,16 @@ FROM rust:1.94-bookworm AS builder
 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-agent
+# compliance-agent depends on the private tramiton-core git repo. Authenticate
 # the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
 # Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
 RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
        "ssh://git@gitea.meghsakha.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*
@@ -7,7 +7,16 @@ ARG DOCS_URL=/docs
 WORKDIR /app
 COPY . .
 ENV DOCS_URL=${DOCS_URL}
-RUN dx build --release --package compliance-dashboard
+# compliance-agent (a workspace member) depends on the private tramiton-core git
 # repo, so the workspace resolve needs it even to build the dashboard.
 # Authenticate the fetch with a PAT passed as a BuildKit secret.
 RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
        "ssh://git@gitea.meghsakha.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
@@ -2,7 +2,16 @@ FROM rust:1.94-bookworm AS builder
 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-mcp
+# compliance-agent (a workspace member) depends on the private tramiton-core git
 # repo, so the workspace resolve needs it even to build the mcp binary.
 # Authenticate the fetch with a PAT passed as a BuildKit secret.
 RUN --mount=type=secret,id=tramiton_token \
    if [ -s /run/secrets/tramiton_token ]; then \
      git config --global \
        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
        "ssh://git@gitea.meghsakha.com:22222/"; \
    fi && \
    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
@@ -10,6 +10,11 @@ workspace = true
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
 # Native firmware build/target detection for bare-metal & RTOS artifacts.
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
 # available to the onboarding classifier. NOTE: CI must be able to fetch this
 # private repo (see the git-auth step in .gitea/workflows/ci.yml).
 tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -42,6 +47,7 @@ tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
 futures-core = "0.3"
 dashmap = { workspace = true }
 tokio-stream = { workspace = true }
 rand = { workspace = true }
 [dev-dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "axum"] }
@@ -63,7 +63,31 @@ impl ComplianceAgent {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        orchestrator.run(repo_id, trigger).await
+        if self.config.unified_pipeline {
            orchestrator.run_target(repo_id, trigger).await
        } else {
            orchestrator.run(repo_id, trigger).await
        }
    }
    /// Run a scan for an onboarded target through the unified pipeline,
    /// unconditionally.
    ///
    /// Unlike [`Self::run_scan`], this does *not* consult the
    /// `unified_pipeline` transition flag: the caller (the `/targets/{id}/scan`
    /// endpoint) operates on `onboarded_targets` by construction, so it must
    /// always dispatch to `run_target` regardless of how the legacy paths
    /// (scheduler, webhooks, `/repositories/{id}/scan`) are configured.
    pub async fn run_target_scan(
        &self,
        tenant_id: &str,
        target_id: &str,
        trigger: compliance_core::models::ScanTrigger,
    ) -> Result<(), crate::error::AgentError> {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
        orchestrator.run_target(target_id, trigger).await
    }
    /// Run a PR review: scan the diff and post review comments.
@@ -0,0 +1,115 @@
 //! Cross-tenant admin endpoints (`/api/v1/admin/*`).
 //!
 //! Operator-only. Auth is a **static bearer token** (`ADMIN_API_TOKEN`
 //! env on the agent) — explicitly NOT a Keycloak JWT, because the
 //! whole point of these endpoints is to operate ACROSS tenants. A
 //! customer JWT (which always carries a single tenant_id) has no
 //! business mounting them.
 //!
 //! Routes are only registered when `ADMIN_API_TOKEN` is set. With no
 //! token, the endpoints don't exist at all (404), which is a stronger
 //! guarantee than "401 if you guess the path".
 //!
 //! Operations:
 //! - `GET    /api/v1/admin/tenants`              — list tenant DBs
 //! - `DELETE /api/v1/admin/tenants/{tenant_id}`  — GDPR delete
 //!
 //! Tenant ids in URLs are passed as-is to `DatabasePool::drop_tenant`,
 //! which sanitises them the same way it does for creation. Listing
 //! returns the raw DB names from `list_tenant_db_names` — operators
 //! can reverse-derive the tenant_id from the prefix.
 use axum::extract::{Extension, Path, Request};
 use axum::http::{header, StatusCode};
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
 use axum::Json;
 use secrecy::ExposeSecret;
 use serde::Serialize;
 use super::dto::AgentExt;
 #[derive(Serialize)]
 pub struct ListTenantDbsResponse {
    pub tenant_db_names: Vec<String>,
 }
 #[tracing::instrument(skip_all)]
 pub async fn list_tenant_dbs(
    Extension(agent): AgentExt,
 ) -> Result<Json<ListTenantDbsResponse>, StatusCode> {
    let names = agent.db_pool.list_tenant_db_names().await.map_err(|e| {
        tracing::error!("admin: list_tenant_db_names failed: {e}");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
    Ok(Json(ListTenantDbsResponse {
        tenant_db_names: names,
    }))
 }
 #[tracing::instrument(skip_all, fields(tenant_id = %tenant_id))]
 pub async fn drop_tenant_db(
    Extension(agent): AgentExt,
    Path(tenant_id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    agent.db_pool.drop_tenant(&tenant_id).await.map_err(|e| {
        tracing::error!("admin: drop_tenant failed: {e}");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
    Ok(Json(serde_json::json!({ "status": "dropped" })))
 }
 /// Constant-time-ish comparison of the configured admin token against
 /// the incoming bearer. Uses `subtle`-style byte equality so timing
 /// attacks can't probe the token character by character.
 fn tokens_eq(a: &str, b: &str) -> bool {
    if a.len() != b.len() {
        return false;
    }
    let mut diff = 0u8;
    for (x, y) in a.bytes().zip(b.bytes()) {
        diff |= x ^ y;
    }
    diff == 0
 }
 /// Middleware enforcing the static `ADMIN_API_TOKEN`. Mounted only on
 /// the admin sub-router, so this never runs on customer routes.
 pub async fn require_admin_token(
    Extension(agent): AgentExt,
    request: Request,
    next: Next,
 ) -> Response {
    let Some(expected) = agent.config.admin_api_token.as_ref() else {
        // Belt-and-braces — if the routes were somehow mounted without
        // a token configured, refuse rather than no-op-pass.
        return (StatusCode::NOT_FOUND, "admin disabled").into_response();
    };
    let presented = request
        .headers()
        .get(header::AUTHORIZATION)
        .and_then(|v| v.to_str().ok())
        .and_then(|s| s.strip_prefix("Bearer "))
        .map(|s| s.trim());
    let Some(presented) = presented.filter(|s| !s.is_empty()) else {
        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
    };
    if !tokens_eq(presented, expected.expose_secret()) {
        return (StatusCode::UNAUTHORIZED, "Invalid admin token").into_response();
    }
    next.run(request).await
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn tokens_eq_basic() {
        assert!(tokens_eq("abc", "abc"));
        assert!(!tokens_eq("abc", "abd"));
        assert!(!tokens_eq("abc", "abcd"));
        assert!(!tokens_eq("", "x"));
        assert!(tokens_eq("", ""));
    }
 }
@@ -0,0 +1,186 @@
 //! `/api/v1/mcp-tokens` — per-tenant API tokens for the MCP server.
 //!
 //! These are opaque static bearers issued via the dashboard (or a
 //! direct curl with a KC JWT) and copied into LLM clients (Claude
 //! Desktop / Cursor / ChatGPT). The MCP server hashes incoming bearers
 //! and looks them up in the cross-tenant `<prefix>__admin.mcp_tokens`
 //! collection to derive the tenant_id for routing.
 //!
 //! The raw token is shown to the caller exactly once at creation; the
 //! database only ever stores the SHA-256 hash. Revocation is a soft
 //! delete (sets `revoked: true`) so the audit log keeps the record.
 use axum::extract::{Extension, Path};
 use axum::http::StatusCode;
 use axum::Json;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use compliance_core::models::{McpToken, McpTokenView};
 use compliance_core::tenant_ctx::TenantCtx;
 use mongodb::bson::doc;
 use rand::RngCore;
 use sha2::{Digest, Sha256};
 use super::dto::{AgentExt, ApiResponse};
 /// Mongo collection name inside the admin DB.
 const COLLECTION: &str = "mcp_tokens";
 /// Token prefix the MCP server expects on every bearer.
 const TOKEN_PREFIX: &str = "mcpt_";
 /// Bytes of randomness behind each token. 32 → ~256 bits.
 /// Encoded as URL-safe base64 without padding → 43 chars.
 /// Combined with `mcpt_` → 48-char tokens.
 const TOKEN_RAND_BYTES: usize = 32;
 #[derive(serde::Deserialize)]
 pub struct CreateMcpTokenRequest {
    pub name: String,
 }
 /// Returned exactly once at creation. The `token` field is gone from
 /// the listing endpoint — the user must save it now.
 #[derive(serde::Serialize)]
 pub struct CreateMcpTokenResponse {
    pub token: String,
    pub view: McpTokenView,
 }
 /// `POST /api/v1/mcp-tokens` — mint a new token for the caller's tenant.
 #[tracing::instrument(skip_all)]
 pub async fn create_mcp_token(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Json(req): Json<CreateMcpTokenRequest>,
 ) -> Result<Json<CreateMcpTokenResponse>, StatusCode> {
    if req.name.trim().is_empty() {
        return Err(StatusCode::BAD_REQUEST);
    }
    let raw = generate_token();
    let token_hash = sha256_hex(&raw);
    let token_prefix: String = raw.chars().take(12).collect();
    let mut token = McpToken {
        id: None,
        token_hash,
        token_prefix,
        tenant_id: tenant.0.tenant_id.clone(),
        name: req.name.trim().to_string(),
        created_by: tenant.0.user_id.clone(),
        created_at: chrono::Utc::now(),
        last_used_at: None,
        revoked: false,
    };
    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
    let res = col.insert_one(&token).await.map_err(|e| {
        tracing::error!("Failed to insert MCP token: {e}");
        StatusCode::INTERNAL_SERVER_ERROR
    })?;
    token.id = res.inserted_id.as_object_id();
    Ok(Json(CreateMcpTokenResponse {
        view: McpTokenView::from(&token),
        token: raw,
    }))
 }
 /// `GET /api/v1/mcp-tokens` — list tokens for the caller's tenant.
 /// Hash is never returned; only metadata + the 12-char prefix so the
 /// user can identify which row is which.
 #[tracing::instrument(skip_all)]
 pub async fn list_mcp_tokens(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
 ) -> Result<Json<ApiResponse<Vec<McpTokenView>>>, StatusCode> {
    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
    let mut cursor = col
        .find(doc! { "tenant_id": &tenant.0.tenant_id })
        .sort(doc! { "created_at": -1 })
        .await
        .map_err(|e| {
            tracing::error!("Failed to list MCP tokens: {e}");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;
    let mut out = Vec::new();
    while cursor.advance().await.map_err(|e| {
        tracing::warn!("MCP tokens cursor advance failed: {e}");
        StatusCode::INTERNAL_SERVER_ERROR
    })? {
        match cursor.deserialize_current() {
            Ok(t) => out.push(McpTokenView::from(&t)),
            Err(e) => tracing::warn!("Failed to deserialize MCP token: {e}"),
        }
    }
    Ok(Json(ApiResponse {
        data: out,
        total: None,
        page: None,
    }))
 }
 /// `DELETE /api/v1/mcp-tokens/{id}` — revoke (soft delete).
 /// Scoped to the caller's tenant: a user can't revoke another tenant's
 /// token even if they guess its id.
 #[tracing::instrument(skip_all, fields(id = %id))]
 pub async fn revoke_mcp_token(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
    let result = col
        .update_one(
            doc! { "_id": oid, "tenant_id": &tenant.0.tenant_id },
            doc! { "$set": { "revoked": true } },
        )
        .await
        .map_err(|e| {
            tracing::error!("Failed to revoke MCP token: {e}");
            StatusCode::INTERNAL_SERVER_ERROR
        })?;
    if result.matched_count == 0 {
        return Err(StatusCode::NOT_FOUND);
    }
    Ok(Json(serde_json::json!({ "status": "revoked" })))
 }
 /// 32 bytes random → URL-safe base64 → 43 chars, no padding.
 /// Prefixed with `mcpt_` so the MCP server can sniff the format
 /// before bothering with the DB lookup.
 fn generate_token() -> String {
    let mut bytes = [0u8; TOKEN_RAND_BYTES];
    rand::rng().fill_bytes(&mut bytes);
    format!("{TOKEN_PREFIX}{}", URL_SAFE_NO_PAD.encode(bytes))
 }
 fn sha256_hex(s: &str) -> String {
    let mut h = Sha256::new();
    h.update(s.as_bytes());
    hex::encode(h.finalize())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn generated_tokens_are_unique_and_prefixed() {
        let a = generate_token();
        let b = generate_token();
        assert_ne!(a, b);
        assert!(a.starts_with(TOKEN_PREFIX));
        assert!(b.starts_with(TOKEN_PREFIX));
        // 5 + 43 = 48 chars
        assert_eq!(a.len(), 5 + 43);
    }
    #[test]
    fn sha256_is_stable_and_64_hex() {
        let h = sha256_hex("mcpt_abc");
        assert_eq!(h.len(), 64);
        assert!(h.chars().all(|c| c.is_ascii_hexdigit()));
        assert_eq!(sha256_hex("mcpt_abc"), h);
    }
 }
@@ -1,3 +1,4 @@
 pub mod admin;
 pub mod chat;
 pub mod dast;
 pub mod dto;
@@ -6,7 +7,9 @@ pub mod graph;
 pub mod health;
 pub mod help_chat;
 pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
 pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod repos;
@@ -0,0 +1,393 @@
 //! Onboarding API — CRUD for unified targets, artifact add, classification, and
 //! the scan-applicability matrix. The wizard (and future integrations) drive
 //! onboarding through these endpoints.
 use std::collections::HashMap;
 use std::sync::Arc;
 use axum::extract::{Extension, Path, Query};
 use axum::http::StatusCode;
 use axum::Json;
 use mongodb::bson::{doc, oid::ObjectId, to_bson};
 use serde::{Deserialize, Serialize};
 use compliance_core::models::{
    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
    TargetType,
 };
 use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
 use compliance_core::tenant_ctx::TenantCtx;
 use crate::agent::ComplianceAgent;
 use crate::classify::{classify_target, MockFirmwareDetector};
 use super::dto::tenant_db;
 use super::{collect_cursor_async, ApiResponse, PaginationParams};
 type AgentExt = Extension<Arc<ComplianceAgent>>;
 /// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
 /// id) from it, so clients never set internal fields.
 #[derive(Deserialize)]
 pub struct ArtifactInput {
    pub kind: ArtifactKind,
    pub source_ref: String,
    #[serde(default)]
    pub branch: Option<String>,
    #[serde(default)]
    pub plc_format: Option<PlcFormat>,
 }
 impl ArtifactInput {
    fn build(&self) -> Artifact {
        let s = self.source_ref.clone();
        match self.kind {
            ArtifactKind::GitRepo => {
                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
            }
            ArtifactKind::LiveUrl => Artifact::live_url(s),
            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
            ArtifactKind::SourceArchive => Artifact::source_archive(s),
            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
            ArtifactKind::ContainerImage => Artifact::container_image(s),
            ArtifactKind::PlcProject => {
                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
            }
            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
        }
    }
 }
 #[derive(Deserialize)]
 pub struct CreateTargetRequest {
    pub name: String,
    pub target_type: TargetType,
    #[serde(default)]
    pub description: Option<String>,
    #[serde(default)]
    pub artifacts: Vec<ArtifactInput>,
 }
 #[derive(Deserialize)]
 pub struct UpdateTargetRequest {
    pub name: Option<String>,
    pub target_type: Option<TargetType>,
    pub scan_config: Option<TargetScanConfig>,
    pub compliance_profile: Option<ComplianceProfile>,
    pub scan_schedule: Option<String>,
 }
 /// One applicable-scan option, serialized for the wizard.
 #[derive(Serialize)]
 pub struct ScanOptionDto {
    pub scan: String,
    pub default_on: bool,
    pub rationale: String,
    pub required_artifact: Option<String>,
    pub blocked_reason: Option<String>,
 }
 #[derive(Serialize)]
 pub struct ApplicableScansResponse {
    pub scans: Vec<ScanOptionDto>,
    pub pentest_supported: bool,
 }
 fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
 }
 /// GET /api/v1/targets — list onboarded targets (paginated).
 #[tracing::instrument(skip_all)]
 pub async fn list_targets(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
    let db = tenant_db(&agent, &tenant).await?;
    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
    let total = db
        .onboarded_targets()
        .count_documents(doc! {})
        .await
        .unwrap_or(0);
    let targets = match db
        .onboarded_targets()
        .find(doc! {})
        .skip(skip)
        .limit(params.limit)
        .await
    {
        Ok(cursor) => collect_cursor_async(cursor).await,
        Err(e) => {
            tracing::warn!("Failed to fetch onboarded targets: {e}");
            Vec::new()
        }
    };
    Ok(Json(ApiResponse {
        data: targets,
        total: Some(total),
        page: Some(params.page),
    }))
 }
 /// POST /api/v1/targets — create an onboarded target.
 #[tracing::instrument(skip_all)]
 pub async fn create_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Json(req): Json<CreateTargetRequest>,
 ) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let mut target = OnboardedTarget::new(req.name, req.target_type);
    target.description = req.description;
    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
    let db = tenant_db(&agent, &tenant).await?;
    let res = db
        .onboarded_targets()
        .insert_one(&target)
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    target.id = res.inserted_id.as_object_id();
    Ok(Json(ApiResponse {
        data: target,
        total: None,
        page: None,
    }))
 }
 /// GET /api/v1/targets/{id} — fetch one target.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn get_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let target = db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;
    Ok(Json(ApiResponse {
        data: target,
        total: None,
        page: None,
    }))
 }
 /// PATCH /api/v1/targets/{id} — update mutable fields.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn update_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
    Json(req): Json<UpdateTargetRequest>,
 ) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
    if let Some(name) = req.name {
        set.insert("name", name);
    }
    if let Some(tt) = req.target_type {
        set.insert(
            "target_type",
            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
        );
    }
    if let Some(sc) = req.scan_config {
        set.insert(
            "scan_config",
            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
        );
    }
    if let Some(cp) = req.compliance_profile {
        set.insert(
            "compliance_profile",
            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
        );
    }
    if let Some(ss) = req.scan_schedule {
        set.insert("scan_schedule", ss);
    }
    db.onboarded_targets()
        .update_one(doc! { "_id": oid }, doc! { "$set": set })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    get_target(Extension(agent), tenant, Path(id)).await
 }
 /// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn delete_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    db.onboarded_targets()
        .delete_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    // Cascade the collections keyed by repo_id == target id (best-effort).
    let by_repo = doc! { "repo_id": &id };
    let _ = db.findings().delete_many(by_repo.clone()).await;
    let _ = db.scan_runs().delete_many(by_repo.clone()).await;
    let _ = db.sbom_entries().delete_many(by_repo.clone()).await;
    let _ = db.cve_alerts().delete_many(by_repo).await;
    Ok(Json(serde_json::json!({ "status": "deleted" })))
 }
 /// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn add_artifact(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
    Json(input): Json<ArtifactInput>,
 ) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
    db.onboarded_targets()
        .update_one(
            doc! { "_id": oid },
            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
        )
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    get_target(Extension(agent), tenant, Path(id)).await
 }
 /// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn applicable_scans_for_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let target = db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;
    let scans = applicable_scans(&target)
        .into_iter()
        .map(|o| ScanOptionDto {
            scan: o.scan.to_string(),
            default_on: o.default_on,
            rationale: o.rationale,
            required_artifact: o.required_artifact.map(|k| k.to_string()),
            blocked_reason: o.blocked_reason,
        })
        .collect();
    Ok(Json(ApiResponse {
        data: ApplicableScansResponse {
            scans,
            pentest_supported: supports_pentest(target.target_type),
        },
        total: None,
        page: None,
    }))
 }
 /// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
 ///
 /// This is the lightweight pass: it classifies from artifact kinds without
 /// ingesting (cloning) sources, so it returns immediately. Deep detection (after
 /// ingest, with tramiton firmware analysis) is a follow-up background step.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn detect_target(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    let mut target = db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .ok_or(StatusCode::NOT_FOUND)?;
    // No ingested working paths here → kind-based classification only; the mock
    // firmware detector is never invoked (no firmware working path present).
    let empty = HashMap::new();
    let detector = MockFirmwareDetector { detection: None };
    let classification = classify_target(&target, &empty, &detector)
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    let classification_bson =
        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    db.onboarded_targets()
        .update_one(
            doc! { "_id": oid },
            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
        )
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
    target.classification = Some(classification);
    Ok(Json(ApiResponse {
        data: target,
        total: None,
        page: None,
    }))
 }
 /// POST /api/v1/targets/{id}/scan — trigger a scan for the target.
 ///
 /// Dispatches to the unified pipeline when `UNIFIED_PIPELINE` is set (else the
 /// legacy path). Runs in the background and returns immediately.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn trigger_target_scan(
    Extension(agent): AgentExt,
    tenant: TenantCtx,
    Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
    let oid = parse_oid(&id)?;
    let db = tenant_db(&agent, &tenant).await?;
    // 404 if the target doesn't exist for this tenant.
    if db
        .onboarded_targets()
        .find_one(doc! { "_id": oid })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
        .is_none()
    {
        return Err(StatusCode::NOT_FOUND);
    }
    let agent_clone = (*agent).clone();
    let tenant_id = tenant.0.tenant_id.clone();
    tokio::spawn(async move {
        // Always the unified target pipeline — this endpoint is about an
        // onboarded target by construction, independent of the global
        // `unified_pipeline` transition flag used by the legacy paths.
        if let Err(e) = agent_clone
            .run_target_scan(
                &tenant_id,
                &id,
                compliance_core::models::ScanTrigger::Manual,
            )
            .await
        {
            tracing::error!("Manual target scan failed for {id}: {e}");
        }
    });
    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
 }
@@ -2,7 +2,6 @@ use axum::routing::{delete, get, patch, post};
 use axum::Router;
 use crate::api::handlers;
 use crate::webhooks;
 pub fn build_router() -> Router {
    Router::new()
@@ -26,6 +25,33 @@ pub fn build_router() -> Router {
            "/api/v1/repositories/{id}/webhook-config",
            get(handlers::get_webhook_config),
        )
        // Unified onboarding targets (#131).
        .route(
            "/api/v1/targets",
            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
        )
        .route(
            "/api/v1/targets/{id}",
            get(handlers::onboarding::get_target)
                .patch(handlers::onboarding::update_target)
                .delete(handlers::onboarding::delete_target),
        )
        .route(
            "/api/v1/targets/{id}/artifacts",
            post(handlers::onboarding::add_artifact),
        )
        .route(
            "/api/v1/targets/{id}/applicable-scans",
            get(handlers::onboarding::applicable_scans_for_target),
        )
        .route(
            "/api/v1/targets/{id}/detect",
            post(handlers::onboarding::detect_target),
        )
        .route(
            "/api/v1/targets/{id}/scan",
            post(handlers::onboarding::trigger_target_scan),
        )
        .route("/api/v1/findings", get(handlers::list_findings))
        .route("/api/v1/findings/{id}", get(handlers::get_finding))
        .route(
@@ -47,6 +73,15 @@ pub fn build_router() -> Router {
        .route("/api/v1/sbom/diff", get(handlers::sbom_diff))
        .route("/api/v1/issues", get(handlers::list_issues))
        .route("/api/v1/scan-runs", get(handlers::list_scan_runs))
        // MCP token management (per-tenant API tokens for the MCP server)
        .route(
            "/api/v1/mcp-tokens",
            get(handlers::mcp_tokens::list_mcp_tokens).post(handlers::mcp_tokens::create_mcp_token),
        )
        .route(
            "/api/v1/mcp-tokens/{id}",
            delete(handlers::mcp_tokens::revoke_mcp_token),
        )
        // Graph API endpoints
        .route("/api/v1/graph/{repo_id}", get(handlers::graph::get_graph))
        .route(
@@ -175,17 +210,10 @@ pub fn build_router() -> Router {
            "/api/v1/pentest/stats",
            get(handlers::pentest::pentest_stats),
        )
-        // Webhook endpoints (proxied through dashboard)
+    // Webhook routes live on the separate webhook server (port 3002,
-        .route(
+    // see crate::webhooks::server). The M7.2-C tenant-in-URL form is
-            "/webhook/github/{repo_id}",
+    // `/webhook/{tenant_id}/{platform}/{repo_id}` and the handlers
-            post(webhooks::github::handle_github_webhook),
+    // expect a (tenant_id, repo_id) path tuple. Anything mounting
-        )
+    // them here on the API server would mismatch the handler
-        .route(
+    // signature, so the routes are not exported.
            "/webhook/gitlab/{repo_id}",
            post(webhooks::gitlab::handle_gitlab_webhook),
        )
        .route(
            "/webhook/gitea/{repo_id}",
            post(webhooks::gitea::handle_gitea_webhook),
        )
 }
@@ -4,7 +4,8 @@ use axum::extract::Request;
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
-use axum::{middleware, Extension};
+use axum::routing::{delete, get};
 use axum::{middleware, Extension, Router};
 use tokio::sync::RwLock;
 use tower_http::cors::CorsLayer;
 use tower_http::set_header::SetResponseHeaderLayer;
@@ -14,6 +15,7 @@ use compliance_core::auth::{require_jwt_auth, require_tenant_status, JwksState};
 use compliance_core::{TenantContext, TenantStatus};
 use crate::agent::ComplianceAgent;
 use crate::api::handlers;
 use crate::api::routes;
 use crate::error::AgentError;
@@ -50,7 +52,28 @@ pub async fn inject_dev_tenant(mut request: Request, next: Next) -> Response {
 }
 pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), AgentError> {
    // Admin sub-router. Routes are only mounted when ADMIN_API_TOKEN is
    // configured — without it, the paths don't exist at all (404 rather
    // than 401), so an operator who hasn't opted in can't fingerprint
    // the surface area.
    let admin_router: Router = if agent.config.admin_api_token.is_some() {
        tracing::info!("Admin API enabled — /api/v1/admin/* mounted behind ADMIN_API_TOKEN bearer");
        Router::new()
            .route(
                "/api/v1/admin/tenants",
                get(handlers::admin::list_tenant_dbs),
            )
            .route(
                "/api/v1/admin/tenants/{tenant_id}",
                delete(handlers::admin::drop_tenant_db),
            )
            .layer(middleware::from_fn(handlers::admin::require_admin_token))
    } else {
        Router::new()
    };
    let mut app = routes::build_router()
        .merge(admin_router)
        .layer(Extension(Arc::new(agent.clone())))
        .layer(CorsLayer::permissive())
        .layer(TraceLayer::new_for_http())
@@ -0,0 +1,217 @@
 //! Firmware classification via tramiton.
 //!
 //! tramiton is the company's firmware build/repro engine; we do not re-implement
 //! its detection. We depend on `tramiton-core` directly (same-company IP) and run
 //! its provider analysis in-process behind a [`FirmwareDetector`] port, mapping
 //! tramiton's `BuildPlan` onto a [`TargetType`]. A deterministic
 //! [`MockFirmwareDetector`] backs the tests so CI unit tests need neither the
 //! tramiton sources nor a real firmware tree.
 use std::path::Path;
 use compliance_core::error::CoreError;
 use compliance_core::models::{DetectedFact, TargetType};
 use compliance_core::traits::ClassifierVerdict;
 /// A minimal firmware-detection summary, mapped from tramiton's `BuildPlan`.
 /// Kept small and tramiton-independent so the classifier and the test mock don't
 /// need to construct a full tramiton plan.
 #[derive(Debug, Clone, Default)]
 pub struct FirmwareDetection {
    /// The detecting provider (e.g. `zephyr`, `cmake`, `source-archaeology`).
    pub provider: String,
    /// Detection confidence: `low` | `medium` | `high`.
    pub confidence: String,
    /// Build-system label (e.g. `Zephyr`, `ESP-IDF`, `CMake`).
    pub build_system: String,
    /// Framework, when known (`zephyr`, `esp-idf`, `bare-metal`, ...).
    pub framework: Option<String>,
    /// Target board / MCU / arch.
    pub target: FirmwareTarget,
    /// Unresolved gaps in the plan.
    pub gaps: Vec<String>,
 }
 /// The detected firmware target (board / MCU / arch).
 #[derive(Debug, Clone, Default)]
 pub struct FirmwareTarget {
    /// Board name.
    pub board: Option<String>,
    /// MCU part.
    pub mcu: Option<String>,
    /// Architecture.
    pub arch: Option<String>,
 }
 /// A source of tramiton firmware detection.
 #[allow(async_fn_in_trait)]
 pub trait FirmwareDetector: Send + Sync {
    /// Run detection over a path, returning a firmware detection if tramiton
    /// could form a build plan.
    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError>;
 }
 /// Uses `tramiton-core` in-process. The analysis is blocking (filesystem walk),
 /// so it runs on a blocking thread to avoid stalling the async runtime. A path
 /// with no recognizable build system yields `Ok(None)`.
 pub struct TramitonNative;
 impl FirmwareDetector for TramitonNative {
    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
        let path = path.to_path_buf();
        let plan = tokio::task::spawn_blocking(move || {
            let repo = tramiton_core::Repo::new(&path);
            tramiton_core::provider::analyze(&repo)
        })
        .await
        .map_err(|e| CoreError::Other(format!("tramiton detect task join error: {e}")))?
        .map_err(|e| CoreError::Other(format!("tramiton analyze error: {e}")))?;
        Ok(plan.map(|bp| detection_from_build_plan(&bp)))
    }
 }
 /// Map tramiton's `BuildPlan` onto our minimal detection summary.
 fn detection_from_build_plan(bp: &tramiton_core::BuildPlan) -> FirmwareDetection {
    FirmwareDetection {
        provider: bp.provider.clone(),
        confidence: bp.confidence.to_string(),
        build_system: bp.build_system.label().to_string(),
        framework: bp.framework.clone(),
        target: FirmwareTarget {
            board: bp.target.board.clone(),
            mcu: bp.target.mcu.clone(),
            arch: bp.target.arch.clone(),
        },
        gaps: bp.gaps.clone(),
    }
 }
 /// Map a firmware detection to a target type. Framework/build-system signals
 /// distinguish RTOS from bare-metal from Yocto.
 pub fn detection_to_target_type(det: &FirmwareDetection) -> TargetType {
    let framework = det.framework.as_deref().unwrap_or("").to_lowercase();
    let build_system = det.build_system.to_lowercase();
    let signal = format!("{framework} {build_system} {}", det.provider.to_lowercase());
    const RTOS: [&str; 6] = ["zephyr", "esp-idf", "freertos", "nuttx", "riot", "chibios"];
    if signal.contains("bitbake") || signal.contains("yocto") || signal.contains("openembedded") {
        TargetType::EmbeddedLinuxYocto
    } else if RTOS.iter().any(|k| signal.contains(k)) {
        TargetType::FirmwareRtos
    } else {
        TargetType::FirmwareBareMetal
    }
 }
 /// Map tramiton's confidence label to a `[0,1]` score.
 fn confidence_score(label: &str) -> f32 {
    match label.to_lowercase().as_str() {
        "high" => 0.9,
        "medium" => 0.6,
        "low" => 0.3,
        _ => 0.4,
    }
 }
 /// Turn a firmware detection into a classifier verdict, carrying the MCU / board
 /// / build-system as facts.
 pub fn detection_to_verdict(det: &FirmwareDetection) -> ClassifierVerdict {
    let target_type = detection_to_target_type(det);
    let mut facts = vec![DetectedFact::new(
        "build_system",
        det.build_system.clone(),
        "tramiton",
    )];
    if let Some(fw) = &det.framework {
        facts.push(DetectedFact::new("framework", fw.clone(), "tramiton"));
    }
    if let Some(mcu) = &det.target.mcu {
        facts.push(DetectedFact::new("mcu", mcu.clone(), "tramiton"));
    }
    if let Some(board) = &det.target.board {
        facts.push(DetectedFact::new("board", board.clone(), "tramiton"));
    }
    if let Some(arch) = &det.target.arch {
        facts.push(DetectedFact::new("arch", arch.clone(), "tramiton"));
    }
    ClassifierVerdict {
        target_type,
        confidence: confidence_score(&det.confidence),
        facts,
        rationale: format!(
            "tramiton detected build system '{}'{}",
            det.build_system,
            det.framework
                .as_ref()
                .map(|f| format!(" (framework {f})"))
                .unwrap_or_default()
        ),
    }
 }
 /// A deterministic [`FirmwareDetector`] for tests — returns a preset detection.
 pub struct MockFirmwareDetector {
    /// The detection to return (or `None` for "no detection").
    pub detection: Option<FirmwareDetection>,
 }
 impl FirmwareDetector for MockFirmwareDetector {
    async fn detect(&self, _path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
        Ok(self.detection.clone())
    }
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    fn detection(build_system: &str, framework: Option<&str>) -> FirmwareDetection {
        FirmwareDetection {
            provider: build_system.to_string(),
            confidence: "high".to_string(),
            build_system: build_system.to_string(),
            framework: framework.map(|s| s.to_string()),
            target: FirmwareTarget {
                mcu: Some("stm32f429".to_string()),
                ..Default::default()
            },
            gaps: Vec::new(),
        }
    }
    #[test]
    fn zephyr_maps_to_rtos() {
        assert_eq!(
            detection_to_target_type(&detection("zephyr", Some("zephyr"))),
            TargetType::FirmwareRtos
        );
    }
    #[test]
    fn bare_cmake_maps_to_bare_metal() {
        assert_eq!(
            detection_to_target_type(&detection("cmake", Some("bare-metal"))),
            TargetType::FirmwareBareMetal
        );
    }
    #[test]
    fn bitbake_maps_to_yocto() {
        assert_eq!(
            detection_to_target_type(&detection("bitbake", None)),
            TargetType::EmbeddedLinuxYocto
        );
    }
    #[test]
    fn verdict_carries_mcu_fact_and_confidence() {
        let v = detection_to_verdict(&detection("esp-idf", Some("esp-idf")));
        assert_eq!(v.target_type, TargetType::FirmwareRtos);
        assert!((v.confidence - 0.9).abs() < f32::EPSILON);
        assert!(v
            .facts
            .iter()
            .any(|f| f.key == "mcu" && f.value == "stm32f429"));
    }
 }
@@ -0,0 +1,357 @@
 //! Heuristic target-type classification from artifact kinds and source markers.
 //!
 //! Complements the tramiton firmware detector: this handles web / backend /
 //! mobile / desktop / PLC by sniffing manifest files and file extensions in the
 //! ingested code trees, plus strong priors from the artifact kinds themselves
 //! (a PLC-project artifact is a PLC target; an `.ipa` is an iOS app).
 use std::collections::HashSet;
 use std::fs;
 use std::path::Path;
 use compliance_core::error::CoreError;
 use compliance_core::models::{ArtifactKind, DetectedFact, TargetType};
 use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
 /// Max directory depth scanned for marker files.
 const SCAN_DEPTH: usize = 2;
 /// Markers collected from a code tree.
 #[derive(Default)]
 struct Markers {
    files: HashSet<String>,
    dirs: HashSet<String>,
    exts: HashSet<String>,
 }
 impl Markers {
    fn has_file(&self, name: &str) -> bool {
        self.files.contains(name)
    }
    fn has_ext(&self, ext: &str) -> bool {
        self.exts.contains(ext)
    }
    fn any_dir_ends_with(&self, suffix: &str) -> bool {
        self.dirs.iter().any(|d| d.ends_with(suffix))
    }
 }
 /// Recursively collect marker file/dir/extension names up to [`SCAN_DEPTH`].
 fn collect_markers(root: &Path) -> Markers {
    let mut m = Markers::default();
    scan_dir(root, 0, &mut m);
    m
 }
 fn scan_dir(dir: &Path, depth: usize, m: &mut Markers) {
    let Ok(entries) = fs::read_dir(dir) else {
        return;
    };
    for entry in entries.flatten() {
        let path = entry.path();
        let name = entry.file_name().to_string_lossy().to_lowercase();
        if path.is_dir() {
            m.dirs.insert(name);
            if depth < SCAN_DEPTH {
                scan_dir(&path, depth + 1, m);
            }
        } else {
            if let Some(ext) = path.extension() {
                m.exts.insert(ext.to_string_lossy().to_lowercase());
            }
            m.files.insert(name);
        }
    }
 }
 /// Whether a `package.json` at `root` looks like a front-end app.
 fn package_json_is_frontend(root: &Path) -> bool {
    let Ok(content) = fs::read_to_string(root.join("package.json")) else {
        return false;
    };
    let c = content.to_lowercase();
    ["react", "next", "vue", "@angular", "svelte", "vite"]
        .iter()
        .any(|f| c.contains(f))
 }
 /// The heuristic classifier: artifact-kind priors + source-tree markers.
 pub struct HeuristicClassifier;
 impl HeuristicClassifier {
    /// Verdicts from the artifact kinds alone (no filesystem needed).
    fn kind_priors(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
        let mut out = Vec::new();
        for a in input.artifacts {
            let lower = a.source_ref.to_lowercase();
            match a.kind {
                ArtifactKind::PlcProject => out.push(verdict(
                    TargetType::PlcSps,
                    0.85,
                    "PLC project artifact",
                    vec![],
                )),
                ArtifactKind::MobilePackage => {
                    let (tt, why) = if lower.ends_with(".ipa") {
                        (TargetType::IosApp, "iOS package (.ipa)")
                    } else {
                        (TargetType::AndroidApp, "Android package (.apk/.aab)")
                    };
                    out.push(verdict(tt, 0.85, why, vec![]));
                }
                ArtifactKind::ContainerImage => out.push(verdict(
                    TargetType::BackendService,
                    0.4,
                    "container image",
                    vec![],
                )),
                ArtifactKind::FirmwareImage => out.push(verdict(
                    TargetType::FirmwareBareMetal,
                    0.35,
                    "firmware image (pending tramiton detection)",
                    vec![],
                )),
                ArtifactKind::LiveUrl if input.artifacts.len() == 1 => {
                    out.push(verdict(TargetType::WebApp, 0.3, "live URL only", vec![]))
                }
                _ => {}
            }
        }
        out
    }
    /// Verdicts from scanning the ingested code trees for manifest markers.
    fn source_verdicts(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
        let mut out = Vec::new();
        for a in input.artifacts {
            if !matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive) {
                continue;
            }
            let Some(path) = input.working_paths.get(&a.id) else {
                continue;
            };
            let m = collect_markers(path);
            // Mobile (checked first — strongest signal).
            if m.has_file("androidmanifest.xml") || m.has_ext("apk") || m.has_ext("aab") {
                out.push(verdict(
                    TargetType::AndroidApp,
                    0.8,
                    "Android manifest / gradle",
                    facts_lang("kotlin/java"),
                ));
            }
            if m.any_dir_ends_with(".xcodeproj")
                || m.has_file("info.plist")
                || m.has_file("podfile")
                || m.has_ext("ipa")
            {
                out.push(verdict(
                    TargetType::IosApp,
                    0.8,
                    "Xcode project / Info.plist",
                    facts_lang("swift/objc"),
                ));
            }
            // Desktop.
            if m.has_ext("sln")
                || m.has_ext("csproj")
                || m.has_ext("vcxproj")
                || m.has_ext("desktop")
            {
                out.push(verdict(
                    TargetType::DesktopApp,
                    0.7,
                    "desktop project files",
                    facts_lang("dotnet/native"),
                ));
            }
            // PLC.
            if m.has_ext("st") {
                out.push(verdict(
                    TargetType::PlcSps,
                    0.8,
                    "Structured Text sources",
                    facts_lang("iec-61131-3"),
                ));
            }
            // Web vs backend from package.json.
            if m.has_file("package.json") {
                if package_json_is_frontend(path) {
                    out.push(verdict(
                        TargetType::WebApp,
                        0.65,
                        "package.json with a front-end framework",
                        facts_lang("javascript"),
                    ));
                } else {
                    out.push(verdict(
                        TargetType::BackendService,
                        0.55,
                        "package.json (no front-end framework)",
                        facts_lang("javascript"),
                    ));
                }
            }
            // Backend languages.
            for (file, lang) in [
                ("cargo.toml", "rust"),
                ("go.mod", "go"),
                ("pom.xml", "java"),
                ("requirements.txt", "python"),
                ("pyproject.toml", "python"),
            ] {
                if m.has_file(file) {
                    out.push(verdict(
                        TargetType::BackendService,
                        0.6,
                        "backend build manifest",
                        facts_lang(lang),
                    ));
                }
            }
            // Container-only.
            if m.has_file("dockerfile") && out.is_empty() {
                out.push(verdict(
                    TargetType::BackendService,
                    0.4,
                    "Dockerfile",
                    facts_lang("container"),
                ));
            }
        }
        out
    }
 }
 impl TargetClassifier for HeuristicClassifier {
    fn name(&self) -> &str {
        "heuristic"
    }
    async fn classify(
        &self,
        input: &ClassificationInput<'_>,
    ) -> Result<Vec<ClassifierVerdict>, CoreError> {
        let mut out = self.kind_priors(input);
        out.extend(self.source_verdicts(input));
        Ok(out)
    }
 }
 fn verdict(
    target_type: TargetType,
    confidence: f32,
    rationale: &str,
    facts: Vec<DetectedFact>,
 ) -> ClassifierVerdict {
    ClassifierVerdict {
        target_type,
        confidence,
        facts,
        rationale: rationale.to_string(),
    }
 }
 fn facts_lang(lang: &str) -> Vec<DetectedFact> {
    vec![DetectedFact::new("language", lang, "heuristic")]
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use compliance_core::models::Artifact;
    use std::collections::HashMap;
    use std::path::PathBuf;
    struct Scratch(PathBuf);
    impl Scratch {
        fn new() -> Self {
            let p = std::env::temp_dir().join(format!("cs-classify-{}", uuid::Uuid::new_v4()));
            fs::create_dir_all(&p).expect("mkdir");
            Self(p)
        }
    }
    impl Drop for Scratch {
        fn drop(&mut self) {
            let _ = fs::remove_dir_all(&self.0);
        }
    }
    async fn classify_tree(setup: impl FnOnce(&Path)) -> Vec<ClassifierVerdict> {
        let scratch = Scratch::new();
        setup(&scratch.0);
        let artifact = Artifact::git_repo("https://git/x", "main");
        let mut wp = HashMap::new();
        wp.insert(artifact.id.clone(), scratch.0.clone());
        let artifacts = vec![artifact];
        let input = ClassificationInput {
            artifacts: &artifacts,
            working_paths: &wp,
            description: None,
        };
        HeuristicClassifier
            .classify(&input)
            .await
            .expect("classify")
    }
    #[tokio::test]
    async fn frontend_package_json_is_webapp() {
        let v = classify_tree(|root| {
            fs::write(
                root.join("package.json"),
                r#"{"dependencies":{"react":"18"}}"#,
            )
            .unwrap();
        })
        .await;
        assert!(v.iter().any(|x| x.target_type == TargetType::WebApp));
    }
    #[tokio::test]
    async fn cargo_toml_is_backend() {
        let v = classify_tree(|root| {
            fs::write(root.join("Cargo.toml"), "[package]\nname='x'").unwrap();
        })
        .await;
        assert!(v
            .iter()
            .any(|x| x.target_type == TargetType::BackendService));
    }
    #[tokio::test]
    async fn android_manifest_is_android() {
        let v = classify_tree(|root| {
            fs::write(root.join("AndroidManifest.xml"), "<manifest/>").unwrap();
        })
        .await;
        assert!(v.iter().any(|x| x.target_type == TargetType::AndroidApp));
    }
    #[tokio::test]
    async fn structured_text_is_plc() {
        let v = classify_tree(|root| {
            fs::write(root.join("main.st"), "PROGRAM main END_PROGRAM").unwrap();
        })
        .await;
        assert!(v.iter().any(|x| x.target_type == TargetType::PlcSps));
    }
    #[tokio::test]
    async fn ipa_artifact_prior_is_ios() {
        let artifacts = vec![Artifact::mobile_package("app.ipa")];
        let wp = HashMap::new();
        let input = ClassificationInput {
            artifacts: &artifacts,
            working_paths: &wp,
            description: None,
        };
        let v = HeuristicClassifier
            .classify(&input)
            .await
            .expect("classify");
        assert!(v.iter().any(|x| x.target_type == TargetType::IosApp));
    }
 }
@@ -0,0 +1,226 @@
 //! Target classification.
 //!
 //! Runs the classifier registry over a target's artifacts and their ingested
 //! working paths, then merges and ranks the verdicts into a [`Classification`].
 //! The registry is the heuristic classifier (artifact kinds + source markers)
 //! plus the tramiton firmware detector (behind a [`FirmwareDetector`] port).
 mod firmware;
 mod language;
 pub use firmware::{
    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
 };
 pub use language::HeuristicClassifier;
 use std::collections::HashMap;
 use std::path::PathBuf;
 use compliance_core::error::CoreError;
 use compliance_core::models::{
    ArtifactKind, Classification, DetectedFact, OnboardedTarget, TargetType, TargetTypeCandidate,
 };
 use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
 use firmware::detection_to_verdict;
 /// Classify a target from its artifacts and their ingested working paths, using
 /// the heuristic classifier plus the tramiton firmware detector. Verdicts are
 /// merged (max confidence per target type) and ranked into a [`Classification`].
 pub async fn classify_target<D: FirmwareDetector>(
    target: &OnboardedTarget,
    working_paths: &HashMap<String, PathBuf>,
    firmware_detector: &D,
 ) -> Result<Classification, CoreError> {
    let input = ClassificationInput {
        artifacts: &target.artifacts,
        working_paths,
        description: target.description.as_deref(),
    };
    let mut verdicts = Vec::new();
    let mut detected_by = Vec::new();
    let heuristic = HeuristicClassifier.classify(&input).await?;
    if !heuristic.is_empty() {
        detected_by.push("heuristic".to_string());
    }
    verdicts.extend(heuristic);
    // Tramiton firmware detection over firmware / code working paths.
    let mut tramiton_used = false;
    for artifact in &target.artifacts {
        if !matches!(
            artifact.kind,
            ArtifactKind::FirmwareImage | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
        ) {
            continue;
        }
        let Some(path) = working_paths.get(&artifact.id) else {
            continue;
        };
        if let Some(detection) = firmware_detector.detect(path).await? {
            verdicts.push(detection_to_verdict(&detection));
            tramiton_used = true;
        }
    }
    if tramiton_used {
        detected_by.push("tramiton".to_string());
    }
    Ok(rank(verdicts, detected_by, target.target_type))
 }
 /// Merge verdicts by target type (keeping the max confidence and its rationale),
 /// dedupe facts, rank by descending confidence, and assemble a [`Classification`].
 /// Falls back to the declared type when no verdict is produced.
 fn rank(
    verdicts: Vec<ClassifierVerdict>,
    detected_by: Vec<String>,
    fallback: TargetType,
 ) -> Classification {
    let mut best: HashMap<TargetType, (f32, String)> = HashMap::new();
    let mut facts: Vec<DetectedFact> = Vec::new();
    for verdict in verdicts {
        for fact in verdict.facts {
            if !facts
                .iter()
                .any(|e| e.key == fact.key && e.value == fact.value)
            {
                facts.push(fact);
            }
        }
        let entry = best
            .entry(verdict.target_type)
            .or_insert((0.0, String::new()));
        if verdict.confidence > entry.0 {
            *entry = (verdict.confidence, verdict.rationale);
        }
    }
    let mut candidates: Vec<TargetTypeCandidate> = best
        .into_iter()
        .map(
            |(target_type, (confidence, rationale))| TargetTypeCandidate {
                target_type,
                confidence,
                rationale,
            },
        )
        .collect();
    // Descending confidence; ties broken by type name for deterministic ordering.
    candidates.sort_by(|a, b| {
        b.confidence
            .partial_cmp(&a.confidence)
            .unwrap_or(std::cmp::Ordering::Equal)
            .then_with(|| a.target_type.to_string().cmp(&b.target_type.to_string()))
    });
    let suggested = candidates
        .first()
        .map(|c| c.target_type)
        .unwrap_or(fallback);
    Classification {
        suggested,
        candidates,
        facts,
        detected_by,
        detected_at: chrono::Utc::now(),
        confirmed: false,
    }
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use compliance_core::models::Artifact;
    use std::fs;
    use std::path::Path;
    struct Scratch(PathBuf);
    impl Scratch {
        fn new() -> Self {
            let p = std::env::temp_dir().join(format!("cs-classify-mod-{}", uuid::Uuid::new_v4()));
            fs::create_dir_all(&p).expect("mkdir");
            Self(p)
        }
    }
    impl Drop for Scratch {
        fn drop(&mut self) {
            let _ = fs::remove_dir_all(&self.0);
        }
    }
    fn no_firmware() -> MockFirmwareDetector {
        MockFirmwareDetector { detection: None }
    }
    #[tokio::test]
    async fn backend_repo_classifies_as_backend() {
        let scratch = Scratch::new();
        fs::write(scratch.0.join("go.mod"), "module x").unwrap();
        let artifact = Artifact::git_repo("https://git/x", "main");
        let mut wp = HashMap::new();
        wp.insert(artifact.id.clone(), scratch.0.clone());
        let mut target = OnboardedTarget::new("x".to_string(), TargetType::WebApp);
        target.artifacts.push(artifact);
        let c = classify_target(&target, &wp, &no_firmware())
            .await
            .expect("classify");
        assert_eq!(c.suggested, TargetType::BackendService);
        assert!(c.detected_by.contains(&"heuristic".to_string()));
        assert!(!c.confirmed);
    }
    #[tokio::test]
    async fn firmware_detector_verdict_ranks_top() {
        let scratch = Scratch::new();
        fs::write(scratch.0.join("fw.bin"), b"x").unwrap();
        let artifact =
            Artifact::firmware_image(scratch.0.join("fw.bin").to_string_lossy().to_string());
        let mut wp = HashMap::new();
        wp.insert(artifact.id.clone(), scratch.0.clone());
        let mut target = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareBareMetal);
        target.artifacts.push(artifact);
        let detector = MockFirmwareDetector {
            detection: Some(FirmwareDetection {
                provider: "zephyr".to_string(),
                confidence: "high".to_string(),
                build_system: "zephyr".to_string(),
                framework: Some("zephyr".to_string()),
                target: FirmwareTarget {
                    mcu: Some("nrf52840".to_string()),
                    ..Default::default()
                },
                gaps: vec![],
            }),
        };
        let c = classify_target(&target, &wp, &detector)
            .await
            .expect("classify");
        // tramiton's high-confidence RTOS verdict beats the weak firmware prior.
        assert_eq!(c.suggested, TargetType::FirmwareRtos);
        assert!(c.detected_by.contains(&"tramiton".to_string()));
        assert!(c.facts.iter().any(|f| f.key == "mcu"));
    }
    #[tokio::test]
    async fn no_signal_falls_back_to_declared_type() {
        let scratch = Scratch::new();
        let _ = Path::new(&scratch.0);
        let target = OnboardedTarget::new("empty".to_string(), TargetType::DesktopApp);
        let wp = HashMap::new();
        let c = classify_target(&target, &wp, &no_firmware())
            .await
            .expect("classify");
        assert_eq!(c.suggested, TargetType::DesktopApp);
        assert!(c.candidates.is_empty());
    }
 }
@@ -45,6 +45,14 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
            .unwrap_or_else(|| "0 0 * * * *".to_string()),
        git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
            .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
        // Defaults ON: the unified onboarded-target pipeline is now the primary
        // path (no legacy `repositories` data in production). Set
        // `UNIFIED_PIPELINE=0` to fall back to the legacy repository pipeline.
        unified_pipeline: env_var_opt("UNIFIED_PIPELINE")
            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
            .unwrap_or(true),
        ssh_key_path: env_var_opt("SSH_KEY_PATH")
            .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
        keycloak_url: env_var_opt("KEYCLOAK_URL"),
@@ -59,5 +67,7 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
            .unwrap_or(true),
        pentest_imap_username: env_var_opt("PENTEST_IMAP_USERNAME"),
        pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
        admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
        tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
    })
 }
@@ -141,6 +141,25 @@ impl DatabasePool {
        &self.client
    }
    /// Cross-tenant admin database used by features that intentionally
    /// span tenants (today: MCP bearer tokens — each token row carries
    /// a `tenant_id` and the MCP server reads them to route requests).
    ///
    /// The name `<db_prefix>__admin` (double underscore) is reserved —
    /// the sanitizer never produces it for a normal tenant DB because
    /// the natural format is `<db_prefix>_<sanitized_tenant_id>` (one
    /// underscore) and tenant_ids would have to start with `_admin` to
    /// collide. New tenant provisioning should reject such ids.
    pub fn admin_db(&self) -> mongodb::Database {
        self.client.database(&self.admin_db_name())
    }
    /// Name of the admin database — public so tests / operators can
    /// drop it via the raw client.
    pub fn admin_db_name(&self) -> String {
        format!("{}__admin", self.db_prefix)
    }
    /// List every Mongo database currently belonging to this pool,
    /// identified by the `<db_prefix>_` prefix. The result is the raw
    /// database names — opening one for offboarding/cleanup goes
@@ -160,6 +179,23 @@ impl DatabasePool {
            .collect())
    }
    /// Tenant ids for every provisioned tenant database, derived by stripping
    /// the `<prefix>_` from the database names. Skips the admin database
    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
    /// at the cluster level and cannot be recovered here — in practice tenant
    /// ids are UUIDs and never hit that path. Used by the migration CLI's
    /// `--all` mode.
    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
        let prefix = format!("{}_", self.db_prefix);
        Ok(self
            .list_tenant_db_names()
            .await?
            .into_iter()
            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
            .filter(|id| !id.starts_with('_'))
            .collect())
    }
    /// Drop the database for a specific tenant. Used by GDPR delete
    /// and tenant offboarding. Idempotent — dropping a non-existent
    /// database is a no-op at the driver level.
@@ -409,6 +445,36 @@ impl Database {
            )
            .await?;
        // onboarded_targets: multikey on artifact source ref (webhook + dedupe
        // lookup). Non-unique — "one git URL per tenant" is enforced in the
        // create handler, since a unique multikey index on an array field has
        // null-collision caveats.
        self.onboarded_targets()
            .create_index(
                IndexModel::builder()
                    .keys(doc! { "artifacts.source_ref": 1 })
                    .build(),
            )
            .await?;
        // onboarded_targets: multikey on artifact kind
        self.onboarded_targets()
            .create_index(
                IndexModel::builder()
                    .keys(doc! { "artifacts.kind": 1 })
                    .build(),
            )
            .await?;
        // onboarded_targets: target_type filter
        self.onboarded_targets()
            .create_index(
                IndexModel::builder()
                    .keys(doc! { "target_type": 1 })
                    .build(),
            )
            .await?;
        tracing::info!("Database indexes ensured");
        Ok(())
    }
@@ -465,6 +531,20 @@ impl Database {
        self.inner.collection("dast_targets")
    }
    /// The unified onboarding targets that replace `repositories` and
    /// `dast_targets`. Ids are preserved from the legacy collections during
    /// migration so downstream `repo_id` / `target_id` references keep resolving.
    pub fn onboarded_targets(&self) -> Collection<OnboardedTarget> {
        self.inner.collection("onboarded_targets")
    }
    /// A typed handle to an arbitrary collection by name. For bookkeeping
    /// collections without a dedicated model (e.g. `schema_migrations`,
    /// `onboarding_migration_log`).
    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
        self.inner.collection(name)
    }
    pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
        self.inner.collection("dast_scan_runs")
    }
@@ -0,0 +1,154 @@
 //! Content-addressed blob storage and archive extraction for ingest.
 //!
 //! Blobs are stored at `<base>/blobs/<sha[0:2]>/<sha>` and deduplicated by
 //! digest; per-run working directories live under `<base>/work/`.
 use std::fs::{self, File};
 use std::io::{self, Read};
 use std::path::{Path, PathBuf};
 use sha2::{Digest, Sha256};
 use crate::error::AgentError;
 /// Read buffer size for streaming hashes/copies (64 KiB).
 const BUF_LEN: usize = 64 * 1024;
 /// Stream-hash a file with SHA-256, returning the lowercase-hex digest and the
 /// byte length. Streams so large firmware images never load fully into memory.
 pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
    let mut file = File::open(path)?;
    let mut hasher = Sha256::new();
    let mut buf = [0u8; BUF_LEN];
    let mut total: u64 = 0;
    loop {
        let n = file.read(&mut buf)?;
        if n == 0 {
            break;
        }
        hasher.update(&buf[..n]);
        total += n as u64;
    }
    Ok((hex::encode(hasher.finalize()), total))
 }
 /// Copy `src` into the content-addressed blob store under `base`, returning the
 /// stored path. Idempotent: an already-present blob is not rewritten.
 pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
    if sha.len() < 2 {
        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
    }
    let dir = base.join("blobs").join(&sha[0..2]);
    fs::create_dir_all(&dir)?;
    let dest = dir.join(sha);
    if !dest.exists() {
        fs::copy(src, &dest)?;
    }
    Ok(dest)
 }
 /// Extract a zip archive into `dest` (created if needed). `enclosed_name`
 /// sanitizes each entry path, so this is safe against zip-slip traversal.
 pub fn extract_zip(archive: &Path, dest: &Path) -> Result<(), AgentError> {
    let file = File::open(archive)?;
    let mut zip =
        zip::ZipArchive::new(file).map_err(|e| AgentError::Other(format!("open zip: {e}")))?;
    fs::create_dir_all(dest)?;
    for i in 0..zip.len() {
        let mut entry = zip
            .by_index(i)
            .map_err(|e| AgentError::Other(format!("read zip entry: {e}")))?;
        // `enclosed_name` returns `None` for traversal-unsafe paths — skip them.
        let Some(rel) = entry.enclosed_name() else {
            continue;
        };
        let out = dest.join(rel);
        if entry.is_dir() {
            fs::create_dir_all(&out)?;
        } else {
            if let Some(parent) = out.parent() {
                fs::create_dir_all(parent)?;
            }
            let mut outfile = File::create(&out)?;
            io::copy(&mut entry, &mut outfile)?;
        }
    }
    Ok(())
 }
 /// The working directory for one artifact of a target: `<base>/work/<target>/<artifact>`.
 pub fn work_dir(base: &Path, target_id: &str, artifact_id: &str) -> PathBuf {
    base.join("work").join(target_id).join(artifact_id)
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    /// A unique scratch directory, removed on drop.
    struct Scratch(PathBuf);
    impl Scratch {
        fn new() -> Self {
            let p = std::env::temp_dir().join(format!("cs-ingest-{}", uuid::Uuid::new_v4()));
            fs::create_dir_all(&p).expect("mkdir scratch");
            Self(p)
        }
        fn path(&self) -> &Path {
            &self.0
        }
    }
    impl Drop for Scratch {
        fn drop(&mut self) {
            let _ = fs::remove_dir_all(&self.0);
        }
    }
    #[test]
    fn hash_is_stable_and_reports_size() {
        let dir = Scratch::new();
        let f = dir.path().join("a.bin");
        fs::write(&f, b"hello world").expect("write");
        let (sha, size) = hash_file(&f).expect("hash");
        assert_eq!(size, 11);
        // Known SHA-256 of "hello world".
        assert_eq!(
            sha,
            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
        );
    }
    #[test]
    fn store_is_content_addressed_and_idempotent() {
        let base = Scratch::new();
        let src = base.path().join("src.bin");
        fs::write(&src, b"payload").expect("write");
        let (sha, _) = hash_file(&src).expect("hash");
        let p1 = store_file(base.path(), &src, &sha).expect("store");
        let p2 = store_file(base.path(), &src, &sha).expect("store again");
        assert_eq!(p1, p2);
        assert!(p1.ends_with(&sha));
        assert!(p1.starts_with(base.path().join("blobs").join(&sha[0..2])));
        assert_eq!(fs::read(&p1).expect("read"), b"payload");
    }
    #[test]
    fn extract_zip_writes_entries() {
        let base = Scratch::new();
        let archive = base.path().join("a.zip");
        {
            let file = File::create(&archive).expect("create");
            let mut w = zip::ZipWriter::new(file);
            let opts: zip::write::SimpleFileOptions = Default::default();
            w.start_file("dir/hello.txt", opts).expect("start");
            io::Write::write_all(&mut w, b"hi").expect("write");
            w.finish().expect("finish");
        }
        let dest = base.path().join("out");
        extract_zip(&archive, &dest).expect("extract");
        assert_eq!(
            fs::read_to_string(dest.join("dir/hello.txt")).expect("read"),
            "hi"
        );
    }
 }
@@ -0,0 +1,334 @@
 //! Artifact ingest.
 //!
 //! Normalizes each [`Artifact`] on an [`OnboardedTarget`] into a local working
 //! path plus recorded metadata (content hash, size, discovered facts) that the
 //! classifier and scanners consume. Every blob is SHA-256 hashed — that digest
 //! is also the reconciliation key against sibling products (a firmware sha256
 //! matches tramiton's `Artifact.sha256`).
 mod blob;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use compliance_core::models::{Artifact, ArtifactKind, DetectedFact, OnboardedTarget};
 use compliance_core::AgentConfig;
 use crate::error::AgentError;
 use crate::pipeline::git::{GitOps, RepoCredentials};
 /// The paths and identifiers an ingest needs. Decoupled from the full
 /// [`AgentConfig`] so ingest is testable without a complete config.
 pub struct IngestContext<'a> {
    /// Base directory for content-addressed blobs and working dirs.
    pub artifact_store_base: &'a Path,
    /// Base directory for git clones.
    pub git_clone_base: &'a str,
    /// Default SSH key path (used when an artifact provides none).
    pub ssh_key_path: &'a str,
    /// The id of the target these artifacts belong to (namespaces working dirs).
    pub target_id: &'a str,
 }
 impl<'a> IngestContext<'a> {
    /// Build an ingest context from the agent config for a given target.
    pub fn from_config(config: &'a AgentConfig, target_id: &'a str) -> Self {
        Self {
            artifact_store_base: Path::new(&config.artifact_store_base_path),
            git_clone_base: &config.git_clone_base_path,
            ssh_key_path: &config.ssh_key_path,
            target_id,
        }
    }
 }
 /// The result of ingesting one artifact.
 pub struct IngestedArtifact {
    /// The artifact this corresponds to ([`Artifact::id`]).
    pub artifact_id: String,
    /// The artifact kind.
    pub kind: ArtifactKind,
    /// Local working path (clone dir, extracted dir, or blob file). `None` for
    /// artifacts with no on-disk form (live URL, plaintext, container ref).
    pub working_path: Option<PathBuf>,
    /// SHA-256 of the content (blobs) or git head SHA (git repos).
    pub content_hash: Option<String>,
    /// Stored blob size in bytes, when applicable.
    pub size_bytes: Option<u64>,
    /// Facts discovered during ingest.
    pub facts: Vec<DetectedFact>,
 }
 /// All ingested artifacts for a target, keyed by artifact id.
 pub struct IngestSet {
    /// The ingested artifacts, keyed by [`Artifact::id`].
    pub by_artifact: HashMap<String, IngestedArtifact>,
 }
 impl IngestSet {
    /// The working paths of every ingested artifact that has one — the input the
    /// classifier expects.
    pub fn working_paths(&self) -> HashMap<String, PathBuf> {
        self.by_artifact
            .iter()
            .filter_map(|(id, a)| a.working_path.clone().map(|p| (id.clone(), p)))
            .collect()
    }
    /// The ingest result for a specific artifact.
    pub fn get(&self, artifact_id: &str) -> Option<&IngestedArtifact> {
        self.by_artifact.get(artifact_id)
    }
 }
 /// Ingest every artifact on a target.
 pub fn ingest_all(
    target: &OnboardedTarget,
    ctx: &IngestContext<'_>,
 ) -> Result<IngestSet, AgentError> {
    let mut by_artifact = HashMap::new();
    for artifact in &target.artifacts {
        let ingested = ingest_artifact(artifact, ctx)?;
        by_artifact.insert(artifact.id.clone(), ingested);
    }
    Ok(IngestSet { by_artifact })
 }
 /// Ingest a single artifact, dispatching on its kind.
 pub fn ingest_artifact(
    artifact: &Artifact,
    ctx: &IngestContext<'_>,
 ) -> Result<IngestedArtifact, AgentError> {
    match artifact.kind {
        ArtifactKind::GitRepo => ingest_git(artifact, ctx),
        ArtifactKind::SourceArchive | ArtifactKind::MobilePackage | ArtifactKind::PlcProject => {
            ingest_blob(artifact, ctx, true)
        }
        ArtifactKind::FirmwareImage => ingest_blob(artifact, ctx, false),
        ArtifactKind::ContainerImage => Ok(metadata_only(
            artifact,
            DetectedFact::new("container_ref", artifact.source_ref.as_str(), "ingest"),
        )),
        ArtifactKind::LiveUrl => Ok(metadata_only(
            artifact,
            DetectedFact::new("live_url", artifact.source_ref.as_str(), "ingest"),
        )),
        ArtifactKind::PlaintextDescription => Ok(metadata_only(
            artifact,
            DetectedFact::new(
                "description_len",
                artifact.source_ref.len().to_string(),
                "ingest",
            ),
        )),
    }
 }
 /// Clone (or fetch) a git artifact, recording the head SHA as the content hash.
 fn ingest_git(
    artifact: &Artifact,
    ctx: &IngestContext<'_>,
 ) -> Result<IngestedArtifact, AgentError> {
    let creds = credentials_for(artifact, ctx.ssh_key_path);
    let git_ops = GitOps::new(ctx.git_clone_base, creds);
    let repo_path = git_ops.clone_or_fetch(&artifact.source_ref, &artifact.id)?;
    let head = GitOps::get_head_sha(&repo_path).ok();
    Ok(IngestedArtifact {
        artifact_id: artifact.id.clone(),
        kind: artifact.kind,
        working_path: Some(repo_path),
        content_hash: head,
        size_bytes: None,
        facts: Vec::new(),
    })
 }
 /// Store a blob artifact content-addressed. When `extract` is set and the blob
 /// is a zip container (source archive, APK/AAB/IPA), also unpack it into a
 /// working directory; otherwise the working path is the stored blob.
 fn ingest_blob(
    artifact: &Artifact,
    ctx: &IngestContext<'_>,
    extract: bool,
 ) -> Result<IngestedArtifact, AgentError> {
    let base = ctx.artifact_store_base;
    let src = local_source(artifact)?;
    let (sha, size) = blob::hash_file(&src)?;
    let stored = blob::store_file(base, &src, &sha)?;
    let mut facts = Vec::new();
    let working_path = if extract {
        let dest = blob::work_dir(base, ctx.target_id, &artifact.id);
        match blob::extract_zip(&stored, &dest) {
            Ok(()) => dest,
            Err(e) => {
                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
                // note it so later stages can decide what to do.
                facts.push(DetectedFact::new(
                    "archive_unextracted",
                    e.to_string(),
                    "ingest",
                ));
                stored.clone()
            }
        }
    } else {
        stored.clone()
    };
    Ok(IngestedArtifact {
        artifact_id: artifact.id.clone(),
        kind: artifact.kind,
        working_path: Some(working_path),
        content_hash: Some(sha),
        size_bytes: Some(size),
        facts,
    })
 }
 /// An artifact with no on-disk form: record a single fact, no hash/path.
 fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
    IngestedArtifact {
        artifact_id: artifact.id.clone(),
        kind: artifact.kind,
        working_path: None,
        content_hash: None,
        size_bytes: None,
        facts: vec![fact],
    }
 }
 /// The local file backing a blob artifact: its `stored_path` if already
 /// uploaded, else its `source_ref` interpreted as a filesystem path.
 fn local_source(artifact: &Artifact) -> Result<PathBuf, AgentError> {
    let path = artifact
        .stored_path
        .as_deref()
        .unwrap_or(artifact.source_ref.as_str());
    let path = PathBuf::from(path);
    if !path.exists() {
        return Err(AgentError::Other(format!(
            "artifact {} source not found at {}",
            artifact.id,
            path.display()
        )));
    }
    Ok(path)
 }
 /// Build git credentials from an artifact's auth plus a default SSH key path.
 fn credentials_for(artifact: &Artifact, default_ssh_key_path: &str) -> RepoCredentials {
    let auth = artifact.auth.as_ref();
    RepoCredentials {
        ssh_key_path: auth
            .and_then(|a| a.ssh_key_path.clone())
            .or_else(|| Some(default_ssh_key_path.to_string())),
        auth_token: auth.and_then(|a| a.secret.clone()),
        auth_username: auth.and_then(|a| a.username.clone()),
    }
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use compliance_core::models::{ArtifactAuth, TargetType};
    /// A unique scratch directory, removed on drop.
    struct Scratch(PathBuf);
    impl Scratch {
        fn new() -> Self {
            let p = std::env::temp_dir().join(format!("cs-ingest-mod-{}", uuid::Uuid::new_v4()));
            std::fs::create_dir_all(&p).expect("mkdir scratch");
            Self(p)
        }
    }
    impl Drop for Scratch {
        fn drop(&mut self) {
            let _ = std::fs::remove_dir_all(&self.0);
        }
    }
    fn ctx_for<'a>(store: &'a Path, target_id: &'a str) -> IngestContext<'a> {
        IngestContext {
            artifact_store_base: store,
            git_clone_base: "/tmp/cs-ingest-test-repos",
            ssh_key_path: "/tmp/cs-ingest-test-ssh",
            target_id,
        }
    }
    #[test]
    fn firmware_blob_is_hashed_and_stored() {
        let scratch = Scratch::new();
        let store = scratch.0.join("store");
        let fw = scratch.0.join("fw.bin");
        std::fs::write(&fw, b"firmware-bytes").expect("write");
        let ctx = ctx_for(&store, "t1");
        let artifact = Artifact::firmware_image(fw.to_string_lossy().to_string());
        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
        assert_eq!(out.kind, ArtifactKind::FirmwareImage);
        assert_eq!(out.size_bytes, Some(14));
        let sha = out.content_hash.expect("hash");
        assert_eq!(sha.len(), 64);
        // working path is the content-addressed blob
        let wp = out.working_path.expect("working path");
        assert!(wp.starts_with(store.join("blobs")));
    }
    #[test]
    fn live_url_has_no_blob() {
        let scratch = Scratch::new();
        let store = scratch.0.join("store");
        let ctx = ctx_for(&store, "t1");
        let artifact = Artifact::live_url("https://example.com");
        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
        assert!(out.working_path.is_none());
        assert!(out.content_hash.is_none());
        assert!(out.facts.iter().any(|f| f.key == "live_url"));
    }
    #[test]
    fn ingest_all_collects_working_paths() {
        let scratch = Scratch::new();
        let store = scratch.0.join("store");
        let fw = scratch.0.join("fw.bin");
        std::fs::write(&fw, b"abc").expect("write");
        let ctx = ctx_for(&store, "t1");
        let mut target = OnboardedTarget::new("t".to_string(), TargetType::FirmwareBareMetal);
        target
            .artifacts
            .push(Artifact::firmware_image(fw.to_string_lossy().to_string()));
        target.artifacts.push(Artifact::live_url("https://x"));
        let set = ingest_all(&target, &ctx).expect("ingest all");
        assert_eq!(set.by_artifact.len(), 2);
        // Only the firmware artifact yields a working path.
        assert_eq!(set.working_paths().len(), 1);
    }
    #[test]
    fn credentials_prefer_artifact_auth() {
        let mut artifact = Artifact::git_repo("https://git/x", "main");
        artifact.auth = Some(ArtifactAuth {
            method: "token".to_string(),
            username: Some("bob".to_string()),
            secret: Some("pat".to_string()),
            ..Default::default()
        });
        let creds = credentials_for(&artifact, "/default/ssh/key");
        assert_eq!(creds.auth_token.as_deref(), Some("pat"));
        assert_eq!(creds.auth_username.as_deref(), Some("bob"));
    }
    #[test]
    fn credentials_fall_back_to_default_ssh_key() {
        let artifact = Artifact::git_repo("git@host:x.git", "main");
        let creds = credentials_for(&artifact, "/default/ssh/key");
        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
        assert!(creds.auth_token.is_none());
    }
 }
@@ -2,10 +2,13 @@
 pub mod agent;
 pub mod api;
 pub mod classify;
 pub mod config;
 pub mod database;
 pub mod error;
 pub mod ingest;
 pub mod llm;
 pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;
@@ -1,4 +1,50 @@
-use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
+use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
 /// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
 /// unified `onboarded_targets` collection per tenant.
 ///
 /// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
 async fn run_migration(
    args: &[String],
    pool: &database::DatabasePool,
 ) -> Result<(), compliance_agent::error::AgentError> {
    if args.get(2).map(String::as_str) != Some("onboarding") {
        eprintln!(
            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
        );
        std::process::exit(2);
    }
    let has = |flag: &str| args.iter().any(|a| a == flag);
    let dry_run = has("--dry-run");
    let revert = has("--revert");
    let tenant = args
        .iter()
        .position(|a| a == "--tenant")
        .and_then(|i| args.get(i + 1))
        .cloned();
    let tenants: Vec<String> = if has("--all") {
        pool.list_tenant_ids().await?
    } else if let Some(t) = tenant {
        vec![t]
    } else {
        eprintln!("specify --all or --tenant <id>");
        std::process::exit(2);
    };
    for tenant_id in tenants {
        let db = pool.for_tenant_id(&tenant_id).await?;
        if revert {
            migrate::onboarding::revert(&db).await?;
            println!("[{tenant_id}] reverted onboarding backfill");
        } else {
            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
            let prefix = if dry_run { "(dry-run) " } else { "" };
            println!("[{tenant_id}] {prefix}{report:?}");
        }
    }
    Ok(())
 }
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -31,6 +77,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let db_pool =
        database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
    // One-shot subcommands run and exit without starting the servers.
    let args: Vec<String> = std::env::args().collect();
    if args.get(1).map(String::as_str) == Some("migrate") {
        run_migration(&args, &db_pool).await?;
        return Ok(());
    }
    let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
    tracing::info!("Starting scheduler...");
@@ -0,0 +1,8 @@
 //! One-time data migrations.
 //!
 //! Currently just the onboarding backfill ([`onboarding`]), which folds the
 //! legacy `repositories` and `dast_targets` collections into the unified
 //! `onboarded_targets` collection, preserving `_id` so every downstream record
 //! keyed by `repo_id` / `target_id` keeps resolving.
 pub mod onboarding;
@@ -0,0 +1,406 @@
 //! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
 //!
 //! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
 //! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
 //! downstream collection keyed by that hex id (findings, sbom, scan_runs,
 //! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
 //! existing webhook URLs keep working. The mapping functions are pure and unit
 //! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
 //! thin driver over them.
 use compliance_core::models::{
    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
 };
 use futures_util::TryStreamExt;
 use mongodb::bson::{doc, Document};
 use crate::database::Database;
 use crate::error::AgentError;
 /// Marker id in `schema_migrations` recording that the backfill has run.
 const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
 /// Summary of a backfill run.
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct MigrationReport {
    /// Repositories turned into onboarded targets.
    pub repos_migrated: u64,
    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
    pub dast_targets_folded: u64,
    /// DAST targets with no repo link, migrated as standalone targets.
    pub dast_targets_standalone: u64,
    /// Records skipped because a target with that `_id` already existed.
    pub skipped_existing: u64,
 }
 /// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
 /// are backend services; a browser app is a web app.
 fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
    match kind {
        DastTargetType::WebApp => TargetType::WebApp,
        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
    }
 }
 /// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
 /// auth). Shared by fold-in and standalone migration.
 pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
    let mut artifact = Artifact::live_url(dast.base_url.clone());
    artifact.web = Some(WebArtifactConfig {
        target_kind: dast.target_type.clone(),
        excluded_paths: dast.excluded_paths.clone(),
        max_crawl_depth: dast.max_crawl_depth,
        rate_limit: dast.rate_limit,
        allow_destructive: dast.allow_destructive,
    });
    artifact.auth = dast.auth_config.clone().map(Into::into);
    artifact
 }
 /// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
 /// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
 /// and auth; tracker config folds into `scan_config`.
 ///
 /// `target_type` is a safe default (`BackendService`) — the classifier can
 /// refine it later; `classification` is left `None` (unconfirmed).
 pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
    target.id = repo.id;
    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
    artifact.git = Some(GitArtifactConfig {
        default_branch: repo.default_branch.clone(),
        last_scanned_commit: repo.last_scanned_commit.clone(),
        local_path: repo.local_path.clone(),
    });
    if repo.auth_token.is_some() || repo.auth_username.is_some() {
        artifact.auth = Some(compliance_core::models::ArtifactAuth {
            method: "token".to_string(),
            username: repo.auth_username.clone(),
            secret: repo.auth_token.clone(),
            ..Default::default()
        });
    }
    target.artifacts.push(artifact);
    if repo.tracker_type.is_some() {
        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
            tracker_type: repo.tracker_type.clone(),
            owner: repo.tracker_owner.clone(),
            repo: repo.tracker_repo.clone(),
            token: repo.tracker_token.clone(),
        });
    }
    target.scan_schedule = repo.scan_schedule.clone();
    target.webhook_enabled = repo.webhook_enabled;
    target.webhook_secret = repo.webhook_secret.clone();
    target.findings_count = repo.findings_count;
    target.created_at = repo.created_at;
    target.updated_at = repo.updated_at;
    target
 }
 /// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
 /// target. If the repo default was `BackendService` but the DAST target is a
 /// browser web app, promote the type to `WebApp`.
 pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
    if matches!(dast.target_type, DastTargetType::WebApp)
        && target.target_type == TargetType::BackendService
    {
        target.target_type = TargetType::WebApp;
    }
    if !target.has(ArtifactKind::LiveUrl) {
        target.artifacts.push(dast_to_artifact(dast));
    }
 }
 /// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
 pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
    let mut target =
        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
    target.id = dast.id;
    target.artifacts.push(dast_to_artifact(dast));
    target.created_at = dast.created_at;
    target.updated_at = dast.updated_at;
    target
 }
 /// Whether the onboarding backfill has already been applied to this database.
 pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
    let found = db
        .collection_named::<Document>("schema_migrations")
        .find_one(doc! { "_id": MIGRATION_MARKER })
        .await?;
    Ok(found.is_some())
 }
 /// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
 /// tenant database.
 ///
 /// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
 /// skipped, so re-running is safe. With `dry_run`, computes the report without
 /// writing. The legacy collections are never deleted; the only mutation outside
 /// `onboarded_targets` is the history relink of folded DAST targets, which is
 /// logged so [`revert`] can undo it.
 pub async fn backfill_onboarded_targets(
    db: &Database,
    dry_run: bool,
 ) -> Result<MigrationReport, AgentError> {
    let mut report = MigrationReport::default();
    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
    let mut repos = db.repositories().find(doc! {}).await?;
    while let Some(repo) = repos.try_next().await? {
        let Some(id) = repo.id else { continue };
        if db
            .onboarded_targets()
            .find_one(doc! { "_id": id })
            .await?
            .is_some()
        {
            report.skipped_existing += 1;
            continue;
        }
        if !dry_run {
            db.onboarded_targets()
                .insert_one(repo_to_target(&repo))
                .await?;
        }
        report.repos_migrated += 1;
    }
    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
    let mut dasts = db.dast_targets().find(doc! {}).await?;
    while let Some(dast) = dasts.try_next().await? {
        let Some(dast_id) = dast.id else { continue };
        let repo_oid = dast
            .repo_id
            .as_deref()
            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
        let linked = match repo_oid {
            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
            None => None,
        };
        match (linked, repo_oid) {
            // Fold into an existing repo-derived target.
            (Some(mut target), Some(oid)) => {
                if target.has(ArtifactKind::LiveUrl) {
                    report.skipped_existing += 1; // already folded on a prior run
                    continue;
                }
                fold_dast_into_target(&mut target, &dast);
                if !dry_run {
                    db.onboarded_targets()
                        .replace_one(doc! { "_id": oid }, &target)
                        .await?;
                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
                }
                report.dast_targets_folded += 1;
            }
            // No linked repo target: migrate as a standalone target (keeps _id).
            _ => {
                if db
                    .onboarded_targets()
                    .find_one(doc! { "_id": dast_id })
                    .await?
                    .is_some()
                {
                    report.skipped_existing += 1;
                    continue;
                }
                if !dry_run {
                    db.onboarded_targets()
                        .insert_one(dast_to_standalone_target(&dast))
                        .await?;
                }
                report.dast_targets_standalone += 1;
            }
        }
    }
    if !dry_run {
        db.collection_named::<Document>("schema_migrations")
            .update_one(
                doc! { "_id": MIGRATION_MARKER },
                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
            )
            .upsert(true)
            .await?;
    }
    Ok(report)
 }
 /// Relink DAST scan runs and pentest sessions from the old DAST target id to the
 /// unified target id, logging each move so [`revert`] can undo it.
 ///
 /// Note: if multiple DAST targets fold into the same repo target, revert
 /// restores only the last-logged mapping — a rare edge. The source collections
 /// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
 async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
    db.dast_scan_runs()
        .update_many(
            doc! { "target_id": old_id },
            doc! { "$set": { "target_id": new_id } },
        )
        .await?;
    db.pentest_sessions()
        .update_many(
            doc! { "target_id": old_id },
            doc! { "$set": { "target_id": new_id } },
        )
        .await?;
    db.collection_named::<Document>("onboarding_migration_log")
        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
        .await?;
    Ok(())
 }
 /// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
 /// and the log, and clear the marker. The legacy collections are untouched, so
 /// this restores the pre-migration state.
 pub async fn revert(db: &Database) -> Result<(), AgentError> {
    let log = db.collection_named::<Document>("onboarding_migration_log");
    let mut cursor = log.find(doc! {}).await?;
    while let Some(entry) = cursor.try_next().await? {
        if let (Ok(old), Ok(new)) = (
            entry.get_str("old_target_id"),
            entry.get_str("new_target_id"),
        ) {
            db.dast_scan_runs()
                .update_many(
                    doc! { "target_id": new },
                    doc! { "$set": { "target_id": old } },
                )
                .await?;
            db.pentest_sessions()
                .update_many(
                    doc! { "target_id": new },
                    doc! { "$set": { "target_id": old } },
                )
                .await?;
        }
    }
    db.onboarded_targets().drop().await?;
    log.drop().await?;
    db.collection_named::<Document>("schema_migrations")
        .delete_one(doc! { "_id": MIGRATION_MARKER })
        .await?;
    Ok(())
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use compliance_core::models::{DastAuthConfig, TrackerType};
    fn repo() -> TrackedRepository {
        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
        r.id = Some(mongodb::bson::oid::ObjectId::new());
        r.default_branch = "develop".to_string();
        r.last_scanned_commit = Some("abc123".to_string());
        r.auth_token = Some("pat".to_string());
        r.auth_username = Some("bob".to_string());
        r.tracker_type = Some(TrackerType::Gitea);
        r.tracker_owner = Some("acme".to_string());
        r.findings_count = 7;
        r
    }
    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
        let mut d = DastTarget::new(
            "acme-web".to_string(),
            "https://acme.example.com".to_string(),
            kind,
        );
        d.id = Some(mongodb::bson::oid::ObjectId::new());
        d.repo_id = repo_id;
        d.max_crawl_depth = 5;
        d.auth_config = Some(DastAuthConfig {
            method: "bearer".to_string(),
            login_url: None,
            username: None,
            password: None,
            token: Some("tok".to_string()),
            headers: None,
        });
        d
    }
    #[test]
    fn repo_maps_preserving_id_and_git_artifact() {
        let r = repo();
        let t = repo_to_target(&r);
        assert_eq!(t.id, r.id); // id preserved
        assert_eq!(t.findings_count, 7);
        assert_eq!(t.scan_schedule, r.scan_schedule);
        let git = t.code_artifact().expect("git artifact");
        assert_eq!(git.kind, ArtifactKind::GitRepo);
        assert_eq!(git.source_ref, "https://git/acme.git");
        let gc = git.git.as_ref().expect("git config");
        assert_eq!(gc.default_branch, "develop");
        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
        let auth = git.auth.as_ref().expect("auth");
        assert_eq!(auth.secret.as_deref(), Some("pat"));
        assert_eq!(auth.username.as_deref(), Some("bob"));
        assert_eq!(
            t.scan_config
                .issue_tracker
                .as_ref()
                .and_then(|it| it.tracker_type.clone()),
            Some(TrackerType::Gitea)
        );
    }
    #[test]
    fn standalone_dast_maps_preserving_id_and_live_url() {
        let d = dast(None, DastTargetType::WebApp);
        let t = dast_to_standalone_target(&d);
        assert_eq!(t.id, d.id);
        assert_eq!(t.target_type, TargetType::WebApp);
        let url = t.live_url().expect("live url");
        assert_eq!(url.source_ref, "https://acme.example.com");
        let web = url.web.as_ref().expect("web config");
        assert_eq!(web.max_crawl_depth, 5);
        assert_eq!(
            url.auth.as_ref().and_then(|a| a.secret.clone()),
            Some("tok".to_string())
        );
    }
    #[test]
    fn rest_api_dast_maps_to_backend_service() {
        let d = dast(None, DastTargetType::RestApi);
        assert_eq!(
            dast_to_standalone_target(&d).target_type,
            TargetType::BackendService
        );
    }
    #[test]
    fn fold_adds_live_url_and_promotes_webapp() {
        let mut t = repo_to_target(&repo());
        assert_eq!(t.target_type, TargetType::BackendService);
        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
        assert_eq!(t.target_type, TargetType::WebApp); // promoted
        assert!(t.has(ArtifactKind::LiveUrl));
        assert!(t.has(ArtifactKind::GitRepo));
    }
    #[test]
    fn fold_is_idempotent_on_live_url() {
        let mut t = repo_to_target(&repo());
        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
        fold_dast_into_target(&mut t, &d);
        fold_dast_into_target(&mut t, &d);
        let live_urls = t
            .artifacts
            .iter()
            .filter(|a| a.kind == ArtifactKind::LiveUrl)
            .count();
        assert_eq!(live_urls, 1);
    }
 }
@@ -328,6 +328,7 @@ mod tests {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: String::new(),
            artifact_store_base_path: String::new(),
            ssh_key_path: String::new(),
            keycloak_url: None,
            keycloak_realm: None,
@@ -339,6 +340,9 @@ mod tests {
            pentest_imap_tls: true,
            pentest_imap_username: None,
            pentest_imap_password: None,
            admin_api_token: None,
            tenant_registry_url: None,
            unified_pipeline: false,
        }
    }
@@ -8,6 +8,7 @@ mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
 pub mod plan;
 mod pr_review;
 pub mod sbom;
 pub mod semgrep;
@@ -15,6 +15,7 @@ use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
 use crate::pipeline::plan::build_scan_plan;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
@@ -419,6 +420,260 @@ impl PipelineOrchestrator {
        Ok(new_count)
    }
    /// Unified entry point (behind `UNIFIED_PIPELINE`): run a scan for an
    /// `OnboardedTarget`. Mirrors [`Self::run`] but sources the target from
    /// `onboarded_targets` and dispatches by the scan plan.
    #[tracing::instrument(skip_all, fields(target_id = %target_id, trigger = ?trigger))]
    pub async fn run_target(
        &self,
        target_id: &str,
        trigger: ScanTrigger,
    ) -> Result<(), AgentError> {
        let oid = mongodb::bson::oid::ObjectId::parse_str(target_id)
            .map_err(|e| AgentError::Other(e.to_string()))?;
        let target = self
            .db
            .onboarded_targets()
            .find_one(doc! { "_id": oid })
            .await?
            .ok_or_else(|| AgentError::Other(format!("Onboarded target {target_id} not found")))?;
        let scan_run = ScanRun::new(target_id.to_string(), trigger);
        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
        let scan_run_id = insert
            .inserted_id
            .as_object_id()
            .map(|id| id.to_hex())
            .unwrap_or_default();
        let result = self.run_target_pipeline(&target, &scan_run_id).await;
        match &result {
            Ok(count) => {
                self.db
                    .scan_runs()
                    .update_one(
                        doc! { "_id": &insert.inserted_id },
                        doc! { "$set": {
                            "status": "completed",
                            "current_phase": "completed",
                            "new_findings_count": *count as i64,
                            "completed_at": mongodb::bson::DateTime::now(),
                        } },
                    )
                    .await?;
            }
            Err(e) => {
                tracing::error!(target_id, error = %e, "Unified scan pipeline failed");
                self.db
                    .scan_runs()
                    .update_one(
                        doc! { "_id": &insert.inserted_id },
                        doc! { "$set": {
                            "status": "failed",
                            "error_message": e.to_string(),
                            "completed_at": mongodb::bson::DateTime::now(),
                        } },
                    )
                    .await?;
            }
        }
        result.map(|_| ())
    }
    /// Run the applicable scans for a target. For a code target this reuses the
    /// full legacy pipeline over the code artifact (clone → SAST umbrella →
    /// triage → persist → issues → DAST); firmware/PLC/mobile scanners are
    /// follow-ups (#128/#129/#130). Returns the number of new findings.
    async fn run_target_pipeline(
        &self,
        target: &OnboardedTarget,
        scan_run_id: &str,
    ) -> Result<u32, AgentError> {
        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
        let plan = build_scan_plan(target);
        tracing::info!(
            target_id = %target_id,
            target_type = %target.target_type,
            planned_steps = plan.steps.len(),
            "Unified pipeline: scan plan built"
        );
        // Ingest + classify (tramiton for firmware) and store the detected type.
        self.classify_and_store(target, &target_id, scan_run_id)
            .await;
        // Provision a DAST target from a LiveUrl artifact so DAST fires for
        // wizard-created targets, not just migrated ones.
        self.ensure_dast_target(target, &plan).await;
        match target.code_artifact() {
            Some(code) if code.kind == ArtifactKind::GitRepo => {
                let repo = repo_view_from_target(target, code);
                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
                self.finalize_target(target, &repo, new_count).await?;
                Ok(new_count)
            }
            Some(_) => {
                tracing::warn!(
                    target_id = %target_id,
                    "Unified pipeline: source-archive scanning not yet wired; skipping"
                );
                Ok(0)
            }
            None => {
                // No code to scan. Firmware/PLC/mobile static scanners land in
                // #128/#129/#130; DAST for a running URL still works when a
                // DastTarget row exists (migrated targets).
                tracing::info!(
                    target_id = %target_id,
                    "Unified pipeline: no code artifact; attempting DAST only"
                );
                self.update_phase(scan_run_id, "dast_scanning").await;
                self.maybe_trigger_dast(&target_id, scan_run_id).await;
                Ok(0)
            }
        }
    }
    /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
    /// heuristics otherwise), and store the detected classification on the target.
    /// Best-effort — never fails the scan.
    async fn classify_and_store(
        &self,
        target: &OnboardedTarget,
        target_id: &str,
        scan_run_id: &str,
    ) {
        self.update_phase(scan_run_id, "classification").await;
        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
        let ingest_set = match crate::ingest::ingest_all(target, &ctx) {
            Ok(set) => set,
            Err(e) => {
                tracing::warn!(target_id, error = %e, "Unified pipeline: ingest for classification failed");
                return;
            }
        };
        let working_paths = ingest_set.working_paths();
        match crate::classify::classify_target(
            target,
            &working_paths,
            &crate::classify::TramitonNative,
        )
        .await
        {
            Ok(classification) => {
                tracing::info!(
                    target_id,
                    suggested = %classification.suggested,
                    "Unified pipeline: classified target"
                );
                if let (Some(oid), Ok(bson)) = (target.id, mongodb::bson::to_bson(&classification))
                {
                    let _ = self
                        .db
                        .onboarded_targets()
                        .update_one(
                            doc! { "_id": oid },
                            doc! { "$set": { "classification": bson } },
                        )
                        .await;
                }
            }
            Err(e) => {
                tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
            }
        }
    }
    /// If the target has a `LiveUrl` artifact and DAST is planned, provision a
    /// `DastTarget` (keyed by `repo_id` = target id) so the existing DAST trigger
    /// fires for wizard-created targets. Idempotent.
    async fn ensure_dast_target(
        &self,
        target: &OnboardedTarget,
        plan: &crate::pipeline::plan::ScanPlan,
    ) {
        if !plan.has(ScanType::Dast) {
            return;
        }
        let (Some(url), Some(oid)) = (target.live_url(), target.id) else {
            return;
        };
        let target_id = oid.to_hex();
        if self
            .db
            .dast_targets()
            .find_one(doc! { "repo_id": &target_id })
            .await
            .ok()
            .flatten()
            .is_some()
        {
            return; // already provisioned
        }
        let kind = url
            .web
            .as_ref()
            .map(|w| w.target_kind.clone())
            .unwrap_or(DastTargetType::WebApp);
        let mut dast = DastTarget::new(target.name.clone(), url.source_ref.clone(), kind);
        dast.repo_id = Some(target_id);
        if let Some(web) = &url.web {
            dast.excluded_paths = web.excluded_paths.clone();
            dast.max_crawl_depth = web.max_crawl_depth;
            dast.rate_limit = web.rate_limit;
            dast.allow_destructive = web.allow_destructive;
        }
        if let Some(auth) = &url.auth {
            dast.auth_config = Some(DastAuthConfig {
                method: auth.method.clone(),
                login_url: auth.login_url.clone(),
                username: auth.username.clone(),
                password: None,
                token: auth.secret.clone(),
                headers: auth.headers.clone(),
            });
        }
        if let Err(e) = self.db.dast_targets().insert_one(&dast).await {
            tracing::warn!(error = %e, "Unified pipeline: failed to provision DAST target");
        }
    }
    /// Sync the onboarded-target document after a scan: bump `findings_count`
    /// and advance the git artifact's `last_scanned_commit` watermark.
    async fn finalize_target(
        &self,
        target: &OnboardedTarget,
        repo: &TrackedRepository,
        new_count: u32,
    ) -> Result<(), AgentError> {
        let oid = match target.id {
            Some(id) => id,
            None => return Ok(()),
        };
        self.db
            .onboarded_targets()
            .update_one(
                doc! { "_id": oid },
                doc! {
                    "$inc": { "findings_count": new_count as i64 },
                    "$set": { "updated_at": mongodb::bson::DateTime::now() },
                },
            )
            .await?;
        let repo_path = std::path::Path::new(&self.config.git_clone_base_path).join(&repo.name);
        if let (Ok(sha), Some(code)) = (GitOps::get_head_sha(&repo_path), target.code_artifact()) {
            self.db
                .onboarded_targets()
                .update_one(
                    doc! { "_id": oid, "artifacts.id": &code.id },
                    doc! { "$set": { "artifacts.$.git.last_scanned_commit": sha } },
                )
                .await?;
        }
        Ok(())
    }
    pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
        if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
            let _ = self
@@ -436,6 +691,37 @@ impl PipelineOrchestrator {
    }
 }
 /// Build a legacy `TrackedRepository` view from an onboarded target's code
 /// artifact, so the unified pipeline can reuse the existing repo pipeline. The
 /// inverse of the migration's `repo_to_target`. `_id` is preserved so findings
 /// and DAST lookups resolve against the same key.
 fn repo_view_from_target(target: &OnboardedTarget, code: &Artifact) -> TrackedRepository {
    let mut repo = TrackedRepository::new(target.name.clone(), code.source_ref.clone());
    repo.id = target.id;
    if let Some(git) = &code.git {
        repo.default_branch = git.default_branch.clone();
        repo.last_scanned_commit = git.last_scanned_commit.clone();
        repo.local_path = git.local_path.clone();
    }
    if let Some(auth) = &code.auth {
        repo.auth_token = auth.secret.clone();
        repo.auth_username = auth.username.clone();
    }
    if let Some(it) = &target.scan_config.issue_tracker {
        repo.tracker_type = it.tracker_type.clone();
        repo.tracker_owner = it.owner.clone();
        repo.tracker_repo = it.repo.clone();
        repo.tracker_token = it.token.clone();
    }
    repo.scan_schedule = target.scan_schedule.clone();
    repo.webhook_enabled = target.webhook_enabled;
    repo.webhook_secret = target.webhook_secret.clone();
    repo.findings_count = target.findings_count;
    repo.created_at = target.created_at;
    repo.updated_at = target.updated_at;
    repo
 }
 /// Extract the scheme + host from a git URL.
 /// e.g. "https://gitea.example.com/owner/repo.git" -> "https://gitea.example.com"
 /// e.g. "ssh://git@gitea.example.com:22/owner/repo.git" -> "https://gitea.example.com"
@@ -460,3 +746,50 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
        None
    }
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use compliance_core::models::{
        Artifact, ArtifactAuth, IssueTrackerConfig, TargetType, TrackerType,
    };
    #[test]
    fn repo_view_preserves_id_git_auth_and_tracker() {
        let mut target = OnboardedTarget::new("acme".to_string(), TargetType::WebApp);
        target.id = Some(mongodb::bson::oid::ObjectId::new());
        target.findings_count = 3;
        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
            tracker_type: Some(TrackerType::Gitea),
            owner: Some("acme".to_string()),
            repo: Some("web".to_string()),
            token: Some("tt".to_string()),
        });
        let mut artifact = Artifact::git_repo("https://git/acme.git", "develop");
        if let Some(git) = artifact.git.as_mut() {
            git.last_scanned_commit = Some("abc123".to_string());
        }
        artifact.auth = Some(ArtifactAuth {
            method: "token".to_string(),
            username: Some("bob".to_string()),
            secret: Some("pat".to_string()),
            ..Default::default()
        });
        target.artifacts.push(artifact);
        let code = target.code_artifact().expect("code artifact");
        let repo = repo_view_from_target(&target, code);
        assert_eq!(repo.id, target.id); // preserved
        assert_eq!(repo.git_url, "https://git/acme.git");
        assert_eq!(repo.default_branch, "develop");
        assert_eq!(repo.last_scanned_commit.as_deref(), Some("abc123"));
        assert_eq!(repo.auth_token.as_deref(), Some("pat"));
        assert_eq!(repo.auth_username.as_deref(), Some("bob"));
        assert_eq!(repo.tracker_type, Some(TrackerType::Gitea));
        assert_eq!(repo.tracker_owner.as_deref(), Some("acme"));
        assert_eq!(repo.findings_count, 3);
    }
 }
@@ -215,7 +215,7 @@ fn scan_with_patterns(
                        repo_id.to_string(),
                        fingerprint,
                        scanner_name.to_string(),
-                        scan_type.clone(),
+                        scan_type,
                        pattern.title.clone(),
                        pattern.description.clone(),
                        pattern.severity.clone(),
@@ -0,0 +1,195 @@
 //! The scan plan.
 //!
 //! [`build_scan_plan`] turns an [`OnboardedTarget`] into the concrete ordered
 //! list of scans to run, each bound to the artifact it consumes. It intersects
 //! the scan-applicability matrix ([`applicable_scans`]) with the target's
 //! `scan_config` overrides: a scan runs when its required artifact is present and
 //! it is either on by default or explicitly enabled, and is not explicitly
 //! disabled. This is the decision engine the unified pipeline (`run_target`)
 //! executes.
 use compliance_core::models::{Artifact, ArtifactKind, OnboardedTarget, ScanPhase, ScanType};
 use compliance_core::scan_matrix::applicable_scans;
 /// One scan to run, bound to the artifact it operates on.
 #[derive(Debug, Clone, PartialEq)]
 pub struct ScanStep {
    /// The scan to run.
    pub scan_type: ScanType,
    /// The pipeline phase to report while it runs.
    pub phase: ScanPhase,
    /// The id of the artifact this scan consumes ([`Artifact::id`]).
    pub artifact_id: String,
 }
 /// The ordered set of scans to run for a target.
 #[derive(Debug, Clone, Default, PartialEq)]
 pub struct ScanPlan {
    /// The scans, in matrix order.
    pub steps: Vec<ScanStep>,
 }
 impl ScanPlan {
    /// Whether the plan contains a step for the given scan type.
    pub fn has(&self, scan: ScanType) -> bool {
        self.steps.iter().any(|s| s.scan_type == scan)
    }
    /// Whether the plan is empty (nothing to run).
    pub fn is_empty(&self) -> bool {
        self.steps.is_empty()
    }
 }
 /// Build the scan plan for a target: matrix defaults ∩ `scan_config`, each scan
 /// bound to the artifact it consumes. Scans whose required artifact is absent, or
 /// that are disabled, or off-by-default and not explicitly enabled, are dropped.
 pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
    let enabled = &target.scan_config.enabled_scans;
    let disabled = &target.scan_config.disabled_scans;
    let mut steps = Vec::new();
    for option in applicable_scans(target) {
        // Required artifact missing → not runnable.
        if option.blocked_reason.is_some() {
            continue;
        }
        // Explicit opt-out wins.
        if disabled.contains(&option.scan) {
            continue;
        }
        // Run if on by default, or explicitly enabled.
        if !option.default_on && !enabled.contains(&option.scan) {
            continue;
        }
        let Some(artifact) = resolve_artifact(target, option.required_artifact) else {
            continue;
        };
        steps.push(ScanStep {
            scan_type: option.scan,
            phase: phase_for(option.scan),
            artifact_id: artifact.id.clone(),
        });
    }
    ScanPlan { steps }
 }
 /// Resolve the artifact a scan consumes. A "code" requirement (represented by
 /// `GitRepo`) is satisfied by a git repo *or* a source archive.
 fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
    match required {
        Some(ArtifactKind::GitRepo) => target.code_artifact(),
        Some(kind) => target.first_of(kind),
        None => target.code_artifact().or_else(|| target.artifacts.first()),
    }
 }
 /// The pipeline phase reported while a given scan runs.
 fn phase_for(scan: ScanType) -> ScanPhase {
    match scan {
        ScanType::Sast => ScanPhase::Sast,
        ScanType::Sbom => ScanPhase::SbomGeneration,
        ScanType::Cve => ScanPhase::CveScanning,
        ScanType::Gdpr | ScanType::OAuth => ScanPhase::PatternScanning,
        ScanType::SecretDetection => ScanPhase::SecretDetection,
        ScanType::Lint => ScanPhase::LintScanning,
        ScanType::CodeReview => ScanPhase::CodeReview,
        ScanType::Graph => ScanPhase::GraphBuilding,
        ScanType::Dast => ScanPhase::DastScanning,
        ScanType::FirmwareStatic => ScanPhase::FirmwareStatic,
        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
        ScanType::MobileStatic => ScanPhase::MobileStatic,
        ScanType::ContainerScan => ScanPhase::ContainerScan,
    }
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use compliance_core::models::{PlcFormat, TargetType};
    fn target(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
        let mut t = OnboardedTarget::new("t".to_string(), target_type);
        t.artifacts = artifacts;
        t
    }
    fn step_for<'a>(plan: &'a ScanPlan, scan: ScanType) -> Option<&'a ScanStep> {
        plan.steps.iter().find(|s| s.scan_type == scan)
    }
    #[test]
    fn webapp_with_code_and_url_runs_sast_and_dast_bound_to_the_right_artifacts() {
        let code = Artifact::git_repo("https://git/x", "main");
        let url = Artifact::live_url("https://x");
        let (code_id, url_id) = (code.id.clone(), url.id.clone());
        let t = target(TargetType::WebApp, vec![code, url]);
        let plan = build_scan_plan(&t);
        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
        assert_eq!(sast.artifact_id, code_id);
        assert_eq!(sast.phase, ScanPhase::Sast);
        let dast = step_for(&plan, ScanType::Dast).expect("dast planned");
        assert_eq!(dast.artifact_id, url_id);
    }
    #[test]
    fn webapp_without_url_omits_dast() {
        let t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
        let plan = build_scan_plan(&t);
        assert!(plan.has(ScanType::Sast));
        assert!(!plan.has(ScanType::Dast));
    }
    #[test]
    fn code_scan_binds_to_source_archive_when_no_git_repo() {
        let arc = Artifact::source_archive("src.zip");
        let arc_id = arc.id.clone();
        let t = target(TargetType::BackendService, vec![arc]);
        let plan = build_scan_plan(&t);
        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
        assert_eq!(sast.artifact_id, arc_id);
    }
    #[test]
    fn firmware_sbom_and_cve_bind_to_the_firmware_image() {
        let fw = Artifact::firmware_image("fw.bin");
        let fw_id = fw.id.clone();
        let t = target(TargetType::FirmwareBareMetal, vec![fw]);
        let plan = build_scan_plan(&t);
        let sbom = step_for(&plan, ScanType::Sbom).expect("sbom planned");
        assert_eq!(sbom.artifact_id, fw_id);
        assert!(step_for(&plan, ScanType::FirmwareStatic).is_some());
        assert!(!plan.has(ScanType::Dast));
    }
    #[test]
    fn plc_plans_only_control_logic() {
        let plc = Artifact::plc_project("p.xml", PlcFormat::PlcopenXml);
        let t = target(TargetType::PlcSps, vec![plc]);
        let plan = build_scan_plan(&t);
        assert_eq!(plan.steps.len(), 1);
        assert_eq!(plan.steps[0].scan_type, ScanType::PlcControlLogic);
        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
    }
    #[test]
    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
        t.scan_config.disabled_scans = vec![ScanType::Lint];
        // CodeReview is off by default for web; enable it explicitly.
        t.scan_config.enabled_scans = vec![ScanType::CodeReview];
        let plan = build_scan_plan(&t);
        assert!(!plan.has(ScanType::Lint));
        assert!(plan.has(ScanType::CodeReview));
        assert!(plan.has(ScanType::Sast));
    }
    #[test]
    fn no_code_artifact_yields_empty_plan_for_web() {
        let t = target(TargetType::WebApp, vec![]);
        let plan = build_scan_plan(&t);
        assert!(plan.is_empty());
    }
 }
@@ -7,11 +7,18 @@ use crate::agent::ComplianceAgent;
 use crate::database::Database;
 use crate::error::AgentError;
-/// Default tenant the scheduler runs against when `SCHEDULER_TENANT_IDS`
+/// Default tenant the scheduler runs against when neither the tenant
-/// isn't set. Matches the dev-injector default so a bare `cargo run` has
+/// registry nor `SCHEDULER_TENANT_IDS` are configured. Matches the
-/// the scheduler scanning whatever lives in `<prefix>_dev`.
+/// dev-injector default so a bare `cargo run` has the scheduler
 /// scanning whatever lives in `<prefix>_dev`.
 const DEFAULT_SCHEDULER_TENANT_ID: &str = "dev";
 /// Request timeout when fetching the live tenant list from the
 /// registry. Kept short — if the registry is slow we'd rather fall
 /// back to env-configured ids and finish the tick than block the
 /// scheduler loop.
 const REGISTRY_FETCH_TIMEOUT_SECS: u64 = 5;
 pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError> {
    let sched = JobScheduler::new()
        .await
@@ -24,7 +31,12 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
        let agent = scan_agent.clone();
        Box::pin(async move {
            tracing::info!("Scheduled scan triggered");
-            for tenant_id in scheduler_tenants() {
+            let tenants = scheduler_tenants(&agent).await;
            tracing::debug!(
                tenant_count = tenants.len(),
                "Scheduled scan: tenants resolved"
            );
            for tenant_id in tenants {
                scan_all_repos(&agent, &tenant_id).await;
            }
        })
@@ -42,7 +54,12 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
        let agent = cve_agent.clone();
        Box::pin(async move {
            tracing::info!("CVE monitor triggered");
-            for tenant_id in scheduler_tenants() {
+            let tenants = scheduler_tenants(&agent).await;
            tracing::debug!(
                tenant_count = tenants.len(),
                "CVE monitor: tenants resolved"
            );
            for tenant_id in tenants {
                monitor_cves(&agent, &tenant_id).await;
            }
        })
@@ -58,9 +75,14 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
        .await
        .map_err(|e| AgentError::Scheduler(format!("Failed to start scheduler: {e}")))?;
-    let tenants = scheduler_tenants();
+    let tenants = scheduler_tenants(agent).await;
    let source = if agent.config.tenant_registry_url.is_some() {
        "tenant-registry (env fallback)"
    } else {
        "env (SCHEDULER_TENANT_IDS)"
    };
    tracing::info!(
-        "Scheduler started: scans='{}', CVE monitor='{}', tenants={tenants:?}",
+        "Scheduler started: scans='{}', CVE monitor='{}', tenant source={source}, tenants={tenants:?}",
        agent.config.scan_schedule,
        agent.config.cve_monitor_schedule,
    );
@@ -71,10 +93,40 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
    }
 }
-/// Tenants the scheduler iterates each tick. From `SCHEDULER_TENANT_IDS`
+/// Tenants the scheduler iterates each tick.
-/// (comma-separated), or `DEFAULT_SCHEDULER_TENANT_ID` if unset. M7.2-D
+///
-/// will replace this with a pull from the tenant-registry.
+/// Resolution order:
-fn scheduler_tenants() -> Vec<String> {
+/// 1. **Tenant registry** at `agent.config.tenant_registry_url`
 ///    (`GET /v1/tenants`). Fresh on every tick — picks up newly
 ///    provisioned tenants without an agent restart.
 /// 2. **`SCHEDULER_TENANT_IDS`** env (comma-separated) — fallback when
 ///    the registry is unreachable, the response is malformed, or no
 ///    registry URL is configured.
 /// 3. **`DEFAULT_SCHEDULER_TENANT_ID`** (`"dev"`) — last-ditch fallback
 ///    so the scheduler keeps doing something useful in dev.
 ///
 /// We never panic out of this function — the scheduler must keep
 /// firing even if the registry is offline.
 async fn scheduler_tenants(agent: &ComplianceAgent) -> Vec<String> {
    if let Some(url) = agent.config.tenant_registry_url.as_deref() {
        match fetch_tenants_from_registry(&agent.http, url).await {
            Ok(v) if !v.is_empty() => return v,
            Ok(_) => {
                tracing::warn!("tenant-registry returned empty list; falling back to env");
            }
            Err(e) => {
                tracing::warn!(
                    url = %url,
                    error = %e,
                    "tenant-registry fetch failed; falling back to env"
                );
            }
        }
    }
    tenants_from_env()
 }
 fn tenants_from_env() -> Vec<String> {
    std::env::var("SCHEDULER_TENANT_IDS")
        .ok()
        .map(|s| {
@@ -88,6 +140,134 @@ fn scheduler_tenants() -> Vec<String> {
        .unwrap_or_else(|| vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()])
 }
 /// Shape we accept from the registry. Liberal in what we accept:
 /// the registry can return any field shape as long as either `id` or
 /// `tenant_id` is present. Other fields are ignored.
 #[derive(serde::Deserialize)]
 struct RegistryTenant {
    #[serde(alias = "tenant_id")]
    id: String,
    /// Filter out non-running tenants if status is present. Missing
    /// status defaults to "active" so older registry deployments keep
    /// working.
    #[serde(default = "default_status")]
    status: String,
 }
 fn default_status() -> String {
    "active".to_string()
 }
 #[derive(serde::Deserialize)]
 struct RegistryListResponse {
    data: Vec<RegistryTenant>,
 }
 async fn fetch_tenants_from_registry(
    http: &reqwest::Client,
    base_url: &str,
 ) -> Result<Vec<String>, String> {
    let url = format!("{}/v1/tenants", base_url.trim_end_matches('/'));
    let resp = http
        .get(&url)
        .timeout(std::time::Duration::from_secs(REGISTRY_FETCH_TIMEOUT_SECS))
        .send()
        .await
        .map_err(|e| format!("request failed: {e}"))?;
    if !resp.status().is_success() {
        return Err(format!("registry returned {}", resp.status()));
    }
    let body: RegistryListResponse = resp
        .json()
        .await
        .map_err(|e| format!("invalid JSON: {e}"))?;
    Ok(filter_active(body.data))
 }
 /// Frozen/Archived tenants don't need scheduled scans; the M7.1
 /// status gate would 402/410 anyway. Skip them so we don't waste
 /// cycles. Active / trial / demo / anything-else-unknown all run.
 fn filter_active(rows: Vec<RegistryTenant>) -> Vec<String> {
    rows.into_iter()
        .filter(|t| !matches!(t.status.as_str(), "frozen" | "archived"))
        .map(|t| t.id)
        .collect()
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    fn tenant(id: &str, status: &str) -> RegistryTenant {
        RegistryTenant {
            id: id.to_string(),
            status: status.to_string(),
        }
    }
    #[test]
    fn filter_active_keeps_running_skips_frozen_archived() {
        let rows = vec![
            tenant("a", "active"),
            tenant("b", "trial"),
            tenant("c", "demo"),
            tenant("d", "frozen"),
            tenant("e", "archived"),
            tenant("f", "weird-but-not-known-dead"),
        ];
        let out = filter_active(rows);
        assert_eq!(out, vec!["a", "b", "c", "f"]);
    }
    #[test]
    fn deserialize_registry_response_accepts_id_or_tenant_id() {
        let body = r#"{"data":[
            {"id":"a","status":"active"},
            {"tenant_id":"b","status":"trial"},
            {"id":"c"}
        ]}"#;
        let parsed: RegistryListResponse = serde_json::from_str(body).unwrap();
        assert_eq!(parsed.data.len(), 3);
        assert_eq!(parsed.data[0].id, "a");
        assert_eq!(parsed.data[1].id, "b");
        assert_eq!(parsed.data[2].id, "c");
        // Default status for the third entry should be "active"
        assert_eq!(parsed.data[2].status, "active");
    }
    /// Combined into a single test: cargo runs tests in parallel and
    /// env vars are process-global, so two separate tests touching
    /// `SCHEDULER_TENANT_IDS` race each other. Doing both checks in
    /// one test keeps them in a deterministic order.
    #[test]
    fn tenants_from_env_resolution() {
        std::env::remove_var("SCHEDULER_TENANT_IDS");
        assert_eq!(
            tenants_from_env(),
            vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()],
            "unset → default"
        );
        std::env::set_var("SCHEDULER_TENANT_IDS", "acme, globex ,,hello");
        let out = tenants_from_env();
        std::env::remove_var("SCHEDULER_TENANT_IDS");
        assert_eq!(
            out,
            vec!["acme", "globex", "hello"],
            "splits + trims + drops empty"
        );
        std::env::set_var("SCHEDULER_TENANT_IDS", "");
        let out = tenants_from_env();
        std::env::remove_var("SCHEDULER_TENANT_IDS");
        assert_eq!(
            out,
            vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()],
            "empty → default"
        );
    }
 }
 /// Resolve the per-tenant database. Logs and returns `None` on failure
 /// so the loop in the caller can continue with other tenants.
 async fn tenant_db(agent: &ComplianceAgent, tenant_id: &str) -> Option<Database> {
@@ -108,25 +288,25 @@ async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
        None => return,
    };
-    let cursor = match db.repositories().find(doc! {}).await {
+    let cursor = match db.onboarded_targets().find(doc! {}).await {
        Ok(c) => c,
        Err(e) => {
-            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
+            tracing::error!("Failed to list targets for tenant '{tenant_id}': {e}");
            return;
        }
    };
-    let repos: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+    let targets: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
-    for repo in repos {
+    for target in targets {
-        let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
        if let Err(e) = agent
-            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
+            .run_target_scan(tenant_id, &target_id, ScanTrigger::Scheduled)
            .await
        {
            tracing::error!(
                "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
-                repo.name
+                target.name
            );
        }
    }
@@ -25,8 +25,9 @@ impl TestServer {
        let mongodb_uri = std::env::var("TEST_MONGODB_URI")
            .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-        // Unique database name per test run to avoid collisions
+        // Unique db-name prefix per run. Must fit the pool's 30-char cap
-        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
+        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
        let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
            .await
@@ -44,6 +45,7 @@ impl TestServer {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
            github_token: None,
            github_webhook_secret: None,
@@ -66,6 +68,9 @@ impl TestServer {
            pentest_imap_tls: false,
            pentest_imap_username: None,
            pentest_imap_password: None,
            admin_api_token: None,
            tenant_registry_url: None,
            unified_pipeline: false,
        };
        let agent = ComplianceAgent::new(config, db_pool);
@@ -2,5 +2,6 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
 mod onboarding;
 mod repositories;
 mod stats;
@@ -0,0 +1,115 @@
 use crate::common::TestServer;
 use serde_json::json;
 #[tokio::test]
 async fn create_list_and_applicable_scans() {
    let server = TestServer::start().await;
    // Initially empty.
    let resp = server.get("/api/v1/targets").await;
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    assert_eq!(body["data"].as_array().unwrap().len(), 0);
    // Create a web-app target with a git repo + a live URL.
    let resp = server
        .post(
            "/api/v1/targets",
            &json!({
                "name": "acme-web",
                "target_type": "web_app",
                "artifacts": [
                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
                ]
            }),
        )
        .await;
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
    assert!(!id.is_empty());
    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
    // List returns it.
    let resp = server.get("/api/v1/targets").await;
    let body: serde_json::Value = resp.json().await.unwrap();
    assert_eq!(body["data"].as_array().unwrap().len(), 1);
    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
    let resp = server
        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
        .await;
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    let scans = body["data"]["scans"].as_array().unwrap();
    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
    assert!(names.contains(&"sast"));
    assert!(names.contains(&"dast"));
    assert_eq!(body["data"]["pentest_supported"], true);
    server.cleanup().await;
 }
 #[tokio::test]
 async fn detect_classifies_a_plc_target() {
    let server = TestServer::start().await;
    // A PLC project artifact is a strong kind-based signal.
    let resp = server
        .post(
            "/api/v1/targets",
            &json!({
                "name": "line-controller",
                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
                "artifacts": [
                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
                ]
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
    let resp = server
        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
        .await;
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
    server.cleanup().await;
 }
 #[tokio::test]
 async fn add_artifact_and_delete_target() {
    let server = TestServer::start().await;
    let resp = server
        .post(
            "/api/v1/targets",
            &json!({ "name": "svc", "target_type": "backend_service" }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
    // Attach a git repo.
    let resp = server
        .post(
            &format!("/api/v1/targets/{id}/artifacts"),
            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
        )
        .await;
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
    // Delete it.
    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
    assert_eq!(resp.status(), 200);
    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
    assert_eq!(resp.status(), 404);
    server.cleanup().await;
 }
@@ -0,0 +1,156 @@
 // Integration tests for the onboarding backfill migration.
 //
 // Requires MongoDB (set TEST_MONGODB_URI if not at the default).
 // Not run in CI (which is `--lib` only) — run locally:
 //   cargo test -p compliance-agent --test e2e migration
 use compliance_agent::database::{Database, DatabasePool};
 use compliance_agent::migrate::onboarding;
 use compliance_core::models::{
    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
 };
 use mongodb::bson::{doc, Document};
 async fn fresh_db() -> (DatabasePool, String, Database) {
    let uri = std::env::var("TEST_MONGODB_URI")
        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
    let pool = DatabasePool::connect(&uri, &prefix)
        .await
        .expect("connect mongo");
    let db = pool.for_tenant_id("t1").await.expect("tenant db");
    (pool, prefix, db)
 }
 async fn cleanup(pool: &DatabasePool, prefix: &str) {
    if let Ok(names) = pool.client().list_database_names().await {
        for n in names {
            if n.starts_with(prefix) {
                pool.client().database(&n).drop().await.ok();
            }
        }
    }
 }
 #[tokio::test]
 async fn backfill_folds_relinks_is_idempotent_and_reversible() {
    let (pool, prefix, db) = fresh_db().await;
    // Seed a repo.
    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
    let repo_id = db
        .repositories()
        .insert_one(repo)
        .await
        .expect("insert repo")
        .inserted_id
        .as_object_id()
        .expect("repo oid");
    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
    let mut linked = DastTarget::new(
        "acme-web".into(),
        "https://acme.example.com".into(),
        DastTargetType::WebApp,
    );
    linked.repo_id = Some(repo_id.to_hex());
    let linked_id = db
        .dast_targets()
        .insert_one(linked)
        .await
        .expect("insert linked dast")
        .inserted_id
        .as_object_id()
        .expect("linked oid");
    // A repo-less DAST target (standalone).
    let standalone = DastTarget::new(
        "acme-api".into(),
        "https://api.acme.com".into(),
        DastTargetType::RestApi,
    );
    let standalone_id = db
        .dast_targets()
        .insert_one(standalone)
        .await
        .expect("insert standalone dast")
        .inserted_id
        .as_object_id()
        .expect("standalone oid");
    // A DAST scan run pointing at the linked target — should be relinked to the repo.
    db.collection_named::<Document>("dast_scan_runs")
        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
        .await
        .expect("insert dast run");
    // --- Backfill ---
    assert!(!onboarding::already_applied(&db).await.unwrap());
    let report = onboarding::backfill_onboarded_targets(&db, false)
        .await
        .expect("backfill");
    assert_eq!(report.repos_migrated, 1);
    assert_eq!(report.dast_targets_folded, 1);
    assert_eq!(report.dast_targets_standalone, 1);
    assert!(onboarding::already_applied(&db).await.unwrap());
    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
    let repo_target = db
        .onboarded_targets()
        .find_one(doc! { "_id": repo_id })
        .await
        .unwrap()
        .expect("repo target");
    assert!(repo_target.has(ArtifactKind::GitRepo));
    assert!(repo_target.has(ArtifactKind::LiveUrl));
    assert_eq!(repo_target.target_type, TargetType::WebApp);
    // Standalone target: preserved _id, live-url, backend service.
    let standalone_target = db
        .onboarded_targets()
        .find_one(doc! { "_id": standalone_id })
        .await
        .unwrap()
        .expect("standalone target");
    assert!(standalone_target.has(ArtifactKind::LiveUrl));
    assert_eq!(standalone_target.target_type, TargetType::BackendService);
    // The DAST run was relinked from the old dast id to the repo (unified) id.
    let run = db
        .collection_named::<Document>("dast_scan_runs")
        .find_one(doc! {})
        .await
        .unwrap()
        .expect("run");
    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
    // --- Idempotent: re-run migrates nothing new ---
    let again = onboarding::backfill_onboarded_targets(&db, false)
        .await
        .expect("backfill again");
    assert_eq!(again.repos_migrated, 0);
    assert_eq!(again.dast_targets_folded, 0);
    assert_eq!(again.dast_targets_standalone, 0);
    assert!(again.skipped_existing >= 2);
    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
    onboarding::revert(&db).await.expect("revert");
    assert_eq!(
        db.onboarded_targets()
            .count_documents(doc! {})
            .await
            .unwrap(),
        0
    );
    let run_after = db
        .collection_named::<Document>("dast_scan_runs")
        .find_one(doc! {})
        .await
        .unwrap()
        .expect("run");
    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
    assert!(!onboarding::already_applied(&db).await.unwrap());
    cleanup(&pool, &prefix).await;
 }
@@ -7,3 +7,4 @@
 // Or nightly: (via CI with MongoDB service container)
 mod api;
 mod migration;
@@ -63,16 +63,24 @@ struct Claims {
 const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
 /// Path prefixes that bypass JWT validation. The admin sub-router
 /// (`/api/v1/admin/*`) has its own static-bearer middleware and must
 /// not be routed through the customer-JWT path — a Keycloak token
 /// always carries a single tenant_id and would semantically conflict
 /// with cross-tenant admin operations.
 const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
 /// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
 /// and attaches a `TenantContext` extension on success.
 ///
-/// Skips validation for the health endpoint.
+/// Skips validation for the health endpoint and any path under one of
-/// If `JwksState` is not present (Keycloak not configured), requests
+/// the [`PUBLIC_PREFIXES`]. If `JwksState` is not present (Keycloak
-/// pass through and downstream code must handle the missing context.
+/// not configured), requests pass through and downstream code must
 /// handle the missing context.
 pub async fn require_jwt_auth(mut request: Request, next: Next) -> Response {
    let path = request.uri().path();
-    if PUBLIC_ENDPOINTS.contains(&path) {
+    if PUBLIC_ENDPOINTS.contains(&path) || PUBLIC_PREFIXES.iter().any(|p| path.starts_with(p)) {
        return next.run(request).await;
    }
@@ -24,6 +24,9 @@ pub struct AgentConfig {
    pub scan_schedule: String,
    pub cve_monitor_schedule: String,
    pub git_clone_base_path: String,
    /// Base directory for content-addressed artifact blobs and per-run working
    /// dirs (`<base>/blobs/<sha[0:2]>/<sha>`, `<base>/work/<target>/<artifact>/`).
    pub artifact_store_base_path: String,
    pub ssh_key_path: String,
    pub keycloak_url: Option<String>,
    pub keycloak_realm: Option<String>,
@@ -37,6 +40,20 @@ pub struct AgentConfig {
    pub pentest_imap_tls: bool,
    pub pentest_imap_username: Option<String>,
    pub pentest_imap_password: Option<SecretString>,
    /// Static bearer for the cross-tenant admin endpoints under
    /// `/api/v1/admin/*`. When `None`, those endpoints are not
    /// mounted at all (defense-in-depth: ops endpoints never reach
    /// any auth path if no operator has explicitly opted in).
    pub admin_api_token: Option<SecretString>,
    /// Live tenant-registry URL the scheduler consults for the list
    /// of tenants to iterate. When `None` or unreachable, scheduler
    /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
    pub tenant_registry_url: Option<String>,
    /// When true, `run_scan` dispatches to the unified `run_target` pipeline
    /// (reads `onboarded_targets`) instead of the legacy repository pipeline.
    /// Env `UNIFIED_PIPELINE`. Defaults on; set `UNIFIED_PIPELINE=0` to use the
    /// legacy repository pipeline.
    pub unified_pipeline: bool,
 }
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -2,6 +2,7 @@ pub mod config;
 pub mod db;
 pub mod error;
 pub mod models;
 pub mod scan_matrix;
 #[cfg(feature = "telemetry")]
 pub mod telemetry;
 pub mod tenant;
@@ -0,0 +1,69 @@
 //! Per-tenant API tokens used by `compliance-mcp` to authenticate MCP
 //! HTTP requests on behalf of LLM clients (Claude Desktop, Cursor,
 //! ChatGPT, etc.) that can't run a Keycloak OIDC flow.
 //!
 //! Tokens are opaque strings of the form `mcpt_<44 url-safe random
 //! chars>`. The raw value is shown to the user exactly once at
 //! creation; the database only ever sees the SHA-256 hash. Lookups go
 //! through the cross-tenant `<prefix>__admin.mcp_tokens` collection
 //! and return the `tenant_id` the MCP server should route to.
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 /// Persisted token metadata. `token_hash` is the SHA-256 hex of the
 /// raw token; the raw token itself is never stored.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct McpToken {
    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
    pub id: Option<bson::oid::ObjectId>,
    /// SHA-256 hex of the raw token. Unique index in the collection.
    pub token_hash: String,
    /// First 8 chars of the raw token — purely for UI display so users
    /// can identify which token is which without re-issuing.
    pub token_prefix: String,
    /// Routes to `<db_prefix>_<tenant_id>` on MCP requests.
    pub tenant_id: String,
    /// User-given label, e.g. "Claude Desktop" or "Sharang's laptop".
    pub name: String,
    /// Keycloak `sub` of the user who created this token, for audit.
    pub created_by: String,
    #[serde(with = "super::serde_helpers::bson_datetime")]
    pub created_at: DateTime<Utc>,
    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
    pub last_used_at: Option<DateTime<Utc>>,
    /// Soft-delete flag. A revoked token doc stays around for audit
    /// but never authenticates.
    #[serde(default)]
    pub revoked: bool,
 }
 /// Public projection of a token — never includes the hash.
 /// Returned by `GET /api/v1/mcp-tokens`.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct McpTokenView {
    pub id: String,
    pub name: String,
    /// `mcpt_xxxx…` so the user can identify which row is which.
    pub token_prefix: String,
    pub created_by: String,
    #[serde(with = "super::serde_helpers::bson_datetime")]
    pub created_at: DateTime<Utc>,
    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
    pub last_used_at: Option<DateTime<Utc>>,
    pub revoked: bool,
 }
 impl From<&McpToken> for McpTokenView {
    fn from(t: &McpToken) -> Self {
        Self {
            id: t.id.map(|o| o.to_hex()).unwrap_or_default(),
            name: t.name.clone(),
            token_prefix: t.token_prefix.clone(),
            created_by: t.created_by.clone(),
            created_at: t.created_at,
            last_used_at: t.last_used_at,
            revoked: t.revoked,
        }
    }
 }
@@ -7,7 +7,9 @@ pub mod finding;
 pub mod graph;
 pub mod issue;
 pub mod mcp;
 pub mod mcp_token;
 pub mod notification;
 pub mod onboarding;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
@@ -28,7 +30,14 @@ pub use graph::{
 };
 pub use issue::{IssueStatus, TrackerIssue, TrackerType};
 pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
 pub use mcp_token::{McpToken, McpTokenView};
 pub use notification::{CveNotification, NotificationSeverity, NotificationStatus};
 pub use onboarding::{
    default_compliance_profile, Artifact, ArtifactAuth, ArtifactKind, Classification,
    ComplianceFramework, ComplianceProfile, DetectedFact, ExternalRef, ExternalSystem,
    GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
    TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
 pub use pentest::{
    AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
    PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
@@ -0,0 +1,753 @@
 //! The unified onboarding model.
 //!
 //! An [`OnboardedTarget`] is the single source of truth for anything the scanner
 //! can analyze. It records *what kind of software* the target is ([`TargetType`]),
 //! the concrete [`Artifact`]s that were provided for it (a git repo, a firmware
 //! image, a live URL, a PLC project, ...), the classifier's verdict, and the scan
 //! configuration. It replaces the older git-only `TrackedRepository` and the
 //! standalone `DastTarget`, both of which fold into this type as artifacts.
 use std::collections::HashMap;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use super::dast::{DastAuthConfig, DastTargetType};
 use super::issue::TrackerType;
 use super::pentest::{Environment, PentestConfig, PentestStrategy};
 use super::scan::ScanType;
 /// The family of software a target belongs to.
 ///
 /// Targets look endlessly varied but fall into a small enumerable set classified
 /// by where the analyzable signal lives. This drives the scan-applicability
 /// matrix and the onboarding wizard's type selection.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum TargetType {
    /// Browser-facing web application (front end + server).
    WebApp,
    /// Headless backend service / API (REST, GraphQL, gRPC).
    BackendService,
    /// Desktop application (Windows/macOS/Linux GUI or CLI binary).
    DesktopApp,
    /// Android application (APK / AAB).
    AndroidApp,
    /// iOS application (IPA).
    IosApp,
    /// Bare-metal embedded firmware (no operating system).
    FirmwareBareMetal,
    /// Embedded firmware running on an RTOS (Zephyr, FreeRTOS, ...).
    FirmwareRtos,
    /// Embedded Linux built with Yocto / OpenEmbedded (BSP + image).
    EmbeddedLinuxYocto,
    /// Programmable logic controller software (IEC 61131-3, PLCopen / SPS).
    PlcSps,
 }
 impl std::fmt::Display for TargetType {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::WebApp => write!(f, "web_app"),
            Self::BackendService => write!(f, "backend_service"),
            Self::DesktopApp => write!(f, "desktop_app"),
            Self::AndroidApp => write!(f, "android_app"),
            Self::IosApp => write!(f, "ios_app"),
            Self::FirmwareBareMetal => write!(f, "firmware_bare_metal"),
            Self::FirmwareRtos => write!(f, "firmware_rtos"),
            Self::EmbeddedLinuxYocto => write!(f, "embedded_linux_yocto"),
            Self::PlcSps => write!(f, "plc_sps"),
        }
    }
 }
 /// The kind of artifact provided for a target.
 ///
 /// Which scans are possible is a function of the target type *and* which of
 /// these are present (SAST needs code, DAST needs a running URL, and so on).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ArtifactKind {
    /// A git repository (cloned for static analysis).
    GitRepo,
    /// A source archive (zip / tarball) with no live git remote.
    SourceArchive,
    /// A firmware image or binary blob.
    FirmwareImage,
    /// A mobile package: Android APK/AAB or iOS IPA.
    MobilePackage,
    /// An OCI/Docker container image reference.
    ContainerImage,
    /// A reachable running instance (base URL / endpoint) for dynamic testing.
    LiveUrl,
    /// A PLC project: PLCopen XML or Structured Text source.
    PlcProject,
    /// Free-form plaintext describing the target (feeds classification only).
    PlaintextDescription,
 }
 impl std::fmt::Display for ArtifactKind {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::GitRepo => write!(f, "git_repo"),
            Self::SourceArchive => write!(f, "source_archive"),
            Self::FirmwareImage => write!(f, "firmware_image"),
            Self::MobilePackage => write!(f, "mobile_package"),
            Self::ContainerImage => write!(f, "container_image"),
            Self::LiveUrl => write!(f, "live_url"),
            Self::PlcProject => write!(f, "plc_project"),
            Self::PlaintextDescription => write!(f, "plaintext_description"),
        }
    }
 }
 /// Credentials attached to an artifact.
 ///
 /// This folds both `TrackedRepository`'s git auth (`auth_token` / `auth_username`
 /// / SSH key) and `DastAuthConfig`'s HTTP auth (form / bearer / cookie) into one
 /// shape so a single artifact carries whatever it needs to be fetched or probed.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct ArtifactAuth {
    /// Auth method: `none` | `token` | `basic` | `bearer` | `cookie` | `form` | `ssh`.
    #[serde(default)]
    pub method: String,
    /// Username (git user, basic-auth user, or `x-access-token` for PATs).
    pub username: Option<String>,
    /// The secret credential: PAT, password, or bearer token. Encrypted at rest.
    pub secret: Option<String>,
    /// Path to an SSH private key for git-over-SSH.
    pub ssh_key_path: Option<String>,
    /// Login URL for form-based authentication.
    pub login_url: Option<String>,
    /// Extra headers to send when authenticating / probing.
    pub headers: Option<HashMap<String, String>>,
 }
 impl From<DastAuthConfig> for ArtifactAuth {
    fn from(c: DastAuthConfig) -> Self {
        Self {
            method: c.method,
            username: c.username,
            // Prefer a bearer token; otherwise fall back to the password.
            secret: c.token.or(c.password),
            ssh_key_path: None,
            login_url: c.login_url,
            headers: c.headers,
        }
    }
 }
 /// Git-specific configuration for a [`ArtifactKind::GitRepo`] artifact.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct GitArtifactConfig {
    /// Branch to scan.
    pub default_branch: String,
    /// Commit SHA of the last completed scan (change-detection watermark).
    pub last_scanned_commit: Option<String>,
    /// Local clone path once the repo has been fetched.
    pub local_path: Option<String>,
 }
 impl GitArtifactConfig {
    /// Config for a fresh git artifact on the given branch.
    pub fn on_branch(branch: impl Into<String>) -> Self {
        Self {
            default_branch: branch.into(),
            last_scanned_commit: None,
            local_path: None,
        }
    }
 }
 impl Default for GitArtifactConfig {
    fn default() -> Self {
        Self::on_branch("main")
    }
 }
 /// Dynamic-analysis configuration for a [`ArtifactKind::LiveUrl`] artifact.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct WebArtifactConfig {
    /// Whether the endpoint is a web app, REST API, or GraphQL API.
    pub target_kind: DastTargetType,
    /// URL paths to exclude from crawling / scanning.
    #[serde(default)]
    pub excluded_paths: Vec<String>,
    /// Maximum crawl depth.
    pub max_crawl_depth: u32,
    /// Rate limit in requests per second.
    pub rate_limit: u32,
    /// Whether destructive methods (DELETE / PUT) are permitted.
    #[serde(default)]
    pub allow_destructive: bool,
 }
 impl Default for WebArtifactConfig {
    fn default() -> Self {
        Self {
            target_kind: DastTargetType::WebApp,
            excluded_paths: Vec::new(),
            max_crawl_depth: 3,
            rate_limit: 10,
            allow_destructive: false,
        }
    }
 }
 /// The source format of a PLC project artifact.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum PlcFormat {
    /// PLCopen XML project export.
    PlcopenXml,
    /// IEC 61131-3 Structured Text source.
    StructuredText,
 }
 /// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PlcArtifactConfig {
    /// The project source format.
    pub format: PlcFormat,
 }
 /// A single fact discovered about a target by ingest or classification
 /// (e.g. `language=rust`, `build_system=cmake`, `mcu=stm32f429`).
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DetectedFact {
    /// The fact name.
    pub key: String,
    /// The fact value.
    pub value: String,
    /// What produced the fact (e.g. `tramiton`, `language-fingerprint`).
    pub source: String,
 }
 impl DetectedFact {
    /// Build a fact from its parts.
    pub fn new(
        key: impl Into<String>,
        value: impl Into<String>,
        source: impl Into<String>,
    ) -> Self {
        Self {
            key: key.into(),
            value: value.into(),
            source: source.into(),
        }
    }
 }
 /// One concrete thing provided for a target: code, a binary, a URL, etc.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Artifact {
    /// Stable per-artifact id (UUID v4) — scan steps reference this.
    pub id: String,
    /// What kind of artifact this is.
    pub kind: ArtifactKind,
    /// The source reference: git URL, blob id, live URL, or image ref.
    pub source_ref: String,
    /// Optional human-friendly label.
    pub display_name: Option<String>,
    /// Content-addressed storage path once ingested (blobs only).
    pub stored_path: Option<String>,
    /// SHA-256 of the ingested content (git artifacts store the head SHA).
    pub content_hash: Option<String>,
    /// Size of the stored blob in bytes.
    pub size_bytes: Option<u64>,
    /// Credentials for fetching or probing this artifact.
    pub auth: Option<ArtifactAuth>,
    /// Git configuration (present for [`ArtifactKind::GitRepo`]).
    pub git: Option<GitArtifactConfig>,
    /// Dynamic-analysis configuration (present for [`ArtifactKind::LiveUrl`]).
    pub web: Option<WebArtifactConfig>,
    /// PLC configuration (present for [`ArtifactKind::PlcProject`]).
    pub plc: Option<PlcArtifactConfig>,
    /// Facts discovered about this artifact by ingest / classification.
    #[serde(default)]
    pub detected: Vec<DetectedFact>,
    /// When this artifact was last ingested.
    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
    pub ingested_at: Option<DateTime<Utc>>,
 }
 impl Artifact {
    /// A bare artifact of the given kind and source reference.
    fn bare(kind: ArtifactKind, source_ref: impl Into<String>) -> Self {
        Self {
            id: uuid::Uuid::new_v4().to_string(),
            kind,
            source_ref: source_ref.into(),
            display_name: None,
            stored_path: None,
            content_hash: None,
            size_bytes: None,
            auth: None,
            git: None,
            web: None,
            plc: None,
            detected: Vec::new(),
            ingested_at: None,
        }
    }
    /// A git-repository artifact tracking the given branch.
    pub fn git_repo(url: impl Into<String>, branch: impl Into<String>) -> Self {
        let mut a = Self::bare(ArtifactKind::GitRepo, url);
        a.git = Some(GitArtifactConfig::on_branch(branch));
        a
    }
    /// A live-URL artifact with default crawl settings.
    pub fn live_url(url: impl Into<String>) -> Self {
        let mut a = Self::bare(ArtifactKind::LiveUrl, url);
        a.web = Some(WebArtifactConfig::default());
        a
    }
    /// A firmware-image artifact referenced by name (blob ingested later).
    pub fn firmware_image(source_ref: impl Into<String>) -> Self {
        Self::bare(ArtifactKind::FirmwareImage, source_ref)
    }
    /// A source-archive artifact referenced by name (blob ingested later).
    pub fn source_archive(source_ref: impl Into<String>) -> Self {
        Self::bare(ArtifactKind::SourceArchive, source_ref)
    }
    /// A mobile-package artifact (APK/AAB/IPA) referenced by name.
    pub fn mobile_package(source_ref: impl Into<String>) -> Self {
        Self::bare(ArtifactKind::MobilePackage, source_ref)
    }
    /// A container-image artifact referenced by OCI ref.
    pub fn container_image(source_ref: impl Into<String>) -> Self {
        Self::bare(ArtifactKind::ContainerImage, source_ref)
    }
    /// A PLC-project artifact in the given format.
    pub fn plc_project(source_ref: impl Into<String>, format: PlcFormat) -> Self {
        let mut a = Self::bare(ArtifactKind::PlcProject, source_ref);
        a.plc = Some(PlcArtifactConfig { format });
        a
    }
    /// A plaintext-description artifact (classification input only).
    pub fn plaintext(text: impl Into<String>) -> Self {
        Self::bare(ArtifactKind::PlaintextDescription, text)
    }
 }
 /// One ranked candidate produced by the classifier.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TargetTypeCandidate {
    /// The candidate target type.
    pub target_type: TargetType,
    /// Confidence in `[0.0, 1.0]`.
    pub confidence: f32,
    /// Why this candidate was proposed.
    pub rationale: String,
 }
 /// The classifier's verdict for a target: a suggested type plus ranked
 /// alternatives and the facts the decision rested on.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Classification {
    /// The top-ranked target type.
    pub suggested: TargetType,
    /// All candidates, sorted by descending confidence.
    #[serde(default)]
    pub candidates: Vec<TargetTypeCandidate>,
    /// Facts gathered during classification.
    #[serde(default)]
    pub facts: Vec<DetectedFact>,
    /// Which classifiers contributed (e.g. `["tramiton", "language-fingerprint"]`).
    #[serde(default)]
    pub detected_by: Vec<String>,
    /// When classification ran.
    #[serde(with = "super::serde_helpers::bson_datetime")]
    pub detected_at: DateTime<Utc>,
    /// Whether a human confirmed the suggestion.
    #[serde(default)]
    pub confirmed: bool,
 }
 /// Issue-tracker linkage, migrated from `TrackedRepository`'s `tracker_*` fields.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct IssueTrackerConfig {
    /// The tracker platform.
    pub tracker_type: Option<TrackerType>,
    /// Tracker owner / organization.
    pub owner: Option<String>,
    /// Tracker repository / project.
    pub repo: Option<String>,
    /// Per-target tracker access token.
    pub token: Option<String>,
 }
 /// How a target should be scanned.
 ///
 /// `enabled_scans` / `disabled_scans` override the scan-applicability matrix
 /// defaults; the pentest and tracker blocks reuse the existing wizard config.
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct TargetScanConfig {
    /// Scans explicitly turned on (empty means "use matrix defaults").
    #[serde(default)]
    pub enabled_scans: Vec<ScanType>,
    /// Scans explicitly turned off.
    #[serde(default)]
    pub disabled_scans: Vec<ScanType>,
    /// Target environment (gates destructive / active testing).
    #[serde(default)]
    pub environment: Environment,
    /// Whether destructive tests are permitted for this target.
    #[serde(default)]
    pub allow_destructive: bool,
    /// Pentest strategy selector.
    pub strategy: Option<PentestStrategy>,
    /// Full pentest wizard configuration.
    pub pentest: Option<PentestConfig>,
    /// Issue-tracker linkage.
    pub issue_tracker: Option<IssueTrackerConfig>,
 }
 /// A sibling product in the company suite that may already hold authoritative
 /// data for a target. compliance-scanner reconciles with these rather than
 /// recomputing what they already know.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ExternalSystem {
    /// Reproducible-build & firmware compliance engine (build plan, SBOM, VEX,
    /// attestation).
    Tramiton,
    /// Code assistant (downstream remediation consumer).
    Werkpilot,
    /// Compliance-controls RAG (atomic controls derived from laws).
    BreakpilotCompliance,
 }
 impl std::fmt::Display for ExternalSystem {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::Tramiton => write!(f, "tramiton"),
            Self::Werkpilot => write!(f, "werkpilot"),
            Self::BreakpilotCompliance => write!(f, "breakpilot_compliance"),
        }
    }
 }
 /// A link from this target to a record in a sibling product, used to reconcile
 /// existing evidence instead of recomputing it.
 ///
 /// For tramiton, `project_id` is the shared cross-product key and
 /// `subject_sha256` matches a firmware artifact's [`Artifact::content_hash`]
 /// (which equals tramiton's `Artifact.sha256`).
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ExternalRef {
    /// Which sibling product this reference points at.
    pub system: ExternalSystem,
    /// The sibling product's project identifier, if known.
    pub project_id: Option<String>,
    /// Content digest of the subject artifact (firmware sha256), if known.
    pub subject_sha256: Option<String>,
    /// Reconciliation status: `linked` | `reconciled` | `unavailable`.
    #[serde(default)]
    pub status: String,
    /// Opaque, offline-verifiable entitlement grant (e.g. tramiton's signed
    /// `LicenseGrant`), if the tenant provided one.
    pub license_grant: Option<String>,
    /// When evidence was last reconciled from this system.
    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
    pub last_reconciled_at: Option<DateTime<Utc>>,
 }
 impl ExternalRef {
    /// A freshly linked (not yet reconciled) reference to a sibling system.
    pub fn linked(system: ExternalSystem) -> Self {
        Self {
            system,
            project_id: None,
            subject_sha256: None,
            status: "linked".to_string(),
            license_grant: None,
            last_reconciled_at: None,
        }
    }
 }
 /// A regulatory / standards framework a target must comply with. Drives which
 /// controls the mapping engine pulls from the [`crate::traits::ControlsProvider`].
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ComplianceFramework {
    /// EU Cyber Resilience Act.
    Cra,
    /// IEC 62443 (industrial automation & control systems security).
    Iec62443,
    /// EU General Data Protection Regulation.
    Gdpr,
    /// SOC 2.
    Soc2,
    /// ISO/IEC 27001.
    Iso27001,
    /// EU Radio Equipment Directive (RED) cybersecurity articles.
    RedDirective,
 }
 impl std::fmt::Display for ComplianceFramework {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::Cra => write!(f, "cra"),
            Self::Iec62443 => write!(f, "iec_62443"),
            Self::Gdpr => write!(f, "gdpr"),
            Self::Soc2 => write!(f, "soc2"),
            Self::Iso27001 => write!(f, "iso_27001"),
            Self::RedDirective => write!(f, "red_directive"),
        }
    }
 }
 /// The compliance scope of a target: which frameworks apply and, optionally, the
 /// jurisdiction. Captured at onboarding (with per-target-type defaults from
 /// [`default_compliance_profile`]).
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct ComplianceProfile {
    /// Applicable frameworks.
    #[serde(default)]
    pub frameworks: Vec<ComplianceFramework>,
    /// Free-form jurisdiction (e.g. `eu`, `us`, `de`).
    pub jurisdiction: Option<String>,
 }
 /// The sensible default compliance scope for a target type. Firmware / PLC /
 /// embedded default to CRA + IEC 62443; software defaults to GDPR + SOC 2.
 pub fn default_compliance_profile(target_type: TargetType) -> ComplianceProfile {
    use ComplianceFramework::{Cra, Gdpr, Iec62443, Soc2};
    let frameworks = match target_type {
        TargetType::PlcSps
        | TargetType::FirmwareBareMetal
        | TargetType::FirmwareRtos
        | TargetType::EmbeddedLinuxYocto => vec![Cra, Iec62443],
        TargetType::WebApp | TargetType::BackendService => vec![Gdpr, Soc2],
        TargetType::DesktopApp | TargetType::AndroidApp | TargetType::IosApp => {
            vec![Gdpr, Cra]
        }
    };
    ComplianceProfile {
        frameworks,
        jurisdiction: None,
    }
 }
 /// A target onboarded for scanning: the unified replacement for the legacy
 /// `TrackedRepository` (SAST) and `DastTarget` (DAST) records.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct OnboardedTarget {
    /// Mongo id. Preserved from the legacy record during migration so every
    /// downstream collection keyed by `repo_id` / `target_id` keeps resolving.
    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
    pub id: Option<bson::oid::ObjectId>,
    /// Human-friendly name.
    #[serde(default)]
    pub name: String,
    /// The software family this target belongs to.
    pub target_type: TargetType,
    /// Optional free-form description (also a classification input).
    pub description: Option<String>,
    /// The artifacts provided for this target.
    #[serde(default)]
    pub artifacts: Vec<Artifact>,
    /// The classifier's verdict, once run.
    pub classification: Option<Classification>,
    /// How this target should be scanned.
    #[serde(default)]
    pub scan_config: TargetScanConfig,
    /// The compliance scope (applicable frameworks / jurisdiction).
    #[serde(default)]
    pub compliance_profile: ComplianceProfile,
    /// Links to sibling products (tramiton, ...) holding reconcilable evidence.
    #[serde(default)]
    pub external_refs: Vec<ExternalRef>,
    /// Cron schedule for recurring scans, if any.
    pub scan_schedule: Option<String>,
    /// Whether inbound webhooks are enabled for this target.
    #[serde(default)]
    pub webhook_enabled: bool,
    /// HMAC secret for verifying inbound webhooks.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub webhook_secret: Option<String>,
    /// Cached count of findings across this target's scans.
    #[serde(default)]
    pub findings_count: u32,
    /// Creation timestamp.
    #[serde(
        default = "chrono::Utc::now",
        with = "super::serde_helpers::bson_datetime"
    )]
    pub created_at: DateTime<Utc>,
    /// Last-update timestamp.
    #[serde(
        default = "chrono::Utc::now",
        with = "super::serde_helpers::bson_datetime"
    )]
    pub updated_at: DateTime<Utc>,
 }
 impl OnboardedTarget {
    /// A new target of the given type with a freshly generated webhook secret.
    pub fn new(name: String, target_type: TargetType) -> Self {
        let now = Utc::now();
        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
        Self {
            id: None,
            name,
            target_type,
            description: None,
            artifacts: Vec::new(),
            classification: None,
            scan_config: TargetScanConfig::default(),
            compliance_profile: default_compliance_profile(target_type),
            external_refs: Vec::new(),
            scan_schedule: None,
            webhook_enabled: false,
            webhook_secret: Some(webhook_secret),
            findings_count: 0,
            created_at: now,
            updated_at: now,
        }
    }
    /// The first artifact of the given kind, if present.
    pub fn first_of(&self, kind: ArtifactKind) -> Option<&Artifact> {
        self.artifacts.iter().find(|a| a.kind == kind)
    }
    /// Whether the target has at least one artifact of the given kind.
    pub fn has(&self, kind: ArtifactKind) -> bool {
        self.artifacts.iter().any(|a| a.kind == kind)
    }
    /// The primary code artifact (git repo or source archive), if any.
    pub fn code_artifact(&self) -> Option<&Artifact> {
        self.artifacts
            .iter()
            .find(|a| matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive))
    }
    /// The live-URL artifact, if any.
    pub fn live_url(&self) -> Option<&Artifact> {
        self.first_of(ArtifactKind::LiveUrl)
    }
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    fn sample_target() -> OnboardedTarget {
        let mut t = OnboardedTarget::new("acme-web".to_string(), TargetType::WebApp);
        t.artifacts.push(Artifact::git_repo(
            "https://git.example.com/acme.git",
            "main",
        ));
        t.artifacts
            .push(Artifact::live_url("https://acme.example.com"));
        t
    }
    #[test]
    fn onboarded_target_bson_round_trip() {
        let t = sample_target();
        let b = bson::to_bson(&t).expect("serialize");
        let back: OnboardedTarget = bson::from_bson(b.clone()).expect("deserialize");
        let b2 = bson::to_bson(&back).expect("re-serialize");
        assert_eq!(b, b2);
    }
    #[test]
    fn enum_display_is_snake_case() {
        assert_eq!(
            TargetType::FirmwareBareMetal.to_string(),
            "firmware_bare_metal"
        );
        assert_eq!(TargetType::PlcSps.to_string(), "plc_sps");
        assert_eq!(ArtifactKind::PlcProject.to_string(), "plc_project");
        assert_eq!(ArtifactKind::MobilePackage.to_string(), "mobile_package");
    }
    #[test]
    fn helpers_locate_artifacts() {
        let t = sample_target();
        assert!(t.has(ArtifactKind::GitRepo));
        assert!(t.live_url().is_some());
        assert!(t.code_artifact().is_some());
        assert!(!t.has(ArtifactKind::FirmwareImage));
        assert_eq!(
            t.first_of(ArtifactKind::GitRepo).map(|a| a.kind),
            Some(ArtifactKind::GitRepo)
        );
    }
    #[test]
    fn new_target_generates_webhook_secret() {
        let t = OnboardedTarget::new("t".to_string(), TargetType::BackendService);
        let secret = t.webhook_secret.expect("secret present");
        assert_eq!(secret.len(), 32);
        assert!(!secret.contains('-'));
    }
    #[test]
    fn dast_auth_folds_into_artifact_auth() {
        let dast = DastAuthConfig {
            method: "bearer".to_string(),
            login_url: Some("https://x/login".to_string()),
            username: Some("user".to_string()),
            password: Some("pw".to_string()),
            token: Some("tok".to_string()),
            headers: None,
        };
        let auth = ArtifactAuth::from(dast);
        assert_eq!(auth.method, "bearer");
        // Bearer token wins over password.
        assert_eq!(auth.secret.as_deref(), Some("tok"));
        assert_eq!(auth.login_url.as_deref(), Some("https://x/login"));
    }
    #[test]
    fn each_artifact_gets_a_unique_id() {
        let a = Artifact::firmware_image("fw.bin");
        let b = Artifact::firmware_image("fw.bin");
        assert_ne!(a.id, b.id);
    }
    #[test]
    fn firmware_default_profile_is_cra_and_62443() {
        let p = default_compliance_profile(TargetType::FirmwareBareMetal);
        assert!(p.frameworks.contains(&ComplianceFramework::Cra));
        assert!(p.frameworks.contains(&ComplianceFramework::Iec62443));
    }
    #[test]
    fn webapp_default_profile_is_gdpr_and_soc2() {
        let p = default_compliance_profile(TargetType::WebApp);
        assert!(p.frameworks.contains(&ComplianceFramework::Gdpr));
        assert!(p.frameworks.contains(&ComplianceFramework::Soc2));
    }
    #[test]
    fn new_target_gets_default_profile_and_no_external_refs() {
        let t = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareRtos);
        assert!(!t.compliance_profile.frameworks.is_empty());
        assert!(t.external_refs.is_empty());
    }
    #[test]
    fn external_ref_linked_defaults() {
        let r = ExternalRef::linked(ExternalSystem::Tramiton);
        assert_eq!(r.system, ExternalSystem::Tramiton);
        assert_eq!(r.status, "linked");
        assert!(r.project_id.is_none());
        assert!(r.last_reconciled_at.is_none());
    }
 }
@@ -3,7 +3,7 @@ use serde::{Deserialize, Serialize};
 use super::repository::ScanTrigger;
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
 pub enum ScanType {
    Sast,
@@ -16,6 +16,14 @@ pub enum ScanType {
    SecretDetection,
    Lint,
    CodeReview,
    /// Static analysis of a firmware image (unpack + component CVE).
    FirmwareStatic,
    /// Control-logic security analysis of PLC / SPS programs.
    PlcControlLogic,
    /// Static analysis of a mobile package (APK / AAB / IPA).
    MobileStatic,
    /// Static analysis of a container image.
    ContainerScan,
 }
 impl std::fmt::Display for ScanType {
@@ -31,6 +39,10 @@ impl std::fmt::Display for ScanType {
            Self::SecretDetection => write!(f, "secret_detection"),
            Self::Lint => write!(f, "lint"),
            Self::CodeReview => write!(f, "code_review"),
            Self::FirmwareStatic => write!(f, "firmware_static"),
            Self::PlcControlLogic => write!(f, "plc_control_logic"),
            Self::MobileStatic => write!(f, "mobile_static"),
            Self::ContainerScan => write!(f, "container_scan"),
        }
    }
 }
@@ -47,6 +59,8 @@ pub enum ScanRunStatus {
 #[serde(rename_all = "snake_case")]
 pub enum ScanPhase {
    ChangeDetection,
    ArtifactIngest,
    Classification,
    Sast,
    SbomGeneration,
    CveScanning,
@@ -55,6 +69,10 @@ pub enum ScanPhase {
    LintScanning,
    CodeReview,
    GraphBuilding,
    FirmwareStatic,
    PlcAnalysis,
    MobileStatic,
    ContainerScan,
    LlmTriage,
    IssueCreation,
    DastScanning,
@@ -0,0 +1,379 @@
 //! The scan-applicability matrix.
 //!
 //! Which scans are possible for a target is a function of its [`TargetType`] and
 //! which [`ArtifactKind`]s are actually present: SAST needs code, DAST needs a
 //! running URL, firmware-static analysis needs a firmware image, and so on. This
 //! module encodes that as a table — one rule set per target type — and resolves
 //! it against a concrete [`OnboardedTarget`] into a list of [`ScanOption`]s the
 //! onboarding wizard and the scan pipeline both consume.
 use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
 /// What an artifact a scan needs in order to run.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ArtifactRequirement {
    /// Source code — a git repo or a source archive.
    Code,
    /// A reachable running instance (live URL / endpoint).
    RunningUrl,
    /// A firmware image / binary blob.
    Firmware,
    /// A PLC project (PLCopen XML or Structured Text).
    Plc,
    /// A mobile package (APK / AAB / IPA).
    Mobile,
    /// A container image.
    Container,
    /// No specific artifact required.
    Any,
 }
 /// A static rule: this scan applies to a target type, needs this artifact, and
 /// defaults on/off. The rationale explains the entry to the user.
 #[derive(Debug, Clone, Copy)]
 pub struct ScanRule {
    /// The scan this rule governs.
    pub scan: ScanType,
    /// Whether the scan is on by default (only when its artifact is present).
    pub default_on: bool,
    /// Human-readable explanation of what the scan does here.
    pub rationale: &'static str,
    /// The artifact the scan consumes.
    pub requires: ArtifactRequirement,
 }
 impl ScanRule {
    const fn new(
        scan: ScanType,
        default_on: bool,
        rationale: &'static str,
        requires: ArtifactRequirement,
    ) -> Self {
        Self {
            scan,
            default_on,
            rationale,
            requires,
        }
    }
 }
 /// A resolved scan choice for a specific target: a rule intersected with the
 /// artifacts actually present. `blocked_reason` is `Some` when the required
 /// artifact is missing.
 #[derive(Debug, Clone)]
 pub struct ScanOption {
    /// The scan.
    pub scan: ScanType,
    /// Whether to pre-select the scan (false when blocked).
    pub default_on: bool,
    /// Why the scan is offered.
    pub rationale: String,
    /// The artifact kind the scan needs, if any specific one.
    pub required_artifact: Option<ArtifactKind>,
    /// Set when the required artifact is absent, explaining the block.
    pub blocked_reason: Option<String>,
 }
 /// The SAST umbrella: every static-analysis sub-scan that runs over source code.
 fn sast_umbrella() -> Vec<ScanRule> {
    use ArtifactRequirement::Code;
    vec![
        ScanRule::new(
            ScanType::Sast,
            true,
            "Static analysis (Semgrep) over source",
            Code,
        ),
        ScanRule::new(
            ScanType::Sbom,
            true,
            "Software bill of materials from source",
            Code,
        ),
        ScanRule::new(
            ScanType::Cve,
            true,
            "Match dependencies against known CVEs",
            Code,
        ),
        ScanRule::new(
            ScanType::SecretDetection,
            true,
            "Scan source for committed secrets",
            Code,
        ),
        ScanRule::new(ScanType::Lint, true, "Language linters over source", Code),
        ScanRule::new(
            ScanType::Gdpr,
            true,
            "GDPR data-handling pattern checks",
            Code,
        ),
        ScanRule::new(
            ScanType::OAuth,
            true,
            "OAuth misconfiguration patterns",
            Code,
        ),
        ScanRule::new(
            ScanType::Graph,
            true,
            "Build the code graph for impact analysis",
            Code,
        ),
        ScanRule::new(
            ScanType::CodeReview,
            false,
            "LLM code review over changed source",
            Code,
        ),
    ]
 }
 /// The rule set for a target type. Scans that are never applicable to a type are
 /// simply absent (e.g. DAST is not listed for a PLC target).
 pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
    use ArtifactRequirement::{Firmware, Mobile, Plc, RunningUrl};
    match target_type {
        TargetType::WebApp | TargetType::BackendService => {
            let mut r = sast_umbrella();
            r.push(ScanRule::new(
                ScanType::Dast,
                true,
                "Dynamic scan of the running endpoint",
                RunningUrl,
            ));
            r
        }
        TargetType::DesktopApp => sast_umbrella(),
        TargetType::AndroidApp | TargetType::IosApp => {
            let mut r = sast_umbrella();
            r.push(ScanRule::new(
                ScanType::MobileStatic,
                true,
                "Static analysis of the mobile package (manifest, permissions, libs)",
                Mobile,
            ));
            r
        }
        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos => {
            let mut r = sast_umbrella();
            r.push(ScanRule::new(
                ScanType::FirmwareStatic,
                true,
                "Unpack and statically analyze the firmware image",
                Firmware,
            ));
            r.push(ScanRule::new(
                ScanType::Sbom,
                true,
                "SBOM from the firmware image (binwalk / tramiton)",
                Firmware,
            ));
            r.push(ScanRule::new(
                ScanType::Cve,
                true,
                "Match firmware components against known CVEs",
                Firmware,
            ));
            r
        }
        TargetType::EmbeddedLinuxYocto => {
            let mut r = sast_umbrella();
            r.push(ScanRule::new(
                ScanType::FirmwareStatic,
                true,
                "EMBA / binwalk static analysis of the image",
                Firmware,
            ));
            r.push(ScanRule::new(
                ScanType::Sbom,
                true,
                "SBOM from image layers / recipes",
                Firmware,
            ));
            r.push(ScanRule::new(
                ScanType::Cve,
                true,
                "Match image components against known CVEs",
                Firmware,
            ));
            r.push(ScanRule::new(
                ScanType::Dast,
                false,
                "Dynamic scan of exposed network services (if any)",
                RunningUrl,
            ));
            r
        }
        TargetType::PlcSps => vec![ScanRule::new(
            ScanType::PlcControlLogic,
            true,
            "Control-logic security rules over the PLC program",
            Plc,
        )],
    }
 }
 /// Whether an active penetration test is applicable to this target type.
 ///
 /// Pentest runs as its own session (not a [`ScanType`] scan) and needs a
 /// reachable running target, so it is offered only for the network-reachable
 /// families.
 pub fn supports_pentest(target_type: TargetType) -> bool {
    matches!(
        target_type,
        TargetType::WebApp
            | TargetType::BackendService
            | TargetType::AndroidApp
            | TargetType::IosApp
            | TargetType::EmbeddedLinuxYocto
    )
 }
 /// The representative artifact kind a requirement is satisfied by.
 fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
    match req {
        ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
        ArtifactRequirement::RunningUrl => Some(ArtifactKind::LiveUrl),
        ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
        ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
        ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
        ArtifactRequirement::Container => Some(ArtifactKind::ContainerImage),
        ArtifactRequirement::Any => None,
    }
 }
 /// Whether the target carries an artifact that satisfies the requirement.
 fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
    match req {
        ArtifactRequirement::Code => target.code_artifact().is_some(),
        ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
        ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
        ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
        ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
        ArtifactRequirement::Any => true,
    }
 }
 /// Resolve the matrix for a concrete target into the scans it can run, marking
 /// any whose required artifact is missing as blocked.
 pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
    rules_for(target.target_type)
        .into_iter()
        .map(|rule| {
            let satisfied = requirement_satisfied(rule.requires, target);
            let required_artifact = representative_kind(rule.requires);
            let blocked_reason = if satisfied {
                None
            } else {
                Some(match required_artifact {
                    Some(kind) => format!("no {kind} artifact provided"),
                    None => "required artifact missing".to_string(),
                })
            };
            ScanOption {
                scan: rule.scan,
                default_on: rule.default_on && satisfied,
                rationale: rule.rationale.to_string(),
                required_artifact,
                blocked_reason,
            }
        })
        .collect()
 }
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
    use super::*;
    use crate::models::{Artifact, PlcFormat};
    fn target_with(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
        let mut t = OnboardedTarget::new("t".to_string(), target_type);
        t.artifacts = artifacts;
        t
    }
    fn option<'a>(opts: &'a [ScanOption], scan: ScanType) -> Option<&'a ScanOption> {
        opts.iter().find(|o| o.scan == scan)
    }
    #[test]
    fn webapp_with_code_and_url_offers_sast_and_dast() {
        let t = target_with(
            TargetType::WebApp,
            vec![
                Artifact::git_repo("u", "main"),
                Artifact::live_url("http://x"),
            ],
        );
        let opts = applicable_scans(&t);
        let sast = option(&opts, ScanType::Sast).expect("sast offered");
        assert!(sast.default_on && sast.blocked_reason.is_none());
        let dast = option(&opts, ScanType::Dast).expect("dast offered");
        assert!(dast.default_on && dast.blocked_reason.is_none());
    }
    #[test]
    fn webapp_without_url_blocks_dast() {
        let t = target_with(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
        let opts = applicable_scans(&t);
        let dast = option(&opts, ScanType::Dast).expect("dast listed");
        assert!(!dast.default_on);
        assert!(dast.blocked_reason.is_some());
        assert_eq!(dast.required_artifact, Some(ArtifactKind::LiveUrl));
    }
    #[test]
    fn firmware_offers_firmware_static_and_not_dast() {
        let t = target_with(
            TargetType::FirmwareBareMetal,
            vec![Artifact::firmware_image("fw.bin")],
        );
        let opts = applicable_scans(&t);
        let fw = option(&opts, ScanType::FirmwareStatic).expect("firmware static offered");
        assert!(fw.default_on && fw.blocked_reason.is_none());
        assert!(option(&opts, ScanType::Dast).is_none());
    }
    #[test]
    fn plc_offers_only_control_logic() {
        let t = target_with(
            TargetType::PlcSps,
            vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
        );
        let opts = applicable_scans(&t);
        assert_eq!(opts.len(), 1);
        assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
        assert!(opts[0].default_on);
    }
    #[test]
    fn pentest_support_matches_reachable_families() {
        assert!(supports_pentest(TargetType::WebApp));
        assert!(supports_pentest(TargetType::BackendService));
        assert!(!supports_pentest(TargetType::PlcSps));
        assert!(!supports_pentest(TargetType::FirmwareBareMetal));
        assert!(!supports_pentest(TargetType::DesktopApp));
    }
    #[test]
    fn every_target_type_has_at_least_one_rule() {
        for tt in [
            TargetType::WebApp,
            TargetType::BackendService,
            TargetType::DesktopApp,
            TargetType::AndroidApp,
            TargetType::IosApp,
            TargetType::FirmwareBareMetal,
            TargetType::FirmwareRtos,
            TargetType::EmbeddedLinuxYocto,
            TargetType::PlcSps,
        ] {
            assert!(!rules_for(tt).is_empty(), "{tt} has no rules");
        }
    }
 }
@@ -0,0 +1,51 @@
 //! The target-classification port.
 //!
 //! A [`TargetClassifier`] inspects a target's artifacts (and optionally their
 //! ingested working directories) and proposes one or more [`ClassifierVerdict`]s
 //! — a target type, a confidence, and the facts the decision rested on. Concrete
 //! classifiers live in the agent (language/build-system fingerprinting, a
 //! firmware detector backed by tramiton, etc.); a registry merges and ranks
 //! their verdicts. This mirrors the [`crate::traits::Scanner`] port so the two
 //! read the same way.
 use std::collections::HashMap;
 use std::path::PathBuf;
 use crate::error::CoreError;
 use crate::models::{Artifact, DetectedFact, TargetType};
 /// Everything a classifier needs to reason about a target.
 pub struct ClassificationInput<'a> {
    /// The artifacts declared for the target.
    pub artifacts: &'a [Artifact],
    /// Ingested working paths, keyed by [`Artifact::id`]. Absent for artifacts
    /// with no on-disk form (e.g. a live URL).
    pub working_paths: &'a HashMap<String, PathBuf>,
    /// Free-form description of the target, if provided.
    pub description: Option<&'a str>,
 }
 /// A single classifier's proposal for a target.
 pub struct ClassifierVerdict {
    /// The proposed target type.
    pub target_type: TargetType,
    /// Confidence in `[0.0, 1.0]`.
    pub confidence: f32,
    /// Facts that informed the proposal.
    pub facts: Vec<DetectedFact>,
    /// Human-readable explanation.
    pub rationale: String,
 }
 /// A source of target-type classification.
 #[allow(async_fn_in_trait)]
 pub trait TargetClassifier: Send + Sync {
    /// Stable identifier for this classifier (recorded in `detected_by`).
    fn name(&self) -> &str;
    /// Propose zero or more ranked verdicts for the given input.
    async fn classify(
        &self,
        input: &ClassificationInput<'_>,
    ) -> Result<Vec<ClassifierVerdict>, CoreError>;
 }
@@ -0,0 +1,45 @@
 //! The compliance-controls provider port.
 //!
 //! The mapping engine turns findings into compliance status against a corpus of
 //! controls. That corpus is pluggable: the built-in OSCAL catalog by default, or
 //! a tenant-owned RAG of atomic controls derived from laws
 //! (`breakpilot-compliance`) when available. A [`ControlsProvider`] abstracts the
 //! source so the mapping engine does not hardcode a catalog.
 use crate::error::CoreError;
 use crate::models::ComplianceFramework;
 /// A control retrieved from a controls corpus.
 #[derive(Debug, Clone)]
 pub struct Control {
    /// Stable control identifier (e.g. an OSCAL control id or a RAG chunk id).
    pub id: String,
    /// The framework this control belongs to.
    pub framework: ComplianceFramework,
    /// Short human-readable title.
    pub title: String,
    /// The control text / requirement.
    pub text: String,
    /// Free-form source reference (catalog name, law citation, ...).
    pub source: Option<String>,
 }
 /// A query for relevant controls.
 pub struct ControlQuery<'a> {
    /// Frameworks in scope for the target.
    pub frameworks: &'a [ComplianceFramework],
    /// Free-text describing what to map (a finding summary, a component, ...).
    pub context: &'a str,
    /// Maximum number of controls to return.
    pub limit: usize,
 }
 /// A source of compliance controls (built-in OSCAL catalog, breakpilot RAG, ...).
 #[allow(async_fn_in_trait)]
 pub trait ControlsProvider: Send + Sync {
    /// Stable identifier for this provider.
    fn name(&self) -> &str;
    /// Retrieve the controls most relevant to the query.
    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError>;
 }
@@ -0,0 +1,58 @@
 //! The external-evidence provider port.
 //!
 //! A sibling product (tramiton, for firmware) may already hold authoritative
 //! analysis for an artifact. An [`EvidenceProvider`] lets compliance-scanner
 //! *reconcile* that evidence — a build plan, an SBOM, a VEX document, a
 //! reproducible-build lock, an attestation — instead of recomputing it. The key
 //! used to match is the artifact content digest (a firmware sha256, which equals
 //! [`crate::models::Artifact::content_hash`]).
 //!
 //! Concrete providers live in the agent (a tramiton CLI shell-out today, a cloud
 //! client later) plus a deterministic mock for tests, so nothing here depends on
 //! an external binary.
 use std::path::Path;
 use crate::error::CoreError;
 use crate::models::{Artifact, ExternalSystem};
 /// A single reconcilable evidence document fetched from a sibling product.
 #[derive(Debug, Clone)]
 pub struct EvidenceDocument {
    /// What the document is: `build_plan` | `sbom` | `vex` | `lock` | `attestation`.
    pub kind: String,
    /// The document's format (e.g. `cyclonedx-1.5`, `openvex-0.2.0`, `toml`, `json`).
    pub format: String,
    /// The raw document payload.
    pub content: String,
 }
 /// The evidence a provider could return for a target's artifact.
 #[derive(Debug, Clone, Default)]
 pub struct ReconciledEvidence {
    /// The sibling's project identifier, if resolved.
    pub project_id: Option<String>,
    /// The subject content digest the evidence pertains to.
    pub subject_sha256: Option<String>,
    /// The documents fetched (any of build plan / SBOM / VEX / lock / attestation).
    pub documents: Vec<EvidenceDocument>,
 }
 /// A source of externally-held, reconcilable evidence for an artifact.
 #[allow(async_fn_in_trait)]
 pub trait EvidenceProvider: Send + Sync {
    /// Which sibling product this provider integrates.
    fn system(&self) -> ExternalSystem;
    /// Whether this provider can handle the given artifact + working path
    /// (e.g. tramiton handles firmware images / embedded source trees).
    fn handles(&self, artifact: &Artifact, working_path: Option<&Path>) -> bool;
    /// Reconcile existing evidence for the artifact, keyed by its content digest.
    /// Returns `Ok(None)` when the provider has nothing for this artifact.
    async fn reconcile(
        &self,
        artifact: &Artifact,
        working_path: Option<&Path>,
    ) -> Result<Option<ReconciledEvidence>, CoreError>;
 }
@@ -1,10 +1,16 @@
 pub mod classifier;
 pub mod controls;
 pub mod dast_agent;
 pub mod evidence;
 pub mod graph_builder;
 pub mod issue_tracker;
 pub mod pentest_tool;
 pub mod scanner;
 pub use classifier::{ClassificationInput, ClassifierVerdict, TargetClassifier};
 pub use controls::{Control, ControlQuery, ControlsProvider};
 pub use dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
 pub use evidence::{EvidenceDocument, EvidenceProvider, ReconciledEvidence};
 pub use graph_builder::{LanguageParser, ParseOutput};
 pub use issue_tracker::IssueTracker;
 pub use pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};
@@ -12,6 +12,10 @@ pub enum Route {
        OverviewPage {},
        #[route("/repositories")]
        RepositoriesPage {},
        #[route("/targets")]
        TargetsPage {},
        #[route("/onboard")]
        OnboardingPage {},
        #[route("/findings")]
        FindingsPage {},
        #[route("/findings/:id")]
@@ -44,6 +48,8 @@ pub enum Route {
        PentestSessionPage { session_id: String },
        #[route("/mcp-servers")]
        McpServersPage {},
        #[route("/mcp-tokens")]
        McpTokensPage {},
 }
 const FAVICON: Asset = asset!("/assets/favicon.svg");
@@ -24,10 +24,15 @@ pub fn Sidebar() -> Element {
            icon: rsx! { Icon { icon: BsSpeedometer2, width: 18, height: 18 } },
        },
        NavItem {
-            label: "Repositories",
+            label: "Targets",
-            route: Route::RepositoriesPage {},
+            route: Route::TargetsPage {},
            icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
        },
        NavItem {
            label: "Onboard",
            route: Route::OnboardingPage {},
            icon: rsx! { Icon { icon: BsPlusCircle, width: 18, height: 18 } },
        },
        NavItem {
            label: "Findings",
            route: Route::FindingsPage {},
@@ -0,0 +1,90 @@
 //! Server-functions for the MCP-tokens management UI.
 //!
 //! These wrap the agent's `/api/v1/mcp-tokens` CRUD endpoints. The raw
 //! token returned by `create_mcp_token` is only visible at creation
 //! time — the agent's storage never holds the plaintext.
 use dioxus::prelude::*;
 use serde::{Deserialize, Serialize};
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct McpTokenView {
    pub id: String,
    pub name: String,
    pub token_prefix: String,
    pub created_by: String,
    pub created_at: serde_json::Value,
    #[serde(default)]
    pub last_used_at: Option<serde_json::Value>,
    #[serde(default)]
    pub revoked: bool,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct McpTokensListResponse {
    pub data: Vec<McpTokenView>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct CreateMcpTokenResponse {
    /// Raw token. Shown ONCE — the user must copy it now.
    pub token: String,
    pub view: McpTokenView,
 }
 #[server]
 pub async fn fetch_mcp_tokens() -> Result<McpTokensListResponse, ServerFnError> {
    let resp = super::agent_client::agent_get("/api/v1/mcp-tokens")
        .await?
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    let body: McpTokensListResponse = resp
        .json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    Ok(body)
 }
 #[server]
 pub async fn create_mcp_token(name: String) -> Result<CreateMcpTokenResponse, ServerFnError> {
    if name.trim().is_empty() {
        return Err(ServerFnError::new("Name is required"));
    }
    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/mcp-tokens")
        .await?
        .json(&serde_json::json!({ "name": name.trim() }))
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    if !resp.status().is_success() {
        let body = resp.text().await.unwrap_or_default();
        return Err(ServerFnError::new(format!(
            "Failed to create token: {body}"
        )));
    }
    let body: CreateMcpTokenResponse = resp
        .json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    Ok(body)
 }
 #[server]
 pub async fn revoke_mcp_token(id: String) -> Result<(), ServerFnError> {
    let resp = super::agent_client::agent_request(
        reqwest::Method::DELETE,
        &format!("/api/v1/mcp-tokens/{id}"),
    )
    .await?
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    if !resp.status().is_success() {
        let body = resp.text().await.unwrap_or_default();
        return Err(ServerFnError::new(format!(
            "Failed to revoke token: {body}"
        )));
    }
    Ok(())
 }
@@ -8,7 +8,9 @@ pub mod graph;
 pub mod help_chat;
 pub mod issues;
 pub mod mcp;
 pub mod mcp_tokens;
 pub mod notifications;
 pub mod onboarding;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
 pub mod repositories;
@@ -0,0 +1,139 @@
 //! Server functions for the onboarding wizard — proxy to the agent's
 //! `/api/v1/targets` endpoints.
 use dioxus::prelude::*;
 use serde::{Deserialize, Serialize};
 /// One artifact the wizard collects for a target.
 #[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
 pub struct ArtifactInputDto {
    pub kind: String,
    pub source_ref: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub branch: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub plc_format: Option<String>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct TargetsResponse {
    pub data: Vec<serde_json::Value>,
    pub total: Option<u64>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct TargetResponse {
    pub data: serde_json::Value,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ApplicableScansData {
    #[serde(default)]
    pub scans: Vec<serde_json::Value>,
    #[serde(default)]
    pub pentest_supported: bool,
 }
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ApplicableScansResponse {
    pub data: ApplicableScansData,
 }
 /// List onboarded targets.
 #[server]
 pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
    let resp = super::agent_client::agent_get("/api/v1/targets")
        .await?
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Create a target with the collected artifacts.
 #[server]
 pub async fn create_target(
    name: String,
    target_type: String,
    description: Option<String>,
    artifacts: Vec<ArtifactInputDto>,
 ) -> Result<TargetResponse, ServerFnError> {
    let body = serde_json::json!({
        "name": name,
        "target_type": target_type,
        "description": description,
        "artifacts": artifacts,
    });
    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/targets")
        .await?
        .json(&body)
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Run kind-based classification on a target.
 #[server]
 pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
    let resp = super::agent_client::agent_request(
        reqwest::Method::POST,
        &format!("/api/v1/targets/{id}/detect"),
    )
    .await?
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Fetch the scan-applicability matrix for a target.
 #[server]
 pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansResponse, ServerFnError> {
    let resp = super::agent_client::agent_get(&format!("/api/v1/targets/{id}/applicable-scans"))
        .await?
        .send()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Delete a target (and cascade its findings / SBOM / scan runs / CVE alerts).
 #[server]
 pub async fn delete_target(id: String) -> Result<serde_json::Value, ServerFnError> {
    let resp = super::agent_client::agent_request(
        reqwest::Method::DELETE,
        &format!("/api/v1/targets/{id}"),
    )
    .await?
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
 /// Trigger a scan for a target.
 #[server]
 pub async fn trigger_target_scan(id: String) -> Result<serde_json::Value, ServerFnError> {
    let resp = super::agent_client::agent_request(
        reqwest::Method::POST,
        &format!("/api/v1/targets/{id}/scan"),
    )
    .await?
    .send()
    .await
    .map_err(|e| ServerFnError::new(e.to_string()))?;
    resp.json()
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))
 }
@@ -0,0 +1,271 @@
 use dioxus::prelude::*;
 use dioxus_free_icons::icons::bs_icons::*;
 use dioxus_free_icons::Icon;
 use crate::components::page_header::PageHeader;
 use crate::components::toast::{ToastType, Toasts};
 use crate::infrastructure::mcp_tokens::{
    create_mcp_token, fetch_mcp_tokens, revoke_mcp_token, CreateMcpTokenResponse,
 };
 #[component]
 pub fn McpTokensPage() -> Element {
    let mut tokens = use_resource(|| async { fetch_mcp_tokens().await.ok() });
    let mut toasts = use_context::<Toasts>();
    // Create-form state
    let mut show_form = use_signal(|| false);
    let mut new_name = use_signal(String::new);
    let mut submitting = use_signal(|| false);
    // After creation, the raw token shows once in a banner
    let mut just_created: Signal<Option<CreateMcpTokenResponse>> = use_signal(|| None);
    // Revoke confirmation: (id, name)
    let mut confirm_revoke: Signal<Option<(String, String)>> = use_signal(|| None);
    rsx! {
        PageHeader {
            title: "MCP Tokens",
            description: "Static bearer tokens for the MCP server. Use in your LLM client (Claude Desktop, Cursor, etc.) — one token per tool/device.",
        }
        // ── Just-created banner ────────────────────────────────────
        if let Some(resp) = just_created() {
            div { class: "card mb-4", style: "border: 1px solid var(--accent-warning); background: var(--bg-warning-subtle);",
                div { class: "card-header", style: "color: var(--accent-warning);",
                    Icon { icon: BsExclamationTriangle, width: 14, height: 14 }
                    " Copy this token now — it won't be shown again"
                }
                div { style: "padding: 1rem;",
                    p { style: "margin-bottom: 0.5rem; color: var(--text-secondary);",
                        "Token for "
                        strong { "{resp.view.name}" }
                    }
                    div { class: "copyable", style: "background: var(--bg-secondary); padding: 0.75rem; border-radius: 4px;",
                        code { style: "font-family: var(--font-mono); word-break: break-all; flex: 1;", "{resp.token}" }
                        crate::components::copy_button::CopyButton { value: resp.token.clone(), small: false }
                    }
                    div { style: "margin-top: 0.75rem;",
                        button {
                            class: "btn btn-sm btn-ghost",
                            onclick: move |_| just_created.set(None),
                            "Dismiss"
                        }
                    }
                }
            }
        }
        // ── Create form ────────────────────────────────────────────
        div { class: "mb-4",
            button {
                class: "btn btn-primary",
                onclick: move |_| {
                    show_form.set(!show_form());
                    new_name.set(String::new());
                },
                if show_form() { "Cancel" } else {
                    Icon { icon: BsPlusLg, width: 14, height: 14 }
                    " Create Token"
                }
            }
        }
        if show_form() {
            div { class: "card mb-4",
                div { class: "card-header", "New MCP Token" }
                div { style: "padding: 1rem;",
                    div { class: "form-group",
                        label { "Name" }
                        input {
                            r#type: "text",
                            placeholder: "Claude Desktop on my laptop",
                            value: "{new_name}",
                            oninput: move |e| new_name.set(e.value()),
                        }
                        small { style: "color: var(--text-secondary);", "A label so you can identify this token in the list. Not visible to LLM clients." }
                    }
                    div { style: "margin-top: 1rem;",
                        button {
                            class: "btn btn-primary",
                            disabled: submitting() || new_name().trim().is_empty(),
                            onclick: move |_| {
                                let name = new_name().trim().to_string();
                                if name.is_empty() {
                                    return;
                                }
                                spawn(async move {
                                    submitting.set(true);
                                    match create_mcp_token(name).await {
                                        Ok(resp) => {
                                            toasts.push(ToastType::Success, "Token created. Copy it now — it won't be shown again.");
                                            just_created.set(Some(resp));
                                            show_form.set(false);
                                            new_name.set(String::new());
                                            tokens.restart();
                                        }
                                        Err(e) => {
                                            toasts.push(ToastType::Error, format!("Failed to create token: {e}"));
                                        }
                                    }
                                    submitting.set(false);
                                });
                            },
                            if submitting() { "Creating..." } else { "Create" }
                        }
                    }
                }
            }
        }
        // ── Tokens list ────────────────────────────────────────────
        match &*tokens.read() {
            Some(Some(resp)) => {
                if resp.data.is_empty() {
                    rsx! {
                        div { class: "card",
                            p { style: "padding: 1rem; color: var(--text-secondary);", "No MCP tokens yet. Create one to start using the MCP server from an LLM client." }
                        }
                    }
                } else {
                    rsx! {
                        div { class: "mcp-cards-grid",
                            for token in resp.data.iter() {
                                {
                                    let id = token.id.clone();
                                    let name = token.name.clone();
                                    let prefix = token.token_prefix.clone();
                                    let created_str = format_timestamp(&token.created_at);
                                    let last_used_str = token
                                        .last_used_at
                                        .as_ref()
                                        .map(format_timestamp)
                                        .unwrap_or_else(|| "never".to_string());
                                    let revoked = token.revoked;
                                    rsx! {
                                        div { class: "mcp-card", style: if revoked { "opacity: 0.55;" } else { "" },
                                            div { class: "mcp-card-header",
                                                div { class: "mcp-card-title",
                                                    Icon { icon: BsKey, width: 14, height: 14 }
                                                    h3 { "{name}" }
                                                    if revoked {
                                                        span { class: "mcp-card-status stopped", "revoked" }
                                                    }
                                                }
                                                if !revoked {
                                                    button {
                                                        class: "btn btn-sm btn-ghost btn-ghost-danger",
                                                        title: "Revoke token",
                                                        onclick: {
                                                            let id = id.clone();
                                                            let name = name.clone();
                                                            move |_| {
                                                                confirm_revoke.set(Some((id.clone(), name.clone())));
                                                            }
                                                        },
                                                        Icon { icon: BsTrash, width: 14, height: 14 }
                                                    }
                                                }
                                            }
                                            div { class: "mcp-card-details",
                                                div { class: "mcp-detail-row",
                                                    Icon { icon: BsKey, width: 13, height: 13 }
                                                    span { class: "mcp-detail-label", "Prefix" }
                                                    code { class: "mcp-detail-value", "{prefix}…" }
                                                }
                                                div { class: "mcp-detail-row",
                                                    Icon { icon: BsCalendar, width: 13, height: 13 }
                                                    span { class: "mcp-detail-label", "Created" }
                                                    span { class: "mcp-detail-value", "{created_str}" }
                                                }
                                                div { class: "mcp-detail-row",
                                                    Icon { icon: BsClockHistory, width: 13, height: 13 }
                                                    span { class: "mcp-detail-label", "Last used" }
                                                    span { class: "mcp-detail-value", "{last_used_str}" }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
            Some(None) => rsx! {
                div { class: "card",
                    p { style: "padding: 1rem; color: var(--accent-danger);", "Failed to load MCP tokens." }
                }
            },
            None => rsx! {
                div { class: "card",
                    p { style: "padding: 1rem; color: var(--text-secondary);", "Loading..." }
                }
            },
        }
        // ── Revoke confirmation modal ──────────────────────────────
        if let Some((id, name)) = confirm_revoke() {
            div { class: "modal-overlay",
                div { class: "modal",
                    h3 { "Revoke token?" }
                    p {
                        "The token "
                        strong { "{name}" }
                        " will stop working immediately. This cannot be undone. Any LLM client using it will start getting 401."
                    }
                    div { style: "display: flex; gap: 0.5rem; margin-top: 1rem; justify-content: flex-end;",
                        button {
                            class: "btn btn-ghost",
                            onclick: move |_| confirm_revoke.set(None),
                            "Cancel"
                        }
                        button {
                            class: "btn btn-danger",
                            onclick: {
                                let id = id.clone();
                                move |_| {
                                    let id = id.clone();
                                    spawn(async move {
                                        match revoke_mcp_token(id).await {
                                            Ok(()) => {
                                                toasts.push(ToastType::Success, "Token revoked");
                                                tokens.restart();
                                            }
                                            Err(e) => {
                                                toasts.push(ToastType::Error, format!("Failed to revoke: {e}"));
                                            }
                                        }
                                        confirm_revoke.set(None);
                                    });
                                }
                            },
                            "Revoke"
                        }
                    }
                }
            }
        }
    }
 }
 /// Best-effort timestamp formatter. The agent serializes BSON DateTime
 /// as `{"$date":{"$numberLong":"..."}}` in extended JSON. We accept
 /// that shape, plain ISO strings, or anything else (best-effort).
 fn format_timestamp(v: &serde_json::Value) -> String {
    if let Some(s) = v.as_str() {
        return s.to_string();
    }
    if let Some(ms) = v
        .get("$date")
        .and_then(|d| d.get("$numberLong"))
        .and_then(|s| s.as_str())
        .and_then(|s| s.parse::<i64>().ok())
    {
        return chrono::DateTime::<chrono::Utc>::from_timestamp_millis(ms)
            .map(|d| d.format("%Y-%m-%d %H:%M").to_string())
            .unwrap_or_else(|| ms.to_string());
    }
    "—".to_string()
 }
@@ -11,11 +11,14 @@ pub mod graph_index;
 pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
 pub mod mcp_tokens;
 pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
 pub mod repositories;
 pub mod sbom;
 pub mod targets;
 pub use chat::ChatPage;
 pub use chat_index::ChatIndexPage;
@@ -30,8 +33,11 @@ pub use graph_index::GraphIndexPage;
 pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
 pub use mcp_tokens::McpTokensPage;
 pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
 pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;
 pub use targets::TargetsPage;
@@ -0,0 +1,402 @@
 use dioxus::prelude::*;
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::onboarding::{
    create_target, detect_target, fetch_applicable_scans, trigger_target_scan, ArtifactInputDto,
 };
 /// (value, label, one-line description) for the 9 target families.
 const TARGET_TYPES: &[(&str, &str, &str)] = &[
    ("web_app", "Web Application", "Front end + server"),
    ("backend_service", "Backend / API", "REST, GraphQL, gRPC"),
    ("desktop_app", "Desktop App", "Windows / macOS / Linux"),
    ("android_app", "Android App", "APK / AAB"),
    ("ios_app", "iOS App", "IPA"),
    (
        "firmware_bare_metal",
        "Firmware — bare metal",
        "No operating system",
    ),
    ("firmware_rtos", "Firmware — RTOS", "Zephyr, FreeRTOS, ..."),
    (
        "embedded_linux_yocto",
        "Embedded Linux / Yocto",
        "BSP + image",
    ),
    ("plc_sps", "PLC / SPS", "IEC 61131-3"),
 ];
 /// (value, label) for the artifact kinds a user can attach.
 const ARTIFACT_KINDS: &[(&str, &str)] = &[
    ("git_repo", "Git repository"),
    ("source_archive", "Source archive (zip)"),
    ("firmware_image", "Firmware image"),
    ("mobile_package", "Mobile package (APK/IPA)"),
    ("container_image", "Container image"),
    ("live_url", "Live URL"),
    ("plc_project", "PLC project"),
    ("plaintext_description", "Description (text)"),
 ];
 const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
 /// One row in the applicable-scans list on the success step.
 #[component]
 fn ScanRow(scan: serde_json::Value) -> Element {
    let name = scan
        .get("scan")
        .and_then(|v| v.as_str())
        .unwrap_or("?")
        .to_string();
    let rationale = scan
        .get("rationale")
        .and_then(|v| v.as_str())
        .unwrap_or("")
        .to_string();
    let blocked = scan
        .get("blocked_reason")
        .and_then(|v| v.as_str())
        .map(String::from);
    let default_on = scan
        .get("default_on")
        .and_then(|v| v.as_bool())
        .unwrap_or(false);
    let badge_class = if blocked.is_some() {
        "badge badge-info"
    } else if default_on {
        "badge badge-success"
    } else {
        "badge"
    };
    rsx! {
        div { style: "display: flex; gap: 8px; align-items: center; padding: 6px 0;",
            span { class: "{badge_class}", "{name}" }
            span { style: "opacity: 0.8;", "{rationale}" }
            if let Some(b) = blocked {
                span { style: "opacity: 0.6; font-style: italic;", "— {b}" }
            }
        }
    }
 }
 fn kind_label(kind: &str) -> &str {
    ARTIFACT_KINDS
        .iter()
        .find(|(v, _)| *v == kind)
        .map(|(_, l)| *l)
        .unwrap_or(kind)
 }
 fn type_label(value: &str) -> &str {
    TARGET_TYPES
        .iter()
        .find(|(v, _, _)| *v == value)
        .map(|(_, l, _)| *l)
        .unwrap_or(value)
 }
 #[component]
 pub fn OnboardingPage() -> Element {
    let mut step = use_signal(|| 0usize);
    let mut name = use_signal(String::new);
    let mut target_type = use_signal(String::new);
    let mut description = use_signal(String::new);
    let mut artifacts = use_signal(Vec::<ArtifactInputDto>::new);
    // "Add artifact" mini-form.
    let mut new_kind = use_signal(|| "git_repo".to_string());
    let mut new_source = use_signal(String::new);
    let mut new_branch = use_signal(|| "main".to_string());
    // Create + result state.
    let mut creating = use_signal(|| false);
    let mut error = use_signal(|| Option::<String>::None);
    let mut scans = use_signal(Vec::<serde_json::Value>::new);
    let mut suggested = use_signal(|| Option::<String>::None);
    let mut created_id = use_signal(|| Option::<String>::None);
    let mut scan_msg = use_signal(|| Option::<String>::None);
    let step_now = step();
    let can_advance_type = !name().trim().is_empty() && !target_type().trim().is_empty();
    let has_artifacts = !artifacts().is_empty();
    rsx! {
        PageHeader {
            title: "Onboard a target",
            description: "Add a target, attach its artifacts, and see which scans apply.",
        }
        // Stepper.
        div { class: "wizard-steps",
            for (i, label) in STEP_LABELS.iter().enumerate() {
                div {
                    class: if i == step_now { "wizard-step wizard-step-active" } else { "wizard-step" },
                    span { class: "wizard-step-dot", "{i + 1}" }
                    span { class: "wizard-step-label", "{label}" }
                }
            }
        }
        if let Some(err) = error() {
            div { class: "card", style: "border-color: var(--danger, #d33); margin-bottom: 12px;",
                div { class: "card-header", "Error" }
                div { style: "padding: 12px;", "{err}" }
            }
        }
        div { class: "card",
            // ---- Step 0: target type + name ----
            if step_now == 0 {
                div { class: "card-header", "What kind of software is this?" }
                div { style: "padding: 16px;",
                    div { class: "form-group",
                        label { "Name" }
                        input {
                            r#type: "text",
                            placeholder: "acme-web",
                            value: "{name}",
                            oninput: move |e| name.set(e.value()),
                        }
                    }
                    div {
                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
                        for (value, tlabel, tdesc) in TARGET_TYPES.iter().copied() {
                            div {
                                class: "card",
                                style: if target_type() == value {
                                    "padding: 12px; cursor: pointer; border: 2px solid var(--accent, #3b82f6);"
                                } else {
                                    "padding: 12px; cursor: pointer;"
                                },
                                onclick: move |_| target_type.set(value.to_string()),
                                div { style: "font-weight: 600;", "{tlabel}" }
                                div { style: "font-size: 0.85em; opacity: 0.7;", "{tdesc}" }
                            }
                        }
                    }
                }
            }
            // ---- Step 1: artifacts ----
            if step_now == 1 {
                div { class: "card-header", "Attach artifacts" }
                div { style: "padding: 16px;",
                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
                        div { class: "form-group", style: "margin: 0;",
                            label { "Kind" }
                            select {
                                value: "{new_kind}",
                                oninput: move |e| new_kind.set(e.value()),
                                for (value, klabel) in ARTIFACT_KINDS.iter().copied() {
                                    option { value: "{value}", "{klabel}" }
                                }
                            }
                        }
                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
                            label { "Reference (URL / path / text)" }
                            input {
                                r#type: "text",
                                placeholder: "https://git.example.com/acme.git",
                                value: "{new_source}",
                                oninput: move |e| new_source.set(e.value()),
                            }
                        }
                        if new_kind() == "git_repo" {
                            div { class: "form-group", style: "margin: 0;",
                                label { "Branch" }
                                input {
                                    r#type: "text",
                                    value: "{new_branch}",
                                    oninput: move |e| new_branch.set(e.value()),
                                }
                            }
                        }
                        button {
                            class: "btn btn-secondary",
                            onclick: move |_| {
                                let kind = new_kind();
                                if !new_source().trim().is_empty() {
                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
                                    artifacts.write().push(ArtifactInputDto {
                                        kind,
                                        source_ref: new_source(),
                                        branch,
                                        plc_format: None,
                                    });
                                    new_source.set(String::new());
                                }
                            },
                            "+ Add"
                        }
                    }
                    div { style: "margin-top: 16px;",
                        if has_artifacts {
                            for (i, a) in artifacts().iter().enumerate() {
                                div {
                                    style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-bottom: 6px;",
                                    span {
                                        span { style: "opacity: 0.7;", "{kind_label(&a.kind)}: " }
                                        "{a.source_ref}"
                                    }
                                    button {
                                        class: "btn btn-ghost-danger btn-sm",
                                        onclick: move |_| { artifacts.write().remove(i); },
                                        "Remove"
                                    }
                                }
                            }
                        } else {
                            div { style: "opacity: 0.6;", "No artifacts yet. Add at least one." }
                        }
                    }
                }
            }
            // ---- Step 2: review + create ----
            if step_now == 2 {
                div { class: "card-header", "Review" }
                div { style: "padding: 16px;",
                    div { class: "wizard-summary",
                        div { strong { "Name: " } "{name()}" }
                        div { strong { "Type: " } "{type_label(&target_type())}" }
                        div { strong { "Artifacts:" } }
                        ul {
                            for a in artifacts() {
                                li { "{kind_label(&a.kind)}: {a.source_ref}" }
                            }
                        }
                    }
                    div { style: "margin-top: 12px; opacity: 0.7; font-size: 0.9em;",
                        "The applicable scans (SAST / DAST / firmware / PLC) are shown after the target is created."
                    }
                }
            }
            // ---- Step 3: created ----
            if step_now == 3 {
                div { class: "card-header", "Target onboarded" }
                div { style: "padding: 16px;",
                    p {
                        strong { "{name()}" }
                        " was created."
                        if let Some(s) = suggested() {
                            span { " Suggested type from detection: " strong { "{type_label(&s)}" } "." }
                        }
                    }
                    h4 { style: "margin-top: 16px;", "Applicable scans" }
                    if scans().is_empty() {
                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
                    } else {
                        for s in scans() {
                            ScanRow { scan: s }
                        }
                    }
                    if let Some(msg) = scan_msg() {
                        div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
                    }
                    div { style: "margin-top: 16px; display: flex; gap: 8px;",
                        button {
                            class: "btn btn-primary",
                            onclick: move |_| {
                                if let Some(id) = created_id() {
                                    scan_msg.set(Some("Scan triggered...".to_string()));
                                    spawn(async move {
                                        match trigger_target_scan(id).await {
                                            Ok(_) => scan_msg.set(Some(
                                                "Scan started — findings will appear as it runs.".to_string(),
                                            )),
                                            Err(e) => scan_msg.set(Some(format!("Failed to start scan: {e}"))),
                                        }
                                    });
                                }
                            },
                            "Run scan"
                        }
                        button {
                            class: "btn btn-secondary",
                            onclick: move |_| {
                                step.set(0);
                                name.set(String::new());
                                target_type.set(String::new());
                                description.set(String::new());
                                artifacts.write().clear();
                                scans.write().clear();
                                suggested.set(None);
                                created_id.set(None);
                                scan_msg.set(None);
                                error.set(None);
                            },
                            "Onboard another"
                        }
                    }
                }
            }
        }
        // ---- Footer navigation ----
        if step_now < 3 {
            div { style: "display: flex; justify-content: space-between; margin-top: 16px;",
                button {
                    class: "btn btn-back",
                    disabled: step_now == 0,
                    onclick: move |_| { if step() > 0 { step.set(step() - 1); } },
                    "Back"
                }
                if step_now < 2 {
                    button {
                        class: "btn btn-primary",
                        disabled: (step_now == 0 && !can_advance_type) || (step_now == 1 && !has_artifacts),
                        onclick: move |_| step.set(step() + 1),
                        "Next"
                    }
                } else {
                    button {
                        class: "btn btn-primary",
                        disabled: creating(),
                        onclick: move |_| {
                            let n = name();
                            let tt = target_type();
                            let desc = description();
                            let arts = artifacts();
                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
                            creating.set(true);
                            error.set(None);
                            spawn(async move {
                                match create_target(n, tt, d, arts).await {
                                    Ok(resp) => {
                                        let id = resp
                                            .data
                                            .get("_id")
                                            .and_then(|o| o.get("$oid"))
                                            .and_then(|s| s.as_str())
                                            .map(String::from);
                                        if let Some(id) = id {
                                            created_id.set(Some(id.clone()));
                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
                                                scans.set(sc.data.scans);
                                            }
                                            if let Ok(det) = detect_target(id).await {
                                                suggested.set(
                                                    det.data
                                                        .get("classification")
                                                        .and_then(|c| c.get("suggested"))
                                                        .and_then(|s| s.as_str())
                                                        .map(String::from),
                                                );
                                            }
                                        }
                                        step.set(3);
                                    }
                                    Err(e) => error.set(Some(e.to_string())),
                                }
                                creating.set(false);
                            });
                        },
                        if creating() { "Creating..." } else { "Create target" }
                    }
                }
            }
        }
    }
 }
@@ -23,20 +23,6 @@ async fn async_sleep_5s() {
 #[component]
 pub fn RepositoriesPage() -> Element {
    let mut page = use_signal(|| 1u64);
    let mut show_add_form = use_signal(|| false);
    let mut name = use_signal(String::new);
    let mut git_url = use_signal(String::new);
    let mut branch = use_signal(|| "main".to_string());
    let mut auth_token = use_signal(String::new);
    let mut auth_username = use_signal(String::new);
    let mut show_auth = use_signal(|| false);
    let mut ssh_public_key = use_signal(String::new);
    let mut show_tracker = use_signal(|| false);
    let mut tracker_type_val = use_signal(String::new);
    let mut tracker_owner_val = use_signal(String::new);
    let mut tracker_repo_val = use_signal(String::new);
    let mut tracker_token_val = use_signal(String::new);
    let mut adding = use_signal(|| false);
    let mut toasts = use_context::<Toasts>();
    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
    let mut edit_repo_id = use_signal(|| Option::<String>::None);
@@ -64,222 +50,7 @@ pub fn RepositoriesPage() -> Element {
    rsx! {
        PageHeader {
            title: "Repositories",
-            description: "Tracked git repositories",
+            description: "Legacy git repositories. Onboard new targets from Targets / Onboard.",
        }
        div { style: "margin-bottom: 16px;",
            button {
                class: "btn btn-primary",
                onclick: move |_| show_add_form.toggle(),
                if show_add_form() { "Cancel" } else { "+ Add Repository" }
            }
        }
        if show_add_form() {
            div { class: "card",
                div { class: "card-header", "Add Repository" }
                div { class: "form-group",
                    label { "Name" }
                    input {
                        r#type: "text",
                        placeholder: "my-project",
                        value: "{name}",
                        oninput: move |e| name.set(e.value()),
                    }
                }
                div { class: "form-group",
                    label { "Git URL" }
                    input {
                        r#type: "text",
                        placeholder: "https://github.com/org/repo.git  or  git@github.com:org/repo.git",
                        value: "{git_url}",
                        oninput: move |e| git_url.set(e.value()),
                    }
                }
                div { class: "form-group",
                    label { "Default Branch" }
                    input {
                        r#type: "text",
                        placeholder: "main",
                        value: "{branch}",
                        oninput: move |e| branch.set(e.value()),
                    }
                }
                // Private repo auth section
                div { style: "margin-top: 8px;",
                    button {
                        class: "btn btn-ghost",
                        style: "font-size: 12px; padding: 4px 8px;",
                        onclick: move |_| {
                            let opening = !show_auth();
                            show_auth.toggle();
                            if opening {
                                // Fetch SSH key every time the section opens
                                ssh_public_key.set(String::new());
                                spawn(async move {
                                    match crate::infrastructure::repositories::fetch_ssh_public_key().await {
                                        Ok(key) => ssh_public_key.set(key),
                                        Err(_) => ssh_public_key.set("(not available)".to_string()),
                                    }
                                });
                            }
                        },
                        if show_auth() { "Hide auth options" } else { "Private repository?" }
                    }
                }
                if show_auth() {
                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
                        // SSH deploy key display
                        div { style: "margin-bottom: 12px;",
                            label { style: "font-size: 12px; color: var(--text-secondary);",
                                "For SSH URLs: add this deploy key (read-only) to your repository"
                            }
                            div {
                                class: "copyable",
                                style: "margin-top: 4px; padding: 8px; background: var(--bg-secondary); border-radius: 4px;",
                                code {
                                    style: "font-size: 11px; word-break: break-all; user-select: all;",
                                    if ssh_public_key().is_empty() {
                                        "Loading..."
                                    } else {
                                        "{ssh_public_key}"
                                    }
                                }
                                if !ssh_public_key().is_empty() {
                                    crate::components::copy_button::CopyButton { value: ssh_public_key(), small: true }
                                }
                            }
                        }
                        // HTTPS auth fields
                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
                            "For HTTPS URLs: provide an access token (PAT) or username/password"
                        }
                        div { class: "form-group",
                            label { "Auth Token / Password" }
                            input {
                                r#type: "password",
                                placeholder: "ghp_xxxx or personal access token",
                                value: "{auth_token}",
                                oninput: move |e| auth_token.set(e.value()),
                            }
                        }
                        div { class: "form-group",
                            label { "Username (optional, defaults to x-access-token)" }
                            input {
                                r#type: "text",
                                placeholder: "x-access-token",
                                value: "{auth_username}",
                                oninput: move |e| auth_username.set(e.value()),
                            }
                        }
                    }
                }
                // Issue tracker config section
                div { style: "margin-top: 8px;",
                    button {
                        class: "btn btn-ghost",
                        style: "font-size: 12px; padding: 4px 8px;",
                        onclick: move |_| show_tracker.toggle(),
                        if show_tracker() { "Hide tracker options" } else { "Issue tracker?" }
                    }
                }
                if show_tracker() {
                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
                            "Configure an issue tracker to auto-create issues from findings"
                        }
                        div { class: "form-group",
                            label { "Tracker Type" }
                            select {
                                value: "{tracker_type_val}",
                                onchange: move |e| tracker_type_val.set(e.value()),
                                option { value: "", "None" }
                                option { value: "github", "GitHub" }
                                option { value: "gitlab", "GitLab" }
                                option { value: "gitea", "Gitea" }
                                option { value: "jira", "Jira" }
                            }
                        }
                        div { class: "form-group",
                            label { "Owner / Namespace" }
                            input {
                                r#type: "text",
                                placeholder: "org-name",
                                value: "{tracker_owner_val}",
                                oninput: move |e| tracker_owner_val.set(e.value()),
                            }
                        }
                        div { class: "form-group",
                            label { "Repository / Project" }
                            input {
                                r#type: "text",
                                placeholder: "repo-name",
                                value: "{tracker_repo_val}",
                                oninput: move |e| tracker_repo_val.set(e.value()),
                            }
                        }
                        div { class: "form-group",
                            label { "Tracker Token (PAT)" }
                            input {
                                r#type: "password",
                                placeholder: "ghp_xxxx / glpat-xxxx",
                                value: "{tracker_token_val}",
                                oninput: move |e| tracker_token_val.set(e.value()),
                            }
                        }
                    }
                }
                button {
                    class: "btn btn-primary",
                    disabled: adding(),
                    onclick: move |_| {
                        let n = name();
                        let u = git_url();
                        let b = branch();
                        let tok = {
                            let v = auth_token();
                            if v.is_empty() { None } else { Some(v) }
                        };
                        let usr = {
                            let v = auth_username();
                            if v.is_empty() { None } else { Some(v) }
                        };
                        let tt = { let v = tracker_type_val(); if v.is_empty() { None } else { Some(v) } };
                        let t_owner = { let v = tracker_owner_val(); if v.is_empty() { None } else { Some(v) } };
                        let t_repo = { let v = tracker_repo_val(); if v.is_empty() { None } else { Some(v) } };
                        let t_tok = { let v = tracker_token_val(); if v.is_empty() { None } else { Some(v) } };
                        adding.set(true);
                        spawn(async move {
                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr, tt, t_owner, t_repo, t_tok).await {
                                Ok(_) => {
                                    toasts.push(ToastType::Success, "Repository added");
                                    repos.restart();
                                }
                                Err(e) => toasts.push(ToastType::Error, e.to_string()),
                            }
                            adding.set(false);
                        });
                        show_add_form.set(false);
                        show_auth.set(false);
                        show_tracker.set(false);
                        name.set(String::new());
                        git_url.set(String::new());
                        auth_token.set(String::new());
                        auth_username.set(String::new());
                        tracker_type_val.set(String::new());
                        tracker_owner_val.set(String::new());
                        tracker_repo_val.set(String::new());
                        tracker_token_val.set(String::new());
                    },
                    if adding() { "Validating..." } else { "Add" }
                }
            }
        }
        // ── Delete confirmation dialog ──
@@ -0,0 +1,339 @@
 //! Targets page — lists onboarded targets (the unified `OnboardedTarget`
 //! records the wizard creates) and lets the user run a scan, inspect the
 //! classification / applicable scans, or delete a target.
 //!
 //! Creation lives in the Onboard wizard (`/onboard`); this page is the
 //! "where is my target, and what did the scan find" surface.
 use dioxus::prelude::*;
 use dioxus_free_icons::icons::bs_icons::*;
 use dioxus_free_icons::Icon;
 use crate::components::page_header::PageHeader;
 use crate::components::toast::{ToastType, Toasts};
 use crate::infrastructure::onboarding::{
    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan,
 };
 /// Prettify a snake_case target-type value into a human label.
 fn pretty_type(v: &str) -> String {
    match v {
        "web_app" => "Web Application".into(),
        "backend_service" => "Backend / API".into(),
        "desktop_app" => "Desktop App".into(),
        "android_app" => "Android App".into(),
        "ios_app" => "iOS App".into(),
        "firmware_bare_metal" => "Firmware — bare metal".into(),
        "firmware_rtos" => "Firmware — RTOS".into(),
        "embedded_linux_yocto" => "Embedded Linux / Yocto".into(),
        "plc_sps" => "PLC / SPS".into(),
        other => other.replace('_', " "),
    }
 }
 fn str_at<'a>(v: &'a serde_json::Value, key: &str) -> &'a str {
    v.get(key).and_then(|x| x.as_str()).unwrap_or("")
 }
 fn target_id(t: &serde_json::Value) -> String {
    t.get("_id")
        .and_then(|o| o.get("$oid"))
        .and_then(|s| s.as_str())
        .unwrap_or_default()
        .to_string()
 }
 /// The applicable-scans matrix for one target, fetched on expand.
 #[component]
 fn TargetScans(id: String) -> Element {
    let scan_id = id.clone();
    let scans = use_resource(move || {
        let id = scan_id.clone();
        async move { fetch_applicable_scans(id).await.ok() }
    });
    let snapshot = scans.read().clone();
    match &snapshot {
        Some(Some(resp)) => {
            let rows = resp.data.scans.clone();
            let pentest = resp.data.pentest_supported;
            rsx! {
                div { style: "margin-top: 8px;",
                    if rows.is_empty() {
                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
                    }
                    for s in rows {
                        {
                            let name = str_at(&s, "scan").to_string();
                            let rationale = str_at(&s, "rationale").to_string();
                            let blocked = s.get("blocked_reason").and_then(|b| b.as_str()).map(String::from);
                            let default_on = s.get("default_on").and_then(|b| b.as_bool()).unwrap_or(false);
                            let badge = if blocked.is_some() {
                                "badge badge-info"
                            } else if default_on {
                                "badge badge-success"
                            } else {
                                "badge"
                            };
                            rsx! {
                                div { style: "display: flex; gap: 8px; align-items: center; padding: 4px 0;",
                                    span { class: "{badge}", "{name}" }
                                    span { style: "opacity: 0.8; font-size: 0.9em;", "{rationale}" }
                                    if let Some(b) = blocked {
                                        span { style: "opacity: 0.6; font-style: italic; font-size: 0.9em;", "— {b}" }
                                    }
                                }
                            }
                        }
                    }
                    if pentest {
                        div { style: "margin-top: 6px; opacity: 0.75; font-size: 0.85em;",
                            "Active pentest is supported for this target type."
                        }
                    }
                }
            }
        }
        Some(None) => rsx! { div { style: "opacity: 0.6;", "Failed to load applicable scans." } },
        None => rsx! { div { style: "opacity: 0.6;", "Loading scans..." } },
    }
 }
 #[component]
 pub fn TargetsPage() -> Element {
    let mut toasts = use_context::<Toasts>();
    let mut scanning_ids = use_signal(Vec::<String>::new);
    let mut expanded_ids = use_signal(Vec::<String>::new);
    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None);
    let mut targets = use_resource(move || async move { fetch_targets().await.ok() });
    rsx! {
        PageHeader {
            title: "Targets",
            description: "Onboarded targets and what their scans found. Add new targets from Onboard.",
        }
        div { style: "margin-bottom: 16px; display: flex; gap: 8px;",
            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
                "+ Onboard a target"
            }
            button {
                class: "btn btn-secondary",
                onclick: move |_| targets.restart(),
                "Refresh"
            }
        }
        // ── Delete confirmation ──
        if let Some((del_id, del_name)) = confirm_delete() {
            div { class: "modal-overlay",
                div { class: "modal-dialog",
                    h3 { "Delete Target" }
                    p { "Delete " strong { "{del_name}" } "?" }
                    p { class: "modal-warning",
                        "This permanently removes the target and its findings, SBOM entries, scan runs, and CVE alerts."
                    }
                    div { class: "modal-actions",
                        button {
                            class: "btn btn-secondary",
                            onclick: move |_| confirm_delete.set(None),
                            "Cancel"
                        }
                        button {
                            class: "btn btn-danger",
                            onclick: move |_| {
                                let id = del_id.clone();
                                let name = del_name.clone();
                                confirm_delete.set(None);
                                spawn(async move {
                                    match delete_target(id).await {
                                        Ok(_) => {
                                            toasts.push(ToastType::Success, format!("{name} deleted"));
                                            targets.restart();
                                        }
                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
                                    }
                                });
                            },
                            "Delete"
                        }
                    }
                }
            }
        }
        {
        let targets_snapshot = targets.read().clone();
        match &targets_snapshot {
            Some(Some(resp)) => {
                let rows = resp.data.clone();
                if rows.is_empty() {
                    rsx! {
                        div { class: "card", style: "padding: 24px; text-align: center;",
                            p { style: "opacity: 0.7;", "No targets yet." }
                            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
                                "Onboard your first target"
                            }
                        }
                    }
                } else {
                    rsx! {
                        div { class: "card",
                            div { class: "table-wrapper",
                                table {
                                    thead {
                                        tr {
                                            th { "Name" }
                                            th { "Type" }
                                            th { "Detected" }
                                            th { "Artifacts" }
                                            th { "Findings" }
                                            th { "Actions" }
                                        }
                                    }
                                    tbody {
                                        for t in rows {
                                            {
                                                let id = target_id(&t);
                                                let name = str_at(&t, "name").to_string();
                                                let ttype = pretty_type(str_at(&t, "target_type"));
                                                let suggested = t
                                                    .get("classification")
                                                    .and_then(|c| c.get("suggested"))
                                                    .and_then(|s| s.as_str())
                                                    .map(pretty_type);
                                                let artifacts = t
                                                    .get("artifacts")
                                                    .and_then(|a| a.as_array())
                                                    .cloned()
                                                    .unwrap_or_default();
                                                let findings = t
                                                    .get("findings_count")
                                                    .and_then(|n| n.as_u64())
                                                    .unwrap_or(0);
                                                let facts = t
                                                    .get("classification")
                                                    .and_then(|c| c.get("facts"))
                                                    .and_then(|f| f.as_array())
                                                    .cloned()
                                                    .unwrap_or_default();
                                                let is_scanning = scanning_ids().contains(&id);
                                                let is_expanded = expanded_ids().contains(&id);
                                                let id_scan = id.clone();
                                                let id_exp = id.clone();
                                                let id_del = id.clone();
                                                let name_del = name.clone();
                                                let artifacts_detail = artifacts.clone();
                                                rsx! {
                                                    tr {
                                                        td { strong { "{name}" } }
                                                        td { "{ttype}" }
                                                        td {
                                                            if let Some(sug) = suggested.clone() {
                                                                span { class: "badge badge-success", "{sug}" }
                                                            } else {
                                                                span { style: "opacity: 0.5;", "—" }
                                                            }
                                                        }
                                                        td { "{artifacts.len()}" }
                                                        td { "{findings}" }
                                                        td { style: "display: flex; gap: 4px;",
                                                            button {
                                                                class: "btn btn-ghost",
                                                                title: "Details",
                                                                onclick: move |_| {
                                                                    let mut ids = expanded_ids();
                                                                    if ids.contains(&id_exp) {
                                                                        ids.retain(|i| i != &id_exp);
                                                                    } else {
                                                                        ids.push(id_exp.clone());
                                                                    }
                                                                    expanded_ids.set(ids);
                                                                },
                                                                Icon { icon: BsInfoCircle, width: 16, height: 16 }
                                                            }
                                                            button {
                                                                class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
                                                                title: "Run scan",
                                                                disabled: is_scanning,
                                                                onclick: move |_| {
                                                                    let id = id_scan.clone();
                                                                    let mut ids = scanning_ids();
                                                                    ids.push(id.clone());
                                                                    scanning_ids.set(ids);
                                                                    spawn(async move {
                                                                        match trigger_target_scan(id.clone()).await {
                                                                            Ok(_) => toasts.push(ToastType::Success, "Scan triggered — findings appear as it runs. Use Refresh."),
                                                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
                                                                        }
                                                                        let mut ids = scanning_ids();
                                                                        ids.retain(|i| i != &id);
                                                                        scanning_ids.set(ids);
                                                                    });
                                                                },
                                                                if is_scanning {
                                                                    span { class: "spinner" }
                                                                } else {
                                                                    Icon { icon: BsPlayCircle, width: 16, height: 16 }
                                                                }
                                                            }
                                                            button {
                                                                class: "btn btn-ghost btn-ghost-danger",
                                                                title: "Delete target",
                                                                onclick: move |_| {
                                                                    confirm_delete.set(Some((id_del.clone(), name_del.clone())));
                                                                },
                                                                Icon { icon: BsTrash, width: 16, height: 16 }
                                                            }
                                                        }
                                                    }
                                                    if is_expanded {
                                                        tr {
                                                            td { colspan: "6",
                                                                div { style: "padding: 12px 8px;",
                                                                    h4 { style: "margin: 0 0 6px;", "Artifacts" }
                                                                    if artifacts_detail.is_empty() {
                                                                        div { style: "opacity: 0.6;", "No artifacts." }
                                                                    }
                                                                    for a in artifacts_detail {
                                                                        div { style: "font-size: 0.9em; padding: 2px 0;",
                                                                            span { style: "opacity: 0.7;", "{str_at(&a, \"kind\")}: " }
                                                                            span { style: "font-family: monospace;", "{str_at(&a, \"source_ref\")}" }
                                                                        }
                                                                    }
                                                                    if !facts.is_empty() {
                                                                        h4 { style: "margin: 12px 0 6px;", "Detected facts" }
                                                                        for f in facts {
                                                                            div { style: "font-size: 0.9em; padding: 2px 0;",
                                                                                span { style: "font-family: monospace;", "{str_at(&f, \"key\")}={str_at(&f, \"value\")}" }
                                                                                span { style: "opacity: 0.5;", " ({str_at(&f, \"source\")})" }
                                                                            }
                                                                        }
                                                                    }
                                                                    h4 { style: "margin: 12px 0 6px;", "Applicable scans" }
                                                                    TargetScans { id: id.clone() }
                                                                }
                                                            }
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
            Some(None) => rsx! {
                div { class: "card", p { "Failed to load targets." } }
            },
            None => rsx! {
                div { class: "loading", "Loading targets..." }
            },
        }
        }
    }
 }
@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2021"
 [dependencies]
-compliance-core = { workspace = true, features = ["mongodb"] }
+compliance-core = { workspace = true, features = ["mongodb", "axum"] }
 rmcp = { version = "0.16", features = ["server", "macros", "transport-io", "transport-streamable-http-server"] }
 tokio = { workspace = true }
 serde = { workspace = true }
@@ -19,3 +19,6 @@ bson = { version = "2", features = ["chrono-0_4"] }
 schemars = "1.0"
 axum = "0.8"
 tower-http = { version = "0.6", features = ["cors"] }
 sha2 = { workspace = true }
 hex = { workspace = true }
 dashmap = { workspace = true }
@@ -0,0 +1,129 @@
 //! Bearer-token authentication for incoming MCP HTTP requests.
 //!
 //! LLM clients (Claude Desktop / Cursor / ChatGPT / etc.) can't run
 //! Keycloak OIDC, so the MCP server uses opaque static tokens minted
 //! per-tenant via the agent's `POST /api/v1/mcp-tokens` endpoint.
 //!
 //! Flow per request:
 //! 1. Extract `Authorization: Bearer <token>`. Missing → 401.
 //! 2. SHA-256 hash the token.
 //! 3. Look up the hash in `<prefix>__admin.mcp_tokens`. Missing or
 //!    revoked → 401.
 //! 4. Fire-and-forget update of `last_used_at` so the dashboard can
 //!    show staleness without blocking the handler.
 //! 5. Stash the tenant_id in [`TENANT_ID`] (a `tokio::task_local`) so
 //!    the MCP tool handlers can read it without modifying rmcp's
 //!    handler signatures.
 //!
 //! The `task_local` is scoped around the inner service call via
 //! [`bearer_auth`], so every handler invoked downstream sees the
 //! tenant_id without us having to thread it through the macro-
 //! generated tool router.
 use axum::body::Body;
 use axum::extract::{Request, State};
 use axum::http::StatusCode;
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
 use mongodb::bson::doc;
 use sha2::{Digest, Sha256};
 use crate::database::DatabasePool;
 tokio::task_local! {
    /// Tenant id resolved from the bearer for this request. Set by
    /// [`bearer_auth`] before the inner service runs; read by the
    /// MCP tool handlers via [`current_tenant_id`].
    pub static TENANT_ID: String;
 }
 /// Mongo collection name in `<prefix>__admin`.
 const COLLECTION: &str = "mcp_tokens";
 /// Returns the tenant_id set by the auth middleware. `None` outside a
 /// request scope (e.g. unit tests that bypass the middleware).
 pub fn current_tenant_id() -> Option<String> {
    TENANT_ID.try_with(|s| s.clone()).ok()
 }
 /// Axum middleware: validate bearer → set [`TENANT_ID`] → call inner.
 pub async fn bearer_auth(
    State(pool): State<DatabasePool>,
    request: Request,
    next: Next,
 ) -> Response {
    let Some(token) = extract_bearer(&request) else {
        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
    };
    if !token.starts_with("mcpt_") {
        return (StatusCode::UNAUTHORIZED, "Invalid token format").into_response();
    }
    let token_hash = sha256_hex(&token);
    let col = pool.admin_db().collection::<TokenLookup>(COLLECTION);
    let found = match col
        .find_one(doc! { "token_hash": &token_hash, "revoked": false })
        .await
    {
        Ok(Some(t)) => t,
        Ok(None) => {
            return (StatusCode::UNAUTHORIZED, "Invalid or revoked token").into_response();
        }
        Err(e) => {
            tracing::error!("MCP token lookup failed: {e}");
            return (StatusCode::INTERNAL_SERVER_ERROR, "Token lookup error").into_response();
        }
    };
    // Fire-and-forget last_used_at update — never block the handler.
    let col2 = pool.admin_db().collection::<TokenLookup>(COLLECTION);
    let hash_for_update = token_hash.clone();
    tokio::spawn(async move {
        let _ = col2
            .update_one(
                doc! { "token_hash": &hash_for_update },
                doc! { "$set": { "last_used_at": mongodb::bson::DateTime::now() } },
            )
            .await;
    });
    let tenant_id = found.tenant_id;
    let inner = next.run(request);
    TENANT_ID.scope(tenant_id, inner).await
 }
 /// Bare-bones projection — we don't need the whole `McpToken` here,
 /// just enough to route and confirm validity.
 #[derive(serde::Deserialize)]
 struct TokenLookup {
    tenant_id: String,
 }
 fn extract_bearer(req: &Request<Body>) -> Option<String> {
    req.headers()
        .get(axum::http::header::AUTHORIZATION)
        .and_then(|v| v.to_str().ok())
        .and_then(|s| s.strip_prefix("Bearer "))
        .map(|s| s.trim().to_string())
        .filter(|s| !s.is_empty())
 }
 fn sha256_hex(s: &str) -> String {
    let mut h = Sha256::new();
    h.update(s.as_bytes());
    hex::encode(h.finalize())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn sha256_known_value() {
        // python -c 'import hashlib; print(hashlib.sha256(b"mcpt_known").hexdigest())'
        assert_eq!(
            sha256_hex("mcpt_known"),
            "27cf6cf678a44244106863c1c031be8e57b84c2b3019d742f755f8e7afa75dfd"
        );
    }
 }
@@ -1,19 +1,127 @@
-use mongodb::{Client, Collection};
+//! Per-tenant Mongo broker for the MCP server.
 //!
 //! Mirror of the agent's `compliance_agent::database::DatabasePool` —
 //! duplicated here rather than lifted into `compliance-core` to keep
 //! this PR focused. If a third consumer ever needs it, lift then.
 //!
 //! Bearer tokens (validated by the auth middleware) carry a tenant_id
 //! and the handler resolves the per-tenant database via
 //! [`DatabasePool::for_tenant_id`]. The admin database
 //! (`<db_prefix>__admin`) holds the cross-tenant `mcp_tokens`
 //! collection that the middleware queries on every request.
 use std::sync::Arc;
 use dashmap::DashMap;
 use mongodb::{bson::doc, Client, Collection};
 use sha2::{Digest, Sha256};
 use compliance_core::models::*;
 /// 63-byte Mongo db-name cap; same invariant as the agent's pool.
 const MAX_DB_NAME_LEN: usize = 63;
 /// 16-byte SHA-256 truncation, hex-encoded → 32 chars.
 const HASH_HEX_LEN: usize = 32;
 const MAX_PREFIX_LEN: usize = MAX_DB_NAME_LEN - 1 - HASH_HEX_LEN;
 #[derive(Clone, Debug)]
 pub struct DatabasePool {
    client: Client,
    db_prefix: String,
    /// Tenants we've handed out a [`Database`] for. The MCP server
    /// doesn't ensure indexes (the agent owns that side of the
    /// schema), so the marker exists only to satisfy the parallel
    /// shape — current code never reads it.
    #[allow(dead_code)]
    seen: Arc<DashMap<String, ()>>,
 }
 #[derive(Debug, thiserror::Error)]
 pub enum DbError {
    #[error("db_prefix '{prefix}' is {len} chars; max is {max} so the hash-fallback DB name fits Mongo's 63-byte cap")]
    PrefixTooLong {
        prefix: String,
        len: usize,
        max: usize,
    },
    #[error(transparent)]
    Mongo(#[from] mongodb::error::Error),
 }
 impl DatabasePool {
    pub async fn connect(uri: &str, db_prefix: &str) -> Result<Self, DbError> {
        if db_prefix.len() > MAX_PREFIX_LEN {
            return Err(DbError::PrefixTooLong {
                prefix: db_prefix.to_string(),
                len: db_prefix.len(),
                max: MAX_PREFIX_LEN,
            });
        }
        let client = Client::with_uri_str(uri).await?;
        client
            .database("admin")
            .run_command(doc! { "ping": 1 })
            .await?;
        tracing::info!(
            "MCP MongoDB cluster reachable; per-tenant pool ready (db prefix '{db_prefix}')"
        );
        Ok(Self {
            client,
            db_prefix: db_prefix.to_string(),
            seen: Arc::new(DashMap::new()),
        })
    }
    /// Read-only handle to the tenant's database. No indexes are
    /// ensured here — the agent owns writes, MCP only reads.
    pub fn for_tenant_id(&self, tenant_id: &str) -> Database {
        let db_name = self.tenant_db_name(tenant_id);
        self.seen.insert(tenant_id.to_string(), ());
        Database::new(self.client.database(&db_name))
    }
    /// Cross-tenant admin DB — holds the `mcp_tokens` collection that
    /// the auth middleware queries to map bearer → tenant_id.
    pub fn admin_db(&self) -> mongodb::Database {
        self.client.database(&format!("{}__admin", self.db_prefix))
    }
    pub fn tenant_db_name(&self, tenant_id: &str) -> String {
        let sanitized = sanitize_tenant_id(tenant_id);
        let natural = format!("{}_{}", self.db_prefix, sanitized);
        if natural.len() <= MAX_DB_NAME_LEN {
            natural
        } else {
            let mut h = Sha256::new();
            h.update(tenant_id.as_bytes());
            let digest = h.finalize();
            let suffix = hex::encode(&digest[..HASH_HEX_LEN / 2]);
            format!("{}_{}", self.db_prefix, suffix)
        }
    }
 }
 fn sanitize_tenant_id(tenant_id: &str) -> String {
    tenant_id
        .chars()
        .map(|c| match c {
            '/' | '\\' | '.' | '"' | '$' | ' ' | '\0' => '_',
            c => c,
        })
        .collect()
 }
 /// Typed accessors for the MCP-readable collections in a tenant DB.
 /// Matches the agent's `Database` shape but only exposes what the MCP
 /// tool handlers actually need.
 #[derive(Clone, Debug)]
 pub struct Database {
    inner: mongodb::Database,
 }
 impl Database {
-    pub async fn connect(uri: &str, db_name: &str) -> Result<Self, mongodb::error::Error> {
+    pub(crate) fn new(inner: mongodb::Database) -> Self {
-        let client = Client::with_uri_str(uri).await?;
+        Self { inner }
        let db = client.database(db_name);
        db.run_command(mongodb::bson::doc! { "ping": 1 }).await?;
        tracing::info!("MCP server connected to MongoDB '{db_name}'");
        Ok(Self { inner: db })
    }
    pub fn findings(&self) -> Collection<Finding> {
@@ -1,10 +1,11 @@
 mod auth;
 mod database;
 mod server;
 mod tools;
 use std::sync::Arc;
-use database::Database;
+use database::DatabasePool;
 use rmcp::transport::{
    streamable_http_server::session::local::LocalSessionManager, StreamableHttpServerConfig,
    StreamableHttpService,
@@ -24,36 +25,60 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mongo_uri =
        std::env::var("MONGODB_URI").unwrap_or_else(|_| "mongodb://localhost:27017".to_string());
-    let db_name =
+    // MONGODB_DATABASE is reused as the per-tenant DB-name prefix —
    // same convention as the agent so `<prefix>__admin.mcp_tokens`
    // and `<prefix>_<tenant_id>` line up across services.
    let db_prefix =
        std::env::var("MONGODB_DATABASE").unwrap_or_else(|_| "compliance_scanner".to_string());
-    let db = Database::connect(&mongo_uri, &db_name).await?;
+    let pool = DatabasePool::connect(&mongo_uri, &db_prefix).await?;
-    // If MCP_PORT is set, run as Streamable HTTP server; otherwise use stdio.
+    // HTTP transport: bind a small axum router with bearer-auth in
    // front of the rmcp service. `/health` stays public for orca's
    // container probe.
    if let Ok(port_str) = std::env::var("MCP_PORT") {
        let port: u16 = port_str.parse()?;
        tracing::info!("Starting MCP server on HTTP port {port}");
-        let db_clone = db.clone();
+        let pool_for_factory = pool.clone();
        let service = StreamableHttpService::new(
-            move || Ok(ComplianceMcpServer::new(db_clone.clone())),
+            move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
            Arc::new(LocalSessionManager::default()),
            StreamableHttpServerConfig::default(),
        );
        let router = axum::Router::new()
            .route("/health", axum::routing::get(|| async { "ok" }))
-            .nest_service("/mcp", service);
+            .nest_service(
                "/mcp",
                axum::Router::new().fallback_service(service).layer(
                    axum::middleware::from_fn_with_state(pool.clone(), auth::bearer_auth),
                ),
            );
        let listener = tokio::net::TcpListener::bind(("0.0.0.0", port)).await?;
        tracing::info!("MCP HTTP server listening on 0.0.0.0:{port}");
        axum::serve(listener, router).await?;
    } else {
        // stdio transport — used when run as a local MCP server next
        // to the LLM client. There's no HTTP layer to do bearer auth,
        // so we synthesize a tenant_id from STDIO_TENANT_ID for local
        // development. NEVER use this in production.
        tracing::info!("Starting MCP server on stdio");
-        let server = ComplianceMcpServer::new(db);
+        let synth_tenant = std::env::var("STDIO_TENANT_ID").unwrap_or_else(|_| "dev".to_string());
        tracing::warn!(
            tenant_id = %synth_tenant,
            "stdio transport — using synthetic tenant id; DO NOT use in production"
        );
        let server = ComplianceMcpServer::new(pool);
        let transport = rmcp::transport::stdio();
        use rmcp::ServiceExt;
-        let handle = server.serve(transport).await?;
+        auth::TENANT_ID
-        handle.waiting().await?;
+            .scope(synth_tenant, async {
                let handle = server.serve(transport).await?;
                handle.waiting().await?;
                Ok::<_, Box<dyn std::error::Error>>(())
            })
            .await?;
    }
    Ok(())
@@ -2,20 +2,37 @@ use rmcp::{
    handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
 };
-use crate::database::Database;
+use crate::auth::current_tenant_id;
 use crate::database::{Database, DatabasePool};
 use crate::tools::{dast, findings, pentest, sbom};
 pub struct ComplianceMcpServer {
-    db: Database,
+    pool: DatabasePool,
    #[allow(dead_code)]
    tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
 }
 impl ComplianceMcpServer {
    /// Resolve the per-tenant `Database` from the bearer-set
    /// `task_local`. Every tool handler calls this; missing context
    /// surfaces as `internal_error` because it means the auth
    /// middleware was misconfigured (handler ran without scope).
    fn tenant_db(&self) -> Result<Database, rmcp::ErrorData> {
        let tenant_id = current_tenant_id().ok_or_else(|| {
            rmcp::ErrorData::internal_error(
                "no tenant context — bearer middleware not in chain".to_string(),
                None,
            )
        })?;
        Ok(self.pool.for_tenant_id(&tenant_id))
    }
 }
 #[tool_router]
 impl ComplianceMcpServer {
-    pub fn new(db: Database) -> Self {
+    pub fn new(pool: DatabasePool) -> Self {
        Self {
-            db,
+            pool,
            tool_router: Self::tool_router(),
        }
    }
@@ -29,7 +46,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<findings::ListFindingsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::list_findings(&self.db, params).await
+        let db = self.tenant_db()?;
        findings::list_findings(&db, params).await
    }
    #[tool(description = "Get a single finding by its ID")]
@@ -37,7 +55,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<findings::GetFindingParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::get_finding(&self.db, params).await
+        let db = self.tenant_db()?;
        findings::get_finding(&db, params).await
    }
    #[tool(description = "Get a summary of findings counts grouped by severity and status")]
@@ -45,7 +64,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<findings::FindingsSummaryParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::findings_summary(&self.db, params).await
+        let db = self.tenant_db()?;
        findings::findings_summary(&db, params).await
    }
    // ── SBOM ──────────────────────────────────────────────
@@ -57,7 +77,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<sbom::ListSbomPackagesParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        sbom::list_sbom_packages(&self.db, params).await
+        let db = self.tenant_db()?;
        sbom::list_sbom_packages(&db, params).await
    }
    #[tool(
@@ -67,7 +88,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<sbom::SbomVulnReportParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        sbom::sbom_vuln_report(&self.db, params).await
+        let db = self.tenant_db()?;
        sbom::sbom_vuln_report(&db, params).await
    }
    // ── DAST ──────────────────────────────────────────────
@@ -79,7 +101,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<dast::ListDastFindingsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        dast::list_dast_findings(&self.db, params).await
+        let db = self.tenant_db()?;
        dast::list_dast_findings(&db, params).await
    }
    #[tool(description = "Get a summary of recent DAST scan runs and finding counts")]
@@ -87,7 +110,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<dast::DastScanSummaryParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        dast::dast_scan_summary(&self.db, params).await
+        let db = self.tenant_db()?;
        dast::dast_scan_summary(&db, params).await
    }
    // ── Pentest ─────────────────────────────────────────────
@@ -99,7 +123,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::ListPentestSessionsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::list_pentest_sessions(&self.db, params).await
+        let db = self.tenant_db()?;
        pentest::list_pentest_sessions(&db, params).await
    }
    #[tool(description = "Get a single AI pentest session by its ID")]
@@ -107,7 +132,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::GetPentestSessionParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::get_pentest_session(&self.db, params).await
+        let db = self.tenant_db()?;
        pentest::get_pentest_session(&db, params).await
    }
    #[tool(
@@ -117,7 +143,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::GetAttackChainParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::get_attack_chain(&self.db, params).await
+        let db = self.tenant_db()?;
        pentest::get_attack_chain(&db, params).await
    }
    #[tool(description = "Get chat messages from a pentest session")]
@@ -125,7 +152,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::GetPentestMessagesParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::get_pentest_messages(&self.db, params).await
+        let db = self.tenant_db()?;
        pentest::get_pentest_messages(&db, params).await
    }
    #[tool(
@@ -135,7 +163,8 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::PentestStatsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::pentest_stats(&self.db, params).await
+        let db = self.tenant_db()?;
        pentest::pentest_stats(&db, params).await
    }
 }
@@ -149,7 +178,7 @@ impl ServerHandler for ComplianceMcpServer {
                .build(),
            server_info: Implementation::from_build_env(),
            instructions: Some(
-                "Compliance Scanner MCP server. Query security findings, SBOM data, DAST results, and AI pentest sessions."
+                "Compliance Scanner MCP server. Query security findings, SBOM data, DAST results, and AI pentest sessions for your tenant."
                    .to_string(),
            ),
        }
Author	SHA1	Message	Date
Sharang ParnerkarandClaude Opus 4.8	a799a9890a	fix(onboarding): targets visibility + unified pipeline by default CI / Check (pull_request) Successful in 5m52s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details CI / Deploy MCP (pull_request) Has been skipped Details The onboarding wizard created OnboardedTargets that were invisible in the dashboard, and triggering a scan failed with "Repository <id> not found": `/targets/{id}/scan` went through `run_scan`, which consulted the global `unified_pipeline` flag and fell to the legacy repository pipeline (reads `repositories`, not `onboarded_targets`). Agent - Add `ComplianceAgent::run_target_scan`, always dispatching to the unified `run_target` pipeline. The target-scan endpoint operates on `onboarded_targets` by construction, so it must not depend on the transition flag. `trigger_target_scan` now calls it. - Default `UNIFIED_PIPELINE` to on (no legacy `repositories` data in prod); set `UNIFIED_PIPELINE=0` to opt back to the legacy pipeline. - Scheduler now scans `onboarded_targets` (via `run_target_scan`) instead of the legacy `repositories` collection. Dashboard - New Targets page (`/targets`): lists onboarded targets with detected type, artifacts, findings count, applicable-scans matrix (on expand), plus Run scan and Delete. Sidebar "Repositories" nav becomes "Targets". - Remove the "Add Repository" form from the Repositories page — onboarding is the single entry point (private-repo auth + issue tracker move into the onboarding flow, revisable on the target). - Add `delete_target` server fn. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 09:11:37 +02:00
Sharang ParnerkarandClaude Fable 5	9919afa0ee	feat(onboarding): scan-trigger endpoint + wizard Run-Scan button CI / Check (pull_request) Successful in 5m40s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details CI / Deploy MCP (pull_request) Has been skipped Details Complete the onboard -> scan -> results loop in-UI: - POST /api/v1/targets/{id}/scan (404s unknown targets) spawns run_scan, which dispatches to the unified pipeline under UNIFIED_PIPELINE. - Wizard Done step gains a "Run scan" button (server fn trigger_target_scan) with inline status, so a user can onboard and kick off a scan without curl. Passes fmt + clippy -D warnings (agent, dashboard server + web). Closes #126, #127. Refs #131, #133, #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-13 00:13:26 +02:00
sharang	9ec07ff7a1	fix(ci): authenticate tramiton fetch in dashboard + mcp image builds (#147 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Has been skipped Details CI / Deploy MCP (push) Successful in 1m47s Details CI / Deploy Dashboard (push) Successful in 2m37s Details CI / Deploy Docs (push) Has been skipped Details	2026-07-12 21:52:38 +00:00
sharang	0e57c2d7a7	feat(pipeline): run tramiton classification + provision DAST in run_target (#146 ) CI / Deploy Agent (push) Successful in 3m40s Details CI / Deploy Dashboard (push) Has been skipped Details CI / Deploy Docs (push) Has been skipped Details CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy MCP (push) Has been skipped Details	2026-07-12 21:49:22 +00:00
sharang	c6a02f0ac3	feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#145 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Successful in 3m47s Details CI / Deploy Dashboard (push) Failing after 4m28s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Failing after 5s Details	2026-07-12 21:31:21 +00:00
sharang	17f788858d	feat(dashboard): onboarding wizard UI (#144 ) CI / Detect Changes (push) Successful in 3s Details CI / Check (push) Has been skipped Details CI / Deploy Docs (push) Has been cancelled Details CI / Deploy MCP (push) Has been cancelled Details CI / Deploy Dashboard (push) Has been cancelled Details CI / Deploy Agent (push) Has been skipped Details	2026-07-12 21:28:52 +00:00
sharangandSharang Parnerkar	c6b5622113	fix(ci): authenticate tramiton-core fetch in the agent image build (main deploys) (#143 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 5s Details CI / Deploy Agent (push) Successful in 7m46s Details CI / Deploy Dashboard (push) Has been skipped Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Has been skipped Details The PR `check` job authenticates the private tramiton-core git fetch, but the main-branch `deploy-agent` job builds `Dockerfile.agent` where cargo also fetches tramiton-core — inside the image build, with no credentials — so agent image builds on main fail. Fix: inject the PAT as a BuildKit secret (never baked into an image layer). - `Dockerfile.agent`: `RUN --mount=type=secret,id=tramiton_token …` applies the same `https`-insteadOf rewrite + `CARGO_NET_GIT_FETCH_WITH_CLI=true` before `cargo build`. - `deploy-agent`: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN …`, reusing the existing `TRAMITON_FETCH_TOKEN` secret. Only the agent image depends on tramiton-core (dashboard/mcp/docs unaffected). Self-tests on merge — changing `Dockerfile.agent` makes `detect-changes` run `deploy-agent`. Note: couldn't fully run the image build locally (no PAT value on hand + no `.dockerignore` so the context is large), but this mirrors the working PR-stage auth and uses standard BuildKit secret injection. Assumes the deploy runner's Docker daemon supports BuildKit (docker:27-cli → yes). --------- Co-authored-by: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Reviewed-on: #143	2026-07-12 20:25:39 +00:00
sharang	a204f0c59c	feat(api): onboarding endpoints for unified targets (#142 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Failing after 5s Details CI / Deploy Dashboard (push) Has been skipped Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Has been skipped Details	2026-07-12 20:15:22 +00:00
sharang	cf4afdda1b	feat(migrate): onboarding backfill (repositories + dast_targets -> onboarded_targets) (#141 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Failing after 5s Details CI / Deploy Dashboard (push) Has been skipped Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Has been skipped Details	2026-07-12 20:11:16 +00:00
sharang	a074efd0b4	ci: Kellnr crates.io mirror + persistent S3-backed sccache (#140 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Has been skipped Details CI / Deploy Dashboard (push) Has been skipped Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Has been skipped Details	2026-07-10 16:30:51 +00:00
sharang	ef6ee3dcd1	feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Failing after 5s Details CI / Deploy Dashboard (push) Failing after 5s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Failing after 4s Details	2026-07-10 16:00:51 +00:00
sharang	675c4ef699	feat(onboarding): unified multi-target model + scan matrix foundation (#134 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 5s Details CI / Deploy Agent (push) Successful in 7m36s Details CI / Deploy Dashboard (push) Successful in 7m9s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Successful in 1m44s Details	2026-07-10 13:41:25 +00:00
sharang	aed551231c	feat(dashboard): UI for managing MCP tokens (#94 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 4s Details CI / Deploy Agent (push) Has been skipped Details CI / Deploy Dashboard (push) Successful in 3m3s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Has been skipped Details Adds /mcp-tokens page so a logged-in user can mint, list, and revoke bearer tokens for the MCP server without curl. Pairs with #92's tenant-scoped MCP middleware — copy a token from the dashboard straight into an LLM client config.	2026-06-30 16:32:54 +00:00
sharang	b851f4267a	feat(m7.3): scheduler pulls tenants from registry, env as fallback (#96 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Dashboard (push) Has been cancelled Details CI / Deploy Docs (push) Has been cancelled Details CI / Deploy MCP (push) Has been cancelled Details CI / Deploy Agent (push) Has been cancelled Details Replaces M7.2-C static SCHEDULER_TENANT_IDS with a live query to the tenant-registry at every tick. New tenants picked up without an agent restart; env stays as fallback so a registry outage never silences the scheduler. Resolution order: registry -> SCHEDULER_TENANT_IDS env -> DEFAULT_SCHEDULER_TENANT_ID. Logs the active source on startup.	2026-06-30 16:32:35 +00:00
sharang	e9536b6d98	fix(audit): bump quinn-proto + ignore rmcp DNS-rebinding advisory (#97 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 3s Details CI / Deploy Agent (push) Successful in 3m55s Details CI / Deploy Dashboard (push) Successful in 2m44s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Successful in 1m50s Details RUSTSEC-2026-0185 (quinn-proto 0.11.14): patch-bump to 0.11.15. RUSTSEC-2026-0189 (rmcp 0.16 DNS rebinding): added to ignore with public-hostname + bearer-auth threat-model justification; rmcp 0.16->2.x migration tracked as a separate multi-hour PR.	2026-06-30 16:07:01 +00:00
sharang	a3a96fe2cc	feat(m7.3): MCP tenant-scoped bearer tokens (#92 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 5s Details CI / Deploy Agent (push) Successful in 8m13s Details CI / Deploy Dashboard (push) Successful in 7m3s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Successful in 1m50s Details MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.	2026-06-30 15:27:21 +00:00
sharang	ac24ca766a	feat(m7.3): cross-tenant admin HTTP endpoints (#95 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 4s Details CI / Deploy Dashboard (push) Has been cancelled Details CI / Deploy Docs (push) Has been cancelled Details CI / Deploy MCP (push) Has been cancelled Details CI / Deploy Agent (push) Has been cancelled Details GET /api/admin/tenants lists tenant DBs; DELETE /api/admin/tenants/{tenant_id} drops them (GDPR). Behind a separate auth path that rejects customer realm tokens.	2026-06-30 15:23:39 +00:00
sharang	485c3ff45e	chore(agent): remove stale unscoped webhook routes from API router (#93 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 4s Details CI / Deploy Dashboard (push) Has been cancelled Details CI / Deploy Docs (push) Has been cancelled Details CI / Deploy MCP (push) Has been cancelled Details CI / Deploy Agent (push) Has been cancelled Details Webhook routes live on the separate webhook server (port 3002). M7.2-C URL form is /webhook/{tenant_id}/{platform}/{repo_id}; mounting unscoped variants on the API router would mismatch handler signatures.	2026-06-30 15:18:31 +00:00
sharang	69c4f7bb78	feat(dashboard): proactively refresh expired Keycloak tokens (#91 ) CI / Check (push) Has been skipped Details CI / Detect Changes (push) Successful in 8s Details CI / Deploy Agent (push) Has been skipped Details CI / Deploy Dashboard (push) Successful in 2m55s Details CI / Deploy Docs (push) Has been skipped Details CI / Deploy MCP (push) Has been skipped Details	2026-06-17 20:01:37 +00:00