Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sharang ParnerkarandClaude Opus 4.8
|
51aae6665a | ||
|
Sharang ParnerkarandClaude Opus 4.8
|
0e5a2d7e43 |
@@ -109,8 +109,6 @@ jobs:
|
||||
run: cargo clippy -p compliance-mcp -- -D warnings
|
||||
- name: Clippy (werkbank-exec)
|
||||
run: cargo clippy -p werkbank-exec -- -D warnings
|
||||
- name: Clippy (control-map)
|
||||
run: cargo clippy -p control-map -- -D warnings
|
||||
|
||||
# Security audit
|
||||
- name: Security Audit
|
||||
@@ -119,8 +117,8 @@ jobs:
|
||||
RUSTC_WRAPPER: ""
|
||||
|
||||
# Tests (reuses compilation artifacts from clippy)
|
||||
- name: Tests (core + agent + werkbank-exec + control-map)
|
||||
run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
|
||||
- name: Tests (core + agent + werkbank-exec)
|
||||
run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib
|
||||
- name: Tests (dashboard server)
|
||||
run: cargo test -p compliance-dashboard --features server --no-default-features
|
||||
- name: Tests (dashboard web)
|
||||
|
||||
Generated
-17
@@ -666,7 +666,6 @@ dependencies = [
|
||||
"compliance-core",
|
||||
"compliance-dast",
|
||||
"compliance-graph",
|
||||
"control-map",
|
||||
"dashmap",
|
||||
"dotenvy",
|
||||
"futures-core",
|
||||
@@ -969,15 +968,6 @@ dependencies = [
|
||||
"charset",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "control-map"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.18",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "convert_case"
|
||||
version = "0.8.0"
|
||||
@@ -5099,12 +5089,6 @@ dependencies = [
|
||||
"digest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "sha1_smol"
|
||||
version = "1.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
|
||||
|
||||
[[package]]
|
||||
name = "sha2"
|
||||
version = "0.10.9"
|
||||
@@ -6488,7 +6472,6 @@ dependencies = [
|
||||
"getrandom 0.4.1",
|
||||
"js-sys",
|
||||
"serde_core",
|
||||
"sha1_smol",
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
|
||||
+1
-3
@@ -8,7 +8,6 @@ members = [
|
||||
"compliance-mcp",
|
||||
"compliance-smoke",
|
||||
"werkbank-exec",
|
||||
"control-map",
|
||||
]
|
||||
resolver = "2"
|
||||
|
||||
@@ -18,7 +17,6 @@ expect_used = "deny"
|
||||
|
||||
[workspace.dependencies]
|
||||
compliance-core = { path = "compliance-core", default-features = false }
|
||||
control-map = { path = "control-map" }
|
||||
serde = { version = "1", features = ["derive"] }
|
||||
serde_json = "1"
|
||||
tokio = { version = "1", features = ["full"] }
|
||||
@@ -30,7 +28,7 @@ reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "co
|
||||
thiserror = "2"
|
||||
sha2 = "0.10"
|
||||
hex = "0.4"
|
||||
uuid = { version = "1", features = ["v4", "v5", "serde"] }
|
||||
uuid = { version = "1", features = ["v4", "serde"] }
|
||||
secrecy = { version = "0.10", features = ["serde"] }
|
||||
regex = "1"
|
||||
zip = { version = "2", features = ["aes-crypto", "deflate"] }
|
||||
|
||||
@@ -8,7 +8,6 @@ workspace = true
|
||||
|
||||
[dependencies]
|
||||
compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
|
||||
control-map = { workspace = true }
|
||||
compliance-graph = { path = "../compliance-graph" }
|
||||
compliance-dast = { path = "../compliance-dast" }
|
||||
# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also
|
||||
|
||||
@@ -10,7 +10,6 @@ pub mod issues;
|
||||
pub mod mcp_tokens;
|
||||
pub mod notifications;
|
||||
pub mod onboarding;
|
||||
pub mod oscal;
|
||||
pub mod pentest_handlers;
|
||||
pub use pentest_handlers as pentest;
|
||||
pub mod sbom;
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
//! OSCAL assessment endpoint.
|
||||
//!
|
||||
//! Returns a standard OSCAL assessment-results document for a target's findings,
|
||||
//! driven by each finding's stamped `control_refs` (from the scan's control-triage
|
||||
//! stage): mapped findings target their controls, unmapped findings are reported
|
||||
//! as-is. See `compliance_core::models::oscal_assessment`.
|
||||
|
||||
use axum::extract::Extension;
|
||||
use axum::http::StatusCode;
|
||||
use axum::response::{IntoResponse, Response};
|
||||
use axum::Json;
|
||||
use mongodb::bson::doc;
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::models::oscal_assessment::assess;
|
||||
use compliance_core::models::Finding;
|
||||
use compliance_core::tenant_ctx::TenantCtx;
|
||||
|
||||
use super::dto::{collect_cursor_async, tenant_db, AgentExt};
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
pub struct AssessRequest {
|
||||
/// The target / repo id whose findings are assessed.
|
||||
pub target_id: String,
|
||||
}
|
||||
|
||||
/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
|
||||
pub async fn assess_target(
|
||||
Extension(agent): AgentExt,
|
||||
tenant: TenantCtx,
|
||||
Json(req): Json<AssessRequest>,
|
||||
) -> Response {
|
||||
let db = match tenant_db(&agent, &tenant).await {
|
||||
Ok(db) => db,
|
||||
Err(code) => return code.into_response(),
|
||||
};
|
||||
|
||||
let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
|
||||
{
|
||||
Ok(cursor) => collect_cursor_async(cursor).await,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
|
||||
return StatusCode::INTERNAL_SERVER_ERROR.into_response();
|
||||
}
|
||||
};
|
||||
|
||||
Json(assess(&findings, chrono::Utc::now())).into_response()
|
||||
}
|
||||
@@ -6,7 +6,6 @@ use crate::api::handlers;
|
||||
pub fn build_router() -> Router {
|
||||
Router::new()
|
||||
.route("/api/v1/health", get(handlers::health))
|
||||
.route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
|
||||
.route("/api/v1/stats/overview", get(handlers::stats_overview))
|
||||
.route(
|
||||
"/api/v1/settings/ssh-public-key",
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
|
||||
use compliance_core::config::PlcRuntimeConfig;
|
||||
use compliance_core::AgentConfig;
|
||||
use secrecy::SecretString;
|
||||
|
||||
@@ -66,7 +66,6 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
|
||||
tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
|
||||
plc_runtime: load_plc_runtime_config(),
|
||||
werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
|
||||
breakpilot: load_breakpilot_config(),
|
||||
})
|
||||
}
|
||||
|
||||
@@ -91,14 +90,3 @@ fn load_plc_runtime_config() -> PlcRuntimeConfig {
|
||||
.unwrap_or(d.openplc_password),
|
||||
}
|
||||
}
|
||||
|
||||
/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
|
||||
/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
|
||||
fn load_breakpilot_config() -> BreakpilotConfig {
|
||||
let d = BreakpilotConfig::default();
|
||||
BreakpilotConfig {
|
||||
base_url: env_var_opt("BREAKPILOT_BASE_URL"),
|
||||
token: env_secret_opt("BREAKPILOT_TOKEN"),
|
||||
snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,114 +0,0 @@
|
||||
//! The grounded control checker: judge each candidate region for a control, then
|
||||
//! keep only the verdicts that survive the grounding gate.
|
||||
//!
|
||||
//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
|
||||
//! the whole recognize → ground path is then exercised without an LLM. With the
|
||||
//! real judge, determinism comes from temperature 0 plus the gate.
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
|
||||
pub struct GroundedControlChecker<J> {
|
||||
judge: J,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> GroundedControlChecker<J> {
|
||||
pub fn new(judge: J) -> Self {
|
||||
Self { judge }
|
||||
}
|
||||
|
||||
/// Judge every candidate region for `spec` and return the grounded findings.
|
||||
/// A verdict that doesn't quote real code in its region is dropped by
|
||||
/// [`ground`], so nothing fabricated reaches the caller.
|
||||
pub async fn check(
|
||||
&self,
|
||||
spec: &ControlCheckSpec,
|
||||
regions: &[CandidateRegion],
|
||||
repo_id: &str,
|
||||
) -> Vec<Finding> {
|
||||
let mut findings = Vec::new();
|
||||
for region in regions {
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
if let Some(finding) = ground(spec, region, &verdict, repo_id) {
|
||||
findings.push(finding);
|
||||
}
|
||||
}
|
||||
findings
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::LlmVerdict;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
/// Deterministic stub: returns a fixed verdict for every region, so the
|
||||
/// recognize → ground composition is tested without an LLM.
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "No default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
fn region(content: &str) -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: content.into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn keeps_grounded_and_drops_ungrounded() {
|
||||
let checker = GroundedControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
});
|
||||
let regions = vec![
|
||||
region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
|
||||
region("totally unrelated code\n"), // snippet absent → dropped
|
||||
];
|
||||
let findings = checker.check(&spec(), ®ions, "repo").await;
|
||||
assert_eq!(findings.len(), 1);
|
||||
assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
|
||||
assert_eq!(findings[0].line_number, Some(2));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn non_violation_yields_nothing() {
|
||||
let checker = GroundedControlChecker::new(StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.0,
|
||||
},
|
||||
});
|
||||
let findings = checker
|
||||
.check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
|
||||
.await;
|
||||
assert!(findings.is_empty());
|
||||
}
|
||||
}
|
||||
@@ -1,167 +0,0 @@
|
||||
//! The "recognize" stage: judge whether a code region violates a control.
|
||||
//!
|
||||
//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
|
||||
//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
|
||||
//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
|
||||
//! and everything it returns is then re-checked by the grounding gate
|
||||
//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
|
||||
//! smart; it is never trusted.
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
|
||||
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// Prompt/logic version — part of the verdict cache key, bump on any change here.
|
||||
pub const PROMPT_VERSION: &str = "control-judge-v1";
|
||||
|
||||
const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
|
||||
You are given ONE compliance control (a requirement) and ONE code region. Decide \
|
||||
ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
|
||||
shown — never assume code that is not present. (2) If and only if it violates, copy \
|
||||
the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
|
||||
region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
|
||||
violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
|
||||
Respond with STRICT JSON only, no prose: \
|
||||
{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
|
||||
|
||||
/// Judges one (control, region). Async-in-trait so a stub can drive tests.
|
||||
#[allow(async_fn_in_trait)]
|
||||
pub trait ControlJudge: Send + Sync {
|
||||
async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
|
||||
}
|
||||
|
||||
/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
|
||||
pub struct LlmControlJudge {
|
||||
llm: Arc<LlmClient>,
|
||||
}
|
||||
|
||||
impl LlmControlJudge {
|
||||
pub fn new(llm: Arc<LlmClient>) -> Self {
|
||||
Self { llm }
|
||||
}
|
||||
}
|
||||
|
||||
impl ControlJudge for LlmControlJudge {
|
||||
async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
|
||||
let user = build_user_prompt(spec, region);
|
||||
match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
|
||||
Ok(response) => parse_verdict(&response),
|
||||
Err(e) => {
|
||||
// Fail closed: a transient model error yields no finding, never a
|
||||
// fabricated one.
|
||||
tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
|
||||
no_violation()
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
|
||||
format!(
|
||||
"CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
|
||||
id = spec.control_id,
|
||||
title = spec.title,
|
||||
req = spec.requirement,
|
||||
file = region.file,
|
||||
line = region.start_line,
|
||||
code = region.content,
|
||||
)
|
||||
}
|
||||
|
||||
#[derive(Debug, Default, Deserialize)]
|
||||
struct RawVerdict {
|
||||
#[serde(default)]
|
||||
violates: bool,
|
||||
#[serde(default)]
|
||||
snippet: String,
|
||||
#[serde(default)]
|
||||
cwe: Option<String>,
|
||||
#[serde(default)]
|
||||
confidence: f64,
|
||||
}
|
||||
|
||||
/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
|
||||
/// degrades to a non-violation (never a fabricated finding).
|
||||
fn parse_verdict(response: &str) -> LlmVerdict {
|
||||
let cleaned = response
|
||||
.trim()
|
||||
.trim_start_matches("```json")
|
||||
.trim_start_matches("```")
|
||||
.trim_end_matches("```")
|
||||
.trim();
|
||||
match serde_json::from_str::<RawVerdict>(cleaned) {
|
||||
Ok(raw) => LlmVerdict {
|
||||
violates: raw.violates,
|
||||
snippet: raw.snippet,
|
||||
cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
|
||||
confidence: raw.confidence,
|
||||
},
|
||||
Err(e) => {
|
||||
tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
|
||||
no_violation()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn no_violation() -> LlmVerdict {
|
||||
LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.0,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::models::finding::Severity;
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "Products must not ship default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_plain_and_fenced_json() {
|
||||
let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
|
||||
let v = parse_verdict(plain);
|
||||
assert!(v.violates);
|
||||
assert_eq!(v.snippet, "PASSWORD = \"x\"");
|
||||
assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
|
||||
|
||||
let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
|
||||
assert!(!parse_verdict(fenced).violates);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn garbage_and_empty_cwe_are_safe() {
|
||||
assert!(!parse_verdict("not json at all").violates); // fail closed
|
||||
let no_cwe =
|
||||
parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": " ", "confidence": 0.5}"#);
|
||||
assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn user_prompt_carries_control_and_code() {
|
||||
let region = CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 10,
|
||||
content: "PASSWORD = \"admin\"".into(),
|
||||
};
|
||||
let p = build_user_prompt(&spec(), ®ion);
|
||||
assert!(p.contains("cra-ai-8"));
|
||||
assert!(p.contains("Products must not ship default credentials"));
|
||||
assert!(p.contains("PASSWORD = \"admin\""));
|
||||
assert!(p.contains("src/auth.py"));
|
||||
}
|
||||
}
|
||||
@@ -5,14 +5,6 @@
|
||||
//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
|
||||
//! and snapshots it locally.
|
||||
|
||||
mod checker;
|
||||
mod judge;
|
||||
mod oscal_provider;
|
||||
mod scan_triage;
|
||||
mod triage;
|
||||
|
||||
pub use checker::GroundedControlChecker;
|
||||
pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
|
||||
pub use oscal_provider::OscalControlsProvider;
|
||||
pub use scan_triage::triage_repo_findings;
|
||||
pub use triage::{ControlTriage, TriageOutcome};
|
||||
|
||||
@@ -1,139 +0,0 @@
|
||||
//! Scan-pipeline integration for control triage.
|
||||
//!
|
||||
//! After the deterministic tools have produced findings, this stamps each finding
|
||||
//! with the compliance control(s) it's evidence for and marks control-level false
|
||||
//! positives — using the ingested OSCAL catalog for control text, the
|
||||
//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
|
||||
//! confirm. Skipped entirely unless breakpilot is configured.
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::path::Path;
|
||||
use std::sync::Arc;
|
||||
|
||||
use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::finding::{Finding, FindingStatus, Severity};
|
||||
use compliance_core::models::onboarding::ComplianceFramework;
|
||||
use compliance_core::AgentConfig;
|
||||
use control_map::ControlMap;
|
||||
|
||||
use super::{ControlTriage, LlmControlJudge, OscalControlsProvider, TriageOutcome};
|
||||
use crate::llm::LlmClient;
|
||||
|
||||
/// Lines of context to read on each side of a finding's line.
|
||||
const REGION_WINDOW: usize = 6;
|
||||
|
||||
/// Triage every finding in `findings` against the CRA control map: stamp
|
||||
/// `control_refs` on confirmed findings and flag control false positives. Returns
|
||||
/// the number of findings tagged with at least one control.
|
||||
pub async fn triage_repo_findings(
|
||||
config: &AgentConfig,
|
||||
llm: Arc<LlmClient>,
|
||||
repo_path: &Path,
|
||||
findings: &mut [Finding],
|
||||
) -> usize {
|
||||
let Some(base_url) = config.breakpilot.base_url.clone() else {
|
||||
return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
|
||||
};
|
||||
let provider = OscalControlsProvider::new(
|
||||
reqwest::Client::new(),
|
||||
base_url,
|
||||
config.breakpilot.token.clone(),
|
||||
&config.breakpilot.snapshot_dir,
|
||||
);
|
||||
let specs = build_specs(&provider).await;
|
||||
if specs.is_empty() {
|
||||
return 0;
|
||||
}
|
||||
let map = match ControlMap::cra() {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %e, "control map failed to load; skipping control triage");
|
||||
return 0;
|
||||
}
|
||||
};
|
||||
let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
|
||||
|
||||
let mut tagged = 0;
|
||||
for finding in findings.iter_mut() {
|
||||
let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
|
||||
continue;
|
||||
};
|
||||
let Some(region) = fetch_region(repo_path, &file, line) else {
|
||||
continue;
|
||||
};
|
||||
match triage.triage(finding, ®ion).await {
|
||||
TriageOutcome::Confirmed(controls) => {
|
||||
finding.control_refs = controls;
|
||||
tagged += 1;
|
||||
}
|
||||
TriageOutcome::FalsePositive => {
|
||||
finding.status = FindingStatus::FalsePositive;
|
||||
finding.triage_action = Some("control_false_positive".to_string());
|
||||
}
|
||||
TriageOutcome::Unmapped => {}
|
||||
}
|
||||
}
|
||||
tagged
|
||||
}
|
||||
|
||||
/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
|
||||
async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
|
||||
let mut specs = HashMap::new();
|
||||
match provider.load(ComplianceFramework::Cra).await {
|
||||
Ok(doc) => {
|
||||
for control in doc.to_controls() {
|
||||
specs.insert(
|
||||
control.id.clone(),
|
||||
ControlCheckSpec {
|
||||
control_id: control.id,
|
||||
title: control.title,
|
||||
requirement: control.text,
|
||||
default_cwe: None,
|
||||
severity: Severity::Medium,
|
||||
},
|
||||
);
|
||||
}
|
||||
}
|
||||
Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
|
||||
}
|
||||
specs
|
||||
}
|
||||
|
||||
/// Read a window of lines around `line` (1-based) from `repo_path/file`.
|
||||
fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
|
||||
let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
|
||||
let lines: Vec<&str> = content.lines().collect();
|
||||
if lines.is_empty() {
|
||||
return None;
|
||||
}
|
||||
let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
|
||||
let start = center.saturating_sub(REGION_WINDOW);
|
||||
let end = (center + REGION_WINDOW + 1).min(lines.len());
|
||||
Some(CandidateRegion {
|
||||
file: file.to_string(),
|
||||
start_line: (start as u32) + 1,
|
||||
content: lines[start..end].join("\n"),
|
||||
})
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn fetch_region_windows_around_the_line() {
|
||||
let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
|
||||
std::fs::create_dir_all(&dir).unwrap();
|
||||
let file = "a.py";
|
||||
std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
|
||||
let r = fetch_region(&dir, file, 4).unwrap();
|
||||
assert!(r.content.contains("SECRET=1"));
|
||||
assert_eq!(r.start_line, 1); // window clamps to file start
|
||||
let _ = std::fs::remove_dir_all(&dir);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fetch_region_missing_file_is_none() {
|
||||
assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
|
||||
}
|
||||
}
|
||||
@@ -1,184 +0,0 @@
|
||||
//! Triage step: confirm/refute a deterministic tool finding against the controls
|
||||
//! it maps to (via the `control-map` LUT), grounding the judgment.
|
||||
//!
|
||||
//! This is where the LLM finally enters — as a **false-positive filter over tool
|
||||
//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
|
||||
//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
|
||||
//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
|
||||
//! judge then confirms or refutes each, and only judgments anchored to real code
|
||||
//! survive.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
|
||||
use compliance_core::models::Finding;
|
||||
use control_map::ControlMap;
|
||||
|
||||
use super::judge::ControlJudge;
|
||||
|
||||
/// What triage decided for one tool finding.
|
||||
#[derive(Debug, Clone, PartialEq, Eq)]
|
||||
pub enum TriageOutcome {
|
||||
/// The finding maps to no control in the LUT — keep it, untagged.
|
||||
Unmapped,
|
||||
/// Maps to controls and the grounded judge confirmed at least one — keep the
|
||||
/// finding and tag it with these control ids.
|
||||
Confirmed(Vec<String>),
|
||||
/// Maps to controls but the judge grounded none — treat as a false positive.
|
||||
FalsePositive,
|
||||
}
|
||||
|
||||
/// Triages tool findings against the control map, confirming with a grounded judge.
|
||||
pub struct ControlTriage<J> {
|
||||
judge: J,
|
||||
map: ControlMap,
|
||||
/// Control requirement specs (by control id), built from the ingested catalog.
|
||||
specs: HashMap<String, ControlCheckSpec>,
|
||||
}
|
||||
|
||||
impl<J: ControlJudge> ControlTriage<J> {
|
||||
pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
|
||||
Self { judge, map, specs }
|
||||
}
|
||||
|
||||
/// Triage one tool finding. `region` is the code around the finding, used as
|
||||
/// the grounding evidence for the judge.
|
||||
pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
|
||||
let Some(cwe) = finding.cwe.as_deref() else {
|
||||
return TriageOutcome::Unmapped;
|
||||
};
|
||||
let mapped = self.map.controls_for(&finding.scanner, cwe);
|
||||
if mapped.is_empty() {
|
||||
return TriageOutcome::Unmapped;
|
||||
}
|
||||
|
||||
let mut confirmed = Vec::new();
|
||||
for entry in mapped {
|
||||
let Some(spec) = self.specs.get(&entry.control) else {
|
||||
continue;
|
||||
};
|
||||
let verdict = self.judge.judge(spec, region).await;
|
||||
// The verdict only counts if it grounds to real code in the region.
|
||||
if ground(spec, region, &verdict, &finding.repo_id).is_some() {
|
||||
confirmed.push(entry.control.clone());
|
||||
}
|
||||
}
|
||||
|
||||
if confirmed.is_empty() {
|
||||
TriageOutcome::FalsePositive
|
||||
} else {
|
||||
TriageOutcome::Confirmed(confirmed)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use compliance_core::control_check::LlmVerdict;
|
||||
use compliance_core::models::finding::Severity;
|
||||
use compliance_core::models::scan::ScanType;
|
||||
|
||||
struct StubJudge {
|
||||
verdict: LlmVerdict,
|
||||
}
|
||||
impl ControlJudge for StubJudge {
|
||||
async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
|
||||
self.verdict.clone()
|
||||
}
|
||||
}
|
||||
|
||||
fn specs() -> HashMap<String, ControlCheckSpec> {
|
||||
let mut m = HashMap::new();
|
||||
m.insert(
|
||||
"cra-ai-8".to_string(),
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "No default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
},
|
||||
);
|
||||
m
|
||||
}
|
||||
|
||||
fn semgrep_finding(cwe: &str) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
"fp1".into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"hardcoded credential".into(),
|
||||
"desc".into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.cwe = Some(cwe.into());
|
||||
f
|
||||
}
|
||||
|
||||
fn region() -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 1,
|
||||
content: "PASSWORD = \"admin123\"\n".into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn confirmed_finding_is_tagged_with_control() {
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage.triage(&semgrep_finding("CWE-798"), ®ion()).await;
|
||||
assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn refuted_mapped_finding_is_false_positive() {
|
||||
// Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: false,
|
||||
snippet: String::new(),
|
||||
cwe: None,
|
||||
confidence: 0.1,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage.triage(&semgrep_finding("CWE-798"), ®ion()).await;
|
||||
assert_eq!(out, TriageOutcome::FalsePositive);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn unmapped_cwe_is_left_untagged() {
|
||||
let triage = ControlTriage::new(
|
||||
StubJudge {
|
||||
verdict: LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
},
|
||||
},
|
||||
ControlMap::cra().unwrap(),
|
||||
specs(),
|
||||
);
|
||||
let out = triage
|
||||
.triage(&semgrep_finding("CWE-99999"), ®ion())
|
||||
.await;
|
||||
assert_eq!(out, TriageOutcome::Unmapped);
|
||||
}
|
||||
}
|
||||
@@ -344,7 +344,6 @@ mod tests {
|
||||
tenant_registry_url: None,
|
||||
plc_runtime: compliance_core::PlcRuntimeConfig::default(),
|
||||
werkbank_runner_token: None,
|
||||
breakpilot: compliance_core::config::BreakpilotConfig::default(),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -215,21 +215,6 @@ impl PipelineOrchestrator {
|
||||
.await;
|
||||
tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
|
||||
|
||||
// Stage 5b: control triage — stamp findings with the compliance control(s)
|
||||
// they're evidence for and flag control false positives (grounded LLM over
|
||||
// deterministic tool output). No-op unless breakpilot is configured.
|
||||
self.update_phase(scan_run_id, "control_triage").await;
|
||||
let tagged = crate::controls::triage_repo_findings(
|
||||
&self.config,
|
||||
self.llm.clone(),
|
||||
&repo_path,
|
||||
&mut all_findings,
|
||||
)
|
||||
.await;
|
||||
if tagged > 0 {
|
||||
tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
|
||||
}
|
||||
|
||||
// Dedup against existing findings and insert new ones
|
||||
let mut new_count = 0u32;
|
||||
let mut new_findings: Vec<Finding> = Vec::new();
|
||||
|
||||
@@ -82,7 +82,10 @@ impl Scanner for SemgrepScanner {
|
||||
finding.file_path = Some(r.path);
|
||||
finding.line_number = Some(r.start.line);
|
||||
finding.code_snippet = Some(r.extra.lines);
|
||||
finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
|
||||
finding.cwe = r
|
||||
.extra
|
||||
.metadata
|
||||
.and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
|
||||
finding
|
||||
})
|
||||
.collect();
|
||||
@@ -121,34 +124,10 @@ struct SemgrepExtra {
|
||||
metadata: Option<serde_json::Value>,
|
||||
}
|
||||
|
||||
/// semgrep emits `metadata.cwe` as a list of strings like
|
||||
/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
|
||||
/// the first entry and normalise it to just the `CWE-NNN` id.
|
||||
fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
|
||||
let raw = metadata.get("cwe")?;
|
||||
let text = match raw {
|
||||
serde_json::Value::Array(items) => items.first()?.as_str()?,
|
||||
serde_json::Value::String(s) => s.as_str(),
|
||||
_ => return None,
|
||||
};
|
||||
let id = text.split(':').next().unwrap_or(text).trim();
|
||||
(!id.is_empty()).then(|| id.to_string())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn extract_cwe_handles_list_and_normalises() {
|
||||
let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
|
||||
assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
|
||||
let bare = serde_json::json!({"cwe": "CWE-89"});
|
||||
assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
|
||||
let none = serde_json::json!({"severity": "ERROR"});
|
||||
assert_eq!(extract_cwe(&none), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn deserialize_semgrep_output() {
|
||||
let json = r#"{
|
||||
|
||||
@@ -60,7 +60,6 @@ pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
|
||||
tenant_registry_url: None,
|
||||
plc_runtime: compliance_core::PlcRuntimeConfig::default(),
|
||||
werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
|
||||
breakpilot: compliance_core::config::BreakpilotConfig::default(),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -58,33 +58,6 @@ pub struct AgentConfig {
|
||||
/// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
|
||||
/// `None`, those endpoints are not mounted at all.
|
||||
pub werkbank_runner_token: Option<SecretString>,
|
||||
/// Source for the OSCAL control catalog pulled from breakpilot-compliance
|
||||
/// (drives the [`crate::traits::ControlsProvider`]). Disabled when
|
||||
/// `base_url` is `None`.
|
||||
pub breakpilot: BreakpilotConfig,
|
||||
}
|
||||
|
||||
/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
|
||||
/// to snapshot it for deterministic / offline reuse.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct BreakpilotConfig {
|
||||
/// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
|
||||
/// the OSCAL controls provider.
|
||||
pub base_url: Option<String>,
|
||||
/// Optional bearer token for the catalog endpoint.
|
||||
pub token: Option<SecretString>,
|
||||
/// Directory for catalog snapshots.
|
||||
pub snapshot_dir: String,
|
||||
}
|
||||
|
||||
impl Default for BreakpilotConfig {
|
||||
fn default() -> Self {
|
||||
Self {
|
||||
base_url: None,
|
||||
token: None,
|
||||
snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
|
||||
|
||||
@@ -1,204 +0,0 @@
|
||||
//! Grounded control-driven checking.
|
||||
//!
|
||||
//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
|
||||
//! whose output is grounded to real code — so a hallucinated finding cannot
|
||||
//! survive. Determinism is structural, not a prompt plea:
|
||||
//!
|
||||
//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
|
||||
//! code it never saw;
|
||||
//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
|
||||
//! in the region, and the line is recomputed from that match — the model's own
|
||||
//! line number is never trusted ([`ground`]);
|
||||
//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
|
||||
//!
|
||||
//! The LLM supplies cross-language / cross-stack pattern recognition; this module
|
||||
//! supplies the determinism.
|
||||
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
use crate::models::finding::{Finding, Severity};
|
||||
use crate::models::scan::ScanType;
|
||||
|
||||
/// A control rendered as a check the LLM judges code against.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct ControlCheckSpec {
|
||||
/// Stable control id, e.g. `"cra-ai-8"`.
|
||||
pub control_id: String,
|
||||
/// Short control title (used in the finding title).
|
||||
pub title: String,
|
||||
/// The requirement text the LLM judges against (control objective/statement).
|
||||
pub requirement: String,
|
||||
/// CWE to fall back to when the model doesn't supply one.
|
||||
pub default_cwe: Option<String>,
|
||||
/// Severity for findings raised from this control.
|
||||
pub severity: Severity,
|
||||
}
|
||||
|
||||
/// A retrieved code region the LLM judges — never the whole repo.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct CandidateRegion {
|
||||
/// Repo-relative path.
|
||||
pub file: String,
|
||||
/// 1-based line number of the region's first line in `file`.
|
||||
pub start_line: u32,
|
||||
/// The region's source text.
|
||||
pub content: String,
|
||||
}
|
||||
|
||||
/// The LLM's structured verdict for one (control, region). `snippet` is the
|
||||
/// verbatim code the model claims proves the violation — it is the anchor the
|
||||
/// grounding gate checks.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct LlmVerdict {
|
||||
pub violates: bool,
|
||||
pub snippet: String,
|
||||
pub cwe: Option<String>,
|
||||
pub confidence: f64,
|
||||
}
|
||||
|
||||
/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
|
||||
/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
|
||||
/// finding's line is computed from the match, so a fabricated or mis-located
|
||||
/// snippet is dropped. Pure — no LLM, no I/O.
|
||||
pub fn ground(
|
||||
spec: &ControlCheckSpec,
|
||||
region: &CandidateRegion,
|
||||
verdict: &LlmVerdict,
|
||||
repo_id: &str,
|
||||
) -> Option<Finding> {
|
||||
if !verdict.violates {
|
||||
return None;
|
||||
}
|
||||
let snippet = verdict.snippet.trim();
|
||||
if snippet.is_empty() {
|
||||
return None;
|
||||
}
|
||||
// Grounding: the quoted snippet must literally exist in the retrieved region.
|
||||
let pos = region.content.find(snippet)?;
|
||||
// Recompute the real line from the match — never trust the model's number.
|
||||
let newlines_before = region.content[..pos].matches('\n').count();
|
||||
let line = region.start_line + newlines_before as u32;
|
||||
|
||||
let mut finding = Finding::new(
|
||||
repo_id.to_string(),
|
||||
control_finding_fingerprint(&spec.control_id, ®ion.file, snippet),
|
||||
"control-check".to_string(),
|
||||
ScanType::CodeReview,
|
||||
format!("{}: {}", spec.control_id, spec.title),
|
||||
format!(
|
||||
"Control {} appears violated ({}) at {}:{line}",
|
||||
spec.control_id, spec.requirement, region.file
|
||||
),
|
||||
spec.severity.clone(),
|
||||
);
|
||||
finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
|
||||
finding.file_path = Some(region.file.clone());
|
||||
finding.line_number = Some(line);
|
||||
finding.code_snippet = Some(snippet.to_string());
|
||||
finding.confidence = Some(verdict.confidence);
|
||||
// Carry the control reference on the finding.
|
||||
finding.control_refs = vec![spec.control_id.clone()];
|
||||
Some(finding)
|
||||
}
|
||||
|
||||
/// Deterministic cache key for a (control, region, model, prompt-version) verdict
|
||||
/// so identical inputs reproduce the same verdict without another LLM call.
|
||||
pub fn cache_key(
|
||||
control_id: &str,
|
||||
region_content: &str,
|
||||
model: &str,
|
||||
prompt_version: &str,
|
||||
) -> String {
|
||||
hash_parts(&[control_id, region_content, model, prompt_version])
|
||||
}
|
||||
|
||||
fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
|
||||
hash_parts(&[control_id, file, snippet])
|
||||
}
|
||||
|
||||
fn hash_parts(parts: &[&str]) -> String {
|
||||
let mut hasher = Sha256::new();
|
||||
for part in parts {
|
||||
hasher.update(part.as_bytes());
|
||||
hasher.update([0u8]); // domain separator between parts
|
||||
}
|
||||
hex::encode(hasher.finalize())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn spec() -> ControlCheckSpec {
|
||||
ControlCheckSpec {
|
||||
control_id: "cra-ai-8".into(),
|
||||
title: "No default passwords".into(),
|
||||
requirement: "Products must not ship default credentials".into(),
|
||||
default_cwe: Some("CWE-798".into()),
|
||||
severity: Severity::High,
|
||||
}
|
||||
}
|
||||
|
||||
fn region() -> CandidateRegion {
|
||||
CandidateRegion {
|
||||
file: "src/auth.py".into(),
|
||||
start_line: 10,
|
||||
content: "def login():\n PASSWORD = \"admin123\"\n return PASSWORD\n".into(),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn grounds_real_snippet_with_recomputed_line() {
|
||||
let v = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
let f = ground(&spec(), ®ion(), &v, "repo").expect("should ground");
|
||||
assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
|
||||
assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
|
||||
assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
|
||||
assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
|
||||
assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn drops_fabricated_snippet_not_in_region() {
|
||||
let v = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: "SECRET = \"totally-made-up\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.99,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &v, "repo").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn drops_non_violation_and_empty_snippet() {
|
||||
let no = LlmVerdict {
|
||||
violates: false,
|
||||
snippet: "PASSWORD = \"admin123\"".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &no, "repo").is_none());
|
||||
let empty = LlmVerdict {
|
||||
violates: true,
|
||||
snippet: " ".into(),
|
||||
cwe: None,
|
||||
confidence: 0.9,
|
||||
};
|
||||
assert!(ground(&spec(), ®ion(), &empty, "repo").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn cache_key_and_fingerprint_are_deterministic() {
|
||||
assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
|
||||
assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
|
||||
assert_eq!(
|
||||
control_finding_fingerprint("c", "f", "s"),
|
||||
control_finding_fingerprint("c", "f", "s")
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -1,5 +1,4 @@
|
||||
pub mod config;
|
||||
pub mod control_check;
|
||||
pub mod db;
|
||||
pub mod error;
|
||||
pub mod models;
|
||||
|
||||
@@ -76,10 +76,6 @@ pub struct Finding {
|
||||
pub triage_rationale: Option<String>,
|
||||
/// Developer feedback on finding quality
|
||||
pub developer_feedback: Option<String>,
|
||||
/// Compliance control ids this finding is evidence for (stamped by control
|
||||
/// triage against the `control-map` LUT). Empty when unmapped.
|
||||
#[serde(default)]
|
||||
pub control_refs: Vec<String>,
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
pub created_at: DateTime<Utc>,
|
||||
#[serde(with = "super::serde_helpers::bson_datetime")]
|
||||
@@ -122,7 +118,6 @@ impl Finding {
|
||||
triage_action: None,
|
||||
triage_rationale: None,
|
||||
developer_feedback: None,
|
||||
control_refs: Vec::new(),
|
||||
created_at: now,
|
||||
updated_at: now,
|
||||
}
|
||||
|
||||
@@ -11,7 +11,6 @@ pub mod mcp_token;
|
||||
pub mod notification;
|
||||
pub mod onboarding;
|
||||
pub mod oscal;
|
||||
pub mod oscal_assessment;
|
||||
pub mod pentest;
|
||||
pub mod repository;
|
||||
pub mod sbom;
|
||||
@@ -42,7 +41,6 @@ pub use onboarding::{
|
||||
TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
|
||||
};
|
||||
pub use oscal::OscalDocument;
|
||||
pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
|
||||
pub use pentest::{
|
||||
AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
|
||||
PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
|
||||
|
||||
@@ -1,424 +0,0 @@
|
||||
//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
|
||||
//!
|
||||
//! The catalog (domain content) comes from the producer; the **assessment** is
|
||||
//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
|
||||
//! standard OSCAL assessment-results document: an observation per linked finding,
|
||||
//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
|
||||
//! records the full catalog set we considered.
|
||||
//!
|
||||
//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
|
||||
//! timestamp. Pure — no DB, no network.
|
||||
|
||||
use std::collections::HashMap;
|
||||
|
||||
use chrono::{DateTime, Utc};
|
||||
use serde::Serialize;
|
||||
use uuid::Uuid;
|
||||
|
||||
use crate::models::finding::{Finding, FindingStatus};
|
||||
|
||||
const OSCAL_VERSION: &str = "1.1.2";
|
||||
/// Same namespace as the catalog exporter, so ids are stable and correlatable.
|
||||
const NAMESPACE: Uuid = Uuid::from_bytes([
|
||||
0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
|
||||
]);
|
||||
|
||||
fn det_uuid(name: &str) -> String {
|
||||
Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
|
||||
}
|
||||
|
||||
/// Links findings to the catalog control-ids they provide evidence for.
|
||||
pub struct ControlLinker {
|
||||
cwe_to_controls: HashMap<u32, Vec<String>>,
|
||||
}
|
||||
|
||||
impl ControlLinker {
|
||||
/// Build a linker from an explicit CWE → control-id map.
|
||||
pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
|
||||
Self { cwe_to_controls }
|
||||
}
|
||||
|
||||
/// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
|
||||
/// `_CWE_TO_REQ`; extend as scanner coverage grows).
|
||||
pub fn cra_seed() -> Self {
|
||||
let pairs: &[(u32, &str)] = &[
|
||||
(798, "cra-ai-8"),
|
||||
(259, "cra-ai-8"),
|
||||
(1392, "cra-ai-8"),
|
||||
(327, "cra-ai-13"),
|
||||
(326, "cra-ai-13"),
|
||||
(319, "cra-ai-15"),
|
||||
(311, "cra-ai-15"),
|
||||
(89, "cra-ai-20"),
|
||||
(79, "cra-ai-20"),
|
||||
(78, "cra-ai-20"),
|
||||
(22, "cra-ai-20"),
|
||||
];
|
||||
let mut map: HashMap<u32, Vec<String>> = HashMap::new();
|
||||
for (cwe, id) in pairs {
|
||||
map.entry(*cwe).or_default().push((*id).to_string());
|
||||
}
|
||||
Self::new(map)
|
||||
}
|
||||
|
||||
/// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
|
||||
fn parse_cwe(raw: &str) -> Option<u32> {
|
||||
raw.trim_start_matches(|c: char| !c.is_ascii_digit())
|
||||
.split(|c: char| !c.is_ascii_digit())
|
||||
.next()
|
||||
.filter(|s| !s.is_empty())
|
||||
.and_then(|s| s.parse().ok())
|
||||
}
|
||||
|
||||
/// The control-ids a finding provides evidence for (via its CWE).
|
||||
pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
|
||||
finding
|
||||
.cwe
|
||||
.as_deref()
|
||||
.and_then(Self::parse_cwe)
|
||||
.and_then(|cwe| self.cwe_to_controls.get(&cwe))
|
||||
.cloned()
|
||||
.unwrap_or_default()
|
||||
}
|
||||
}
|
||||
|
||||
/// Build a standard OSCAL assessment-results document from `findings`, using each
|
||||
/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
|
||||
/// finding is emitted as an observation — mapped findings additionally produce a
|
||||
/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
|
||||
/// (an observation carrying their CWE/tool/severity, with no control target) so
|
||||
/// nothing is lost. `at` is the assessment timestamp.
|
||||
pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
|
||||
let ts = at.to_rfc3339();
|
||||
|
||||
let mut observations = Vec::new();
|
||||
let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
|
||||
let mut mapped = 0usize;
|
||||
let mut unmapped = 0usize;
|
||||
|
||||
for finding in findings {
|
||||
if finding.status == FindingStatus::FalsePositive {
|
||||
continue; // flagged tool false positive — excluded from the report
|
||||
}
|
||||
let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
|
||||
let location = match (&finding.file_path, finding.line_number) {
|
||||
(Some(f), Some(l)) => Some(format!("{f}:{l}")),
|
||||
(Some(f), None) => Some(f.clone()),
|
||||
_ => None,
|
||||
};
|
||||
let is_mapped = !finding.control_refs.is_empty();
|
||||
if is_mapped {
|
||||
mapped += 1;
|
||||
} else {
|
||||
unmapped += 1;
|
||||
}
|
||||
let mut props = vec![
|
||||
ObsProp::new("tool", &finding.scanner),
|
||||
ObsProp::new("severity", &finding.severity.to_string()),
|
||||
ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
|
||||
];
|
||||
if let Some(cwe) = &finding.cwe {
|
||||
props.push(ObsProp::new("cwe", cwe));
|
||||
}
|
||||
observations.push(Observation {
|
||||
uuid: obs_uuid.clone(),
|
||||
title: finding.title.clone(),
|
||||
description: finding.description.clone(),
|
||||
methods: vec!["TEST".to_string()],
|
||||
collected: ts.clone(),
|
||||
props,
|
||||
relevant_evidence: vec![RelevantEvidence {
|
||||
href: location.map(|l| format!("file://{l}")),
|
||||
description: format!("[{}] {}", finding.scanner, finding.title),
|
||||
}],
|
||||
});
|
||||
for control_id in &finding.control_refs {
|
||||
obs_by_control
|
||||
.entry(control_id.clone())
|
||||
.or_default()
|
||||
.push(obs_uuid.clone());
|
||||
}
|
||||
}
|
||||
|
||||
let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
|
||||
hit_controls.sort();
|
||||
let ar_findings: Vec<ArFinding> = hit_controls
|
||||
.iter()
|
||||
.map(|control_id| ArFinding {
|
||||
uuid: det_uuid(&format!("finding:{control_id}")),
|
||||
title: format!("Findings affect {control_id}"),
|
||||
target: FindingTarget {
|
||||
target_type: "statement-id".to_string(),
|
||||
target_id: format!("{control_id}_smt"),
|
||||
status: TargetStatus {
|
||||
state: "not-satisfied".to_string(),
|
||||
},
|
||||
},
|
||||
related_observations: obs_by_control[*control_id]
|
||||
.iter()
|
||||
.map(|u| RelatedObservation {
|
||||
observation_uuid: u.clone(),
|
||||
})
|
||||
.collect(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
let include_controls: Vec<SelectControlById> = hit_controls
|
||||
.iter()
|
||||
.map(|c| SelectControlById {
|
||||
control_id: (*c).clone(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
let result = ArResult {
|
||||
uuid: det_uuid("result:cra"),
|
||||
title: "Automated code-compliance assessment".to_string(),
|
||||
description: format!(
|
||||
"{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
|
||||
observations.len(),
|
||||
include_controls.len()
|
||||
),
|
||||
start: ts.clone(),
|
||||
reviewed_controls: ReviewedControls {
|
||||
control_selections: vec![ControlSelection { include_controls }],
|
||||
},
|
||||
observations,
|
||||
findings: ar_findings,
|
||||
};
|
||||
|
||||
AssessmentResultsDoc {
|
||||
assessment_results: AssessmentResults {
|
||||
uuid: det_uuid("assessment-results:cra"),
|
||||
metadata: ArMetadata {
|
||||
title: "Compliance scanner — OSCAL assessment results".to_string(),
|
||||
last_modified: ts,
|
||||
version: "1.0.0".to_string(),
|
||||
oscal_version: OSCAL_VERSION.to_string(),
|
||||
},
|
||||
import_ap: ImportAp {
|
||||
href: "#cra-annex-i".to_string(),
|
||||
},
|
||||
results: vec![result],
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// ── OSCAL assessment-results document (serialise) ────────────────────────────
|
||||
|
||||
/// The root OSCAL assessment-results document.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct AssessmentResultsDoc {
|
||||
#[serde(rename = "assessment-results")]
|
||||
pub assessment_results: AssessmentResults,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct AssessmentResults {
|
||||
pub uuid: String,
|
||||
pub metadata: ArMetadata,
|
||||
#[serde(rename = "import-ap")]
|
||||
pub import_ap: ImportAp,
|
||||
pub results: Vec<ArResult>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArMetadata {
|
||||
pub title: String,
|
||||
#[serde(rename = "last-modified")]
|
||||
pub last_modified: String,
|
||||
pub version: String,
|
||||
#[serde(rename = "oscal-version")]
|
||||
pub oscal_version: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ImportAp {
|
||||
pub href: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArResult {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub description: String,
|
||||
pub start: String,
|
||||
#[serde(rename = "reviewed-controls")]
|
||||
pub reviewed_controls: ReviewedControls,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub observations: Vec<Observation>,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub findings: Vec<ArFinding>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ReviewedControls {
|
||||
#[serde(rename = "control-selections")]
|
||||
pub control_selections: Vec<ControlSelection>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ControlSelection {
|
||||
#[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
|
||||
pub include_controls: Vec<SelectControlById>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct SelectControlById {
|
||||
#[serde(rename = "control-id")]
|
||||
pub control_id: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct Observation {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub description: String,
|
||||
pub methods: Vec<String>,
|
||||
pub collected: String,
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub props: Vec<ObsProp>,
|
||||
#[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
|
||||
pub relevant_evidence: Vec<RelevantEvidence>,
|
||||
}
|
||||
|
||||
/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
|
||||
/// unmapped finding be reported fully as-is.
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ObsProp {
|
||||
pub name: String,
|
||||
pub value: String,
|
||||
}
|
||||
|
||||
impl ObsProp {
|
||||
fn new(name: &str, value: &str) -> Self {
|
||||
Self {
|
||||
name: name.to_string(),
|
||||
value: value.to_string(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct RelevantEvidence {
|
||||
#[serde(skip_serializing_if = "Option::is_none")]
|
||||
pub href: Option<String>,
|
||||
pub description: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct ArFinding {
|
||||
pub uuid: String,
|
||||
pub title: String,
|
||||
pub target: FindingTarget,
|
||||
#[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
|
||||
pub related_observations: Vec<RelatedObservation>,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct FindingTarget {
|
||||
#[serde(rename = "type")]
|
||||
pub target_type: String,
|
||||
#[serde(rename = "target-id")]
|
||||
pub target_id: String,
|
||||
pub status: TargetStatus,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct TargetStatus {
|
||||
pub state: String,
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Serialize)]
|
||||
pub struct RelatedObservation {
|
||||
#[serde(rename = "observation-uuid")]
|
||||
pub observation_uuid: String,
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
#[allow(clippy::unwrap_used)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::models::finding::Severity;
|
||||
use crate::models::scan::ScanType;
|
||||
|
||||
fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
|
||||
let mut f = Finding::new(
|
||||
"repo".into(),
|
||||
fp.into(),
|
||||
"semgrep".into(),
|
||||
ScanType::Sast,
|
||||
"hardcoded credential".into(),
|
||||
"desc".into(),
|
||||
Severity::High,
|
||||
);
|
||||
f.cwe = cwe.map(Into::into);
|
||||
f.file_path = Some("src/auth.rs".into());
|
||||
f.line_number = Some(42);
|
||||
f.control_refs = refs.iter().map(|s| s.to_string()).collect();
|
||||
f
|
||||
}
|
||||
|
||||
fn at() -> DateTime<Utc> {
|
||||
DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
|
||||
.unwrap()
|
||||
.with_timezone(&Utc)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mapped_finding_becomes_control_finding() {
|
||||
let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
|
||||
let r = &doc.assessment_results.results[0];
|
||||
assert_eq!(r.observations.len(), 1);
|
||||
assert_eq!(r.findings.len(), 1);
|
||||
assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
|
||||
assert_eq!(r.findings[0].target.status.state, "not-satisfied");
|
||||
assert_eq!(
|
||||
r.reviewed_controls.control_selections[0]
|
||||
.include_controls
|
||||
.len(),
|
||||
1
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn unmapped_finding_is_reported_as_is() {
|
||||
let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
|
||||
let r = &doc.assessment_results.results[0];
|
||||
assert_eq!(r.observations.len(), 1); // still emitted...
|
||||
assert!(r.findings.is_empty()); // ...but no control finding
|
||||
assert!(r.reviewed_controls.control_selections[0]
|
||||
.include_controls
|
||||
.is_empty());
|
||||
let props: Vec<(&str, &str)> = r.observations[0]
|
||||
.props
|
||||
.iter()
|
||||
.map(|p| (p.name.as_str(), p.value.as_str()))
|
||||
.collect();
|
||||
assert!(props.contains(&("mapping", "unmapped")));
|
||||
assert!(props.contains(&("cwe", "CWE-319")));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn false_positive_is_excluded() {
|
||||
let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
|
||||
f.status = FindingStatus::FalsePositive;
|
||||
let doc = assess(&[f], at());
|
||||
assert!(doc.assessment_results.results[0].observations.is_empty());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn deterministic_and_valid_oscal() {
|
||||
let mk = || {
|
||||
vec![
|
||||
finding("f1", Some("CWE-798"), &["cra-ai-8"]),
|
||||
finding("f2", Some("CWE-319"), &[]),
|
||||
]
|
||||
};
|
||||
let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
|
||||
let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
|
||||
assert_eq!(a, b);
|
||||
assert!(a.contains("\"oscal-version\":\"1.1.2\""));
|
||||
assert!(a.contains("\"not-satisfied\""));
|
||||
assert!(a.contains("\"mapping\""));
|
||||
}
|
||||
}
|
||||
@@ -4,7 +4,7 @@ use rmcp::{
|
||||
|
||||
use crate::auth::current_tenant_id;
|
||||
use crate::database::{Database, DatabasePool};
|
||||
use crate::tools::{dast, findings, oscal, pentest, sbom};
|
||||
use crate::tools::{dast, findings, pentest, sbom};
|
||||
|
||||
pub struct ComplianceMcpServer {
|
||||
pool: DatabasePool,
|
||||
@@ -68,17 +68,6 @@ impl ComplianceMcpServer {
|
||||
findings::findings_summary(&db, params).await
|
||||
}
|
||||
|
||||
#[tool(
|
||||
description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
|
||||
)]
|
||||
async fn oscal_assessment(
|
||||
&self,
|
||||
Parameters(params): Parameters<oscal::OscalAssessmentParams>,
|
||||
) -> Result<CallToolResult, rmcp::ErrorData> {
|
||||
let db = self.tenant_db()?;
|
||||
oscal::oscal_assessment(&db, params).await
|
||||
}
|
||||
|
||||
// ── SBOM ──────────────────────────────────────────────
|
||||
|
||||
#[tool(
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
pub mod dast;
|
||||
pub mod findings;
|
||||
pub mod oscal;
|
||||
pub mod pentest;
|
||||
pub mod sbom;
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
//! OSCAL assessment MCP tool.
|
||||
//!
|
||||
//! Emits a standard OSCAL assessment-results document for a repo's findings —
|
||||
//! what breakpilot's scanner MCP client pulls. Mapped findings target their
|
||||
//! compliance controls (via the stamped `control_refs`); unmapped findings are
|
||||
//! reported as-is, so nothing is lost.
|
||||
|
||||
use mongodb::bson::doc;
|
||||
use rmcp::{model::*, ErrorData as McpError};
|
||||
use schemars::JsonSchema;
|
||||
use serde::Deserialize;
|
||||
|
||||
use compliance_core::models::oscal_assessment::assess;
|
||||
use compliance_core::models::Finding;
|
||||
|
||||
use crate::database::Database;
|
||||
|
||||
#[derive(Debug, Deserialize, JsonSchema)]
|
||||
pub struct OscalAssessmentParams {
|
||||
/// Repository / target id to assess.
|
||||
pub repo_id: String,
|
||||
}
|
||||
|
||||
pub async fn oscal_assessment(
|
||||
db: &Database,
|
||||
params: OscalAssessmentParams,
|
||||
) -> Result<CallToolResult, McpError> {
|
||||
let mut cursor = db
|
||||
.findings()
|
||||
.find(doc! { "repo_id": ¶ms.repo_id })
|
||||
.await
|
||||
.map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
|
||||
|
||||
let mut findings: Vec<Finding> = Vec::new();
|
||||
while cursor
|
||||
.advance()
|
||||
.await
|
||||
.map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
|
||||
{
|
||||
findings.push(
|
||||
cursor
|
||||
.deserialize_current()
|
||||
.map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
|
||||
);
|
||||
}
|
||||
|
||||
let document = assess(&findings, chrono::Utc::now());
|
||||
let json = serde_json::to_string_pretty(&document)
|
||||
.map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
|
||||
Ok(CallToolResult::success(vec![Content::text(json)]))
|
||||
}
|
||||
@@ -1,12 +0,0 @@
|
||||
[package]
|
||||
name = "control-map"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
serde = { workspace = true }
|
||||
serde_json = { workspace = true }
|
||||
thiserror = { workspace = true }
|
||||
@@ -1,399 +0,0 @@
|
||||
{
|
||||
"version": "1.0",
|
||||
"framework": "cra",
|
||||
"controls": [
|
||||
{
|
||||
"control": "cra-ai-1",
|
||||
"title": "Secure-by-Default-Konfiguration",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-2",
|
||||
"title": "Minimale Angriffsflaeche",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-3",
|
||||
"title": "Sichere Systemarchitektur",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-4",
|
||||
"title": "Least-Privilege-Prinzip",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-5",
|
||||
"title": "Manipulationsschutz",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-6",
|
||||
"title": "Integritaetspruefung",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-7",
|
||||
"title": "Starke Authentifizierung",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-8",
|
||||
"title": "Keine Default-Passwoerter",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-259"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-9",
|
||||
"title": "Sicheres Credential-Management",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-522"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-10",
|
||||
"title": "Sitzungsmanagement",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-11",
|
||||
"title": "Brute-Force-Schutz",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-12",
|
||||
"title": "Rollenbasierte Autorisierung",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-13",
|
||||
"title": "Verschluesselung sensibler Daten",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-327",
|
||||
"CWE-326"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-14",
|
||||
"title": "Speicher-Schutz (Data at Rest)",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-15",
|
||||
"title": "Transport-Schutz (Data in Transit)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-319",
|
||||
"CWE-311"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-16",
|
||||
"title": "Sicheres Schluesselmanagement",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "gitleaks",
|
||||
"scan_type": "secret_detection",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-798",
|
||||
"CWE-321"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-17",
|
||||
"title": "Datenminimierung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-18",
|
||||
"title": "Strukturierter SSDLC",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-19",
|
||||
"title": "Systematische Code Reviews",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-20",
|
||||
"title": "Automatisierte Sicherheitstests",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "semgrep",
|
||||
"scan_type": "sast",
|
||||
"cwe": [
|
||||
"CWE-89",
|
||||
"CWE-78",
|
||||
"CWE-79",
|
||||
"CWE-22"
|
||||
],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-21",
|
||||
"title": "Supply-Chain-Security",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-22",
|
||||
"title": "Dependency-Monitoring",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "osv",
|
||||
"scan_type": "cve",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-23",
|
||||
"title": "Software Bill of Materials (SBOM)",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-24",
|
||||
"title": "Security-Logging",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-25",
|
||||
"title": "Ereignis-Monitoring",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-26",
|
||||
"title": "Anomalie-Erkennung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-27",
|
||||
"title": "Log-Integritaet und -Aufbewahrung",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-28",
|
||||
"title": "Sichere Update-Mechanismen",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-29",
|
||||
"title": "Update-Authentizitaet",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-30",
|
||||
"title": "Update-Integritaet",
|
||||
"scans": [],
|
||||
"note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
|
||||
"status": "needs_tooling"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-31",
|
||||
"title": "Lifecycle-Support",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-32",
|
||||
"title": "Schwachstellen-Identifikation",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-33",
|
||||
"title": "SBOM-Pflege und Analyse",
|
||||
"scans": [
|
||||
{
|
||||
"tool": "syft",
|
||||
"scan_type": "sbom",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
},
|
||||
{
|
||||
"tool": "osv",
|
||||
"scan_type": "cve",
|
||||
"cwe": [],
|
||||
"rules": []
|
||||
}
|
||||
],
|
||||
"note": null,
|
||||
"status": "covered"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-34",
|
||||
"title": "Risikobasierte Priorisierung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-35",
|
||||
"title": "Coordinated Vulnerability Disclosure",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-36",
|
||||
"title": "Incident-Response-Prozess",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-37",
|
||||
"title": "Fruehwarnung (24h)",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-38",
|
||||
"title": "Detaillierter Vorfallsbericht (72h)",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-39",
|
||||
"title": "Patch-Bereitstellung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
},
|
||||
{
|
||||
"control": "cra-ai-40",
|
||||
"title": "Dokumentation und Nachbereitung",
|
||||
"scans": [],
|
||||
"note": "process / document control — outside static-scan scope",
|
||||
"status": "not_code_checkable"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,163 +0,0 @@
|
||||
//! `control-map` — the deterministic control → scan lookup table (LUT).
|
||||
//!
|
||||
//! The "transcribing" layer: it maps each compliance control to the static-scan
|
||||
//! step(s) that check it, or marks it as needing custom tooling, or as not
|
||||
//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
|
||||
//! decides coverage. The LLM only enters later, downstream, to triage/ground the
|
||||
//! *tool's* findings (that lives in the agent, not here).
|
||||
//!
|
||||
//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
|
||||
//! + query helpers.
|
||||
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
||||
/// Coverage bucket for a control under static (SAST-family) scanning.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub enum Coverage {
|
||||
/// An existing tool's scan surfaces findings for this control.
|
||||
Covered,
|
||||
/// Code-checkable, but no existing tool digs it out — we must write tooling.
|
||||
NeedsTooling,
|
||||
/// Process / document control — out of static-scan scope.
|
||||
NotCodeCheckable,
|
||||
}
|
||||
|
||||
/// One tool binding: a scan step that (at least partially) checks a control.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ScanBinding {
|
||||
/// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
|
||||
pub tool: String,
|
||||
/// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
|
||||
pub scan_type: String,
|
||||
/// CWEs whose findings map to this control (used to attach findings back).
|
||||
#[serde(default)]
|
||||
pub cwe: Vec<String>,
|
||||
/// Optional specific rule ids this control keys on.
|
||||
#[serde(default)]
|
||||
pub rules: Vec<String>,
|
||||
}
|
||||
|
||||
/// One control's entry in the LUT.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlEntry {
|
||||
/// Control id, e.g. `"cra-ai-8"`.
|
||||
pub control: String,
|
||||
/// Human-readable title (for the reviewable view).
|
||||
#[serde(default)]
|
||||
pub title: String,
|
||||
/// Coverage bucket.
|
||||
pub status: Coverage,
|
||||
/// Tool bindings (empty unless `status == Covered`).
|
||||
#[serde(default)]
|
||||
pub scans: Vec<ScanBinding>,
|
||||
/// Reviewer note — why it needs tooling / isn't code-checkable.
|
||||
#[serde(default)]
|
||||
pub note: Option<String>,
|
||||
}
|
||||
|
||||
/// The control → scan lookup table for one framework.
|
||||
#[derive(Debug, Clone, Serialize, Deserialize)]
|
||||
pub struct ControlMap {
|
||||
pub version: String,
|
||||
pub framework: String,
|
||||
pub controls: Vec<ControlEntry>,
|
||||
}
|
||||
|
||||
const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
|
||||
|
||||
impl ControlMap {
|
||||
/// Load the built-in CRA control map (the embedded, authored LUT).
|
||||
pub fn cra() -> Result<Self, MapError> {
|
||||
Ok(serde_json::from_str(CRA_MAP_JSON)?)
|
||||
}
|
||||
|
||||
/// The coverage entry for a control id, if present.
|
||||
pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
|
||||
self.controls.iter().find(|c| c.control == control_id)
|
||||
}
|
||||
|
||||
/// Controls whose bindings include the given `tool` + `cwe` — used to attach a
|
||||
/// raw tool finding back to the control(s) it's evidence for.
|
||||
pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
|
||||
self.controls
|
||||
.iter()
|
||||
.filter(|c| {
|
||||
c.scans
|
||||
.iter()
|
||||
.any(|s| s.tool == tool && s.cwe.iter().any(|w| w == cwe))
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Count of controls in each coverage bucket.
|
||||
pub fn summary(&self) -> CoverageSummary {
|
||||
let mut s = CoverageSummary::default();
|
||||
for c in &self.controls {
|
||||
match c.status {
|
||||
Coverage::Covered => s.covered += 1,
|
||||
Coverage::NeedsTooling => s.needs_tooling += 1,
|
||||
Coverage::NotCodeCheckable => s.not_code_checkable += 1,
|
||||
}
|
||||
}
|
||||
s
|
||||
}
|
||||
}
|
||||
|
||||
/// Coverage bucket counts.
|
||||
#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
|
||||
pub struct CoverageSummary {
|
||||
pub covered: usize,
|
||||
pub needs_tooling: usize,
|
||||
pub not_code_checkable: usize,
|
||||
}
|
||||
|
||||
impl CoverageSummary {
|
||||
pub fn total(&self) -> usize {
|
||||
self.covered + self.needs_tooling + self.not_code_checkable
|
||||
}
|
||||
}
|
||||
|
||||
/// Errors loading a control map.
|
||||
#[derive(Debug, thiserror::Error)]
|
||||
pub enum MapError {
|
||||
#[error("failed to parse control map: {0}")]
|
||||
Parse(#[from] serde_json::Error),
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn cra_map_loads_all_40_controls() {
|
||||
let map = ControlMap::cra().expect("CRA map should parse");
|
||||
assert_eq!(map.framework, "cra");
|
||||
assert_eq!(map.controls.len(), 40);
|
||||
assert_eq!(map.summary().total(), 40);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn hardcoded_password_control_is_tool_covered() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
|
||||
assert_eq!(c.status, Coverage::Covered);
|
||||
assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
|
||||
assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn finding_attaches_back_to_control_via_tool_and_cwe() {
|
||||
let map = ControlMap::cra().unwrap();
|
||||
let hits = map.controls_for("semgrep", "CWE-798");
|
||||
assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn every_bucket_is_represented() {
|
||||
let s = ControlMap::cra().unwrap().summary();
|
||||
assert!(s.covered > 0);
|
||||
assert!(s.needs_tooling > 0);
|
||||
assert!(s.not_code_checkable > 0);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user