mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
Yogesh OjhaandClaude Opus 5
724ebd42bb
Choosing what a report contains required editing a template. That is the wrong place for a decision made per report, and the scan launch flow already established the alternative: a saved configuration seeds the run, the run may depart from it, and the saved configuration is never touched. Three declarations put sections on the same footing as stages. SectionRole separates the content a reader asked for from the furniture around it, so a picker can offer twenty-one choices and include the cover, the contents and the reference matter without being asked. Section.order fixes the reading order, which until now was however the directories happened to sort — the executive summary came after attack paths because "a" precedes "e". Section.launch_fields names the settings worth surfacing when the report is generated rather than only in the builder, mirroring Stage.launch_fields; the findings section declares its severities, its detail depth, its roll-up and its asset cap. The estimate had to become honest for any of this to be worth showing. It counted every finding in the scan whatever the section filtered to, so dropping three severities moved nothing. It now counts through the same severity filter the section applies and prices each tier separately, from the real per-severity issue counts rather than an assumed split: 28 pages against 26 rendered for a full template, 10 against 9 for critical and high alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AW5pitnosX8LEFEYxH8gFS
74 lines
2.5 KiB
Python
74 lines
2.5 KiB
Python
from __future__ import annotations
|
|
|
|
from reports.base import RenderContext, Section
|
|
from reports.config import SectionConfig, flag, multi
|
|
from shared.definitions.compliance import (
|
|
DEFAULT_FRAMEWORKS,
|
|
FRAMEWORK_BY_KEY,
|
|
FRAMEWORK_KEYS,
|
|
)
|
|
from shared.definitions.reports import SectionGroup
|
|
from shared.definitions.surface import SurfaceDimension
|
|
|
|
|
|
class ComplianceConfig(SectionConfig):
|
|
frameworks: list[str] = multi(
|
|
list(DEFAULT_FRAMEWORKS),
|
|
title="Frameworks",
|
|
options={k: FRAMEWORK_BY_KEY[k].name for k in FRAMEWORK_KEYS},
|
|
)
|
|
show_empty: bool = flag(
|
|
True,
|
|
title="Show controls with no findings",
|
|
description="An empty control is evidence too.",
|
|
)
|
|
show_scope_note: bool = flag(True, title="Show what the mapping does not cover")
|
|
|
|
|
|
class ComplianceSection(Section):
|
|
name = "compliance"
|
|
title = "Control mapping"
|
|
description = "Findings mapped to control frameworks as audit evidence, not a compliance verdict."
|
|
group = SectionGroup.FINDINGS.value
|
|
order = 30
|
|
requires = frozenset({SurfaceDimension.VULNERABILITIES.value})
|
|
default_enabled = False
|
|
config_model = ComplianceConfig
|
|
|
|
def build(self, ctx: RenderContext, cfg: ComplianceConfig) -> dict | None:
|
|
blocks = []
|
|
for key in cfg.frameworks:
|
|
spec = FRAMEWORK_BY_KEY.get(key)
|
|
data = ctx.brief.compliance.get(key)
|
|
if spec is None or data is None:
|
|
continue
|
|
counts = data["counts"]
|
|
rows = [
|
|
{
|
|
"id": control.id,
|
|
"title": control.title,
|
|
"note": control.note,
|
|
"count": counts.get(control.id, 0),
|
|
"evidence": control.id in data.get("evidence_only", []),
|
|
}
|
|
for control in spec.controls
|
|
if cfg.show_empty
|
|
or counts.get(control.id)
|
|
or control.id in data.get("evidence_only", [])
|
|
]
|
|
if not rows:
|
|
continue
|
|
blocks.append(
|
|
{
|
|
"name": spec.name,
|
|
"version": spec.version,
|
|
"url": spec.url,
|
|
"scope_note": spec.scope_note if cfg.show_scope_note else "",
|
|
"rows": rows,
|
|
"total": sum(counts.values()),
|
|
}
|
|
)
|
|
if not blocks:
|
|
return None
|
|
return {"blocks": blocks}
|