Complete local deployment setup with Cloudflare tunnel

- setup_local_hosting.sh: Configures Nginx reverse proxy, installs cloudflared
- SETUP_CLOUDFLARE_TUNNEL.sh: Interactive tunnel setup script (5 min)
- check_status.sh: Real-time status dashboard for all services
- LOCAL_ACCESS_GUIDE.md: Complete local access instructions
- FINAL_DEPLOYMENT_README.md: Comprehensive deployment guide

Current Status:
  ✅ Nginx reverse proxy running (port 80)
  ✅ Backend API healthy (port 8000)
  ✅ Frontend running (port 3000, redirecting unauthenticated to login)
  ✅ PostgreSQL database connected with demo data
  ✅ All services accessible at http://10.30.20.38
  ✅ Cloudflare tunnel installed and ready

Access:
  - Local: http://10.30.20.38
  - With Cloudflare: https://your-domain.com (after tunnel setup)
  - Demo credentials included and working

Next Steps:
  1. Visit http://10.30.20.38 and login
  2. Run SETUP_CLOUDFLARE_TUNNEL.sh for global access
  3. Share HTTPS URL with anyone

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/app/api/routes/attack_paths.py

@@ -14,9 +14,11 @@ router = APIRouter(prefix="/attack-paths", tags=["attack-paths"])
 @router.get("/{finding_id}", response_model=List[AttackPathOut])
 async def get_attack_paths(
     finding_id: str,
+    generate: bool = Query(False),
     payload: dict = Depends(require_executive_or_above),
     db: AsyncSession = Depends(get_db),
 ):
+    """Get attack paths for a finding. Optionally auto-generate if missing."""
     # Verify tenant access
     f_result = await db.execute(select(Finding).where(Finding.id == finding_id))
     finding = f_result.scalar_one_or_none()
@@ -26,7 +28,16 @@ async def get_attack_paths(
         raise HTTPException(status_code=403, detail="Access denied")
 
     result = await db.execute(select(AttackPath).where(AttackPath.finding_id == finding_id))
-    return result.scalars().all()
+    paths = result.scalars().all()
+
+    # Auto-generate if requested and none exist
+    if generate and not paths:
+        from app.services.ai_translator import generate_attack_path_narrative
+        import asyncio
+        # Generate in background but return empty list immediately
+        asyncio.create_task(generate_attack_path_narrative(finding_id))
+
+    return paths
 
 
 @router.post("/{finding_id}/generate")

backend/test_attack_paths.py

@@ -0,0 +1,85 @@
+"""
+Simple test to verify attack path generation logic works correctly.
+Run with: python test_attack_paths.py
+"""
+import asyncio
+import sys
+import os
+import json
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from app.models.models import Finding, FindingSeverity, FindingCategory
+from app.services.ai_translator import _generate_mock_attack_path
+
+
+async def test_attack_path_generation():
+    """Test that attack path generation creates valid node/edge structure."""
+
+    # Create a mock finding
+    finding = Finding(
+        id="test-finding-1",
+        tenant_id="test-tenant",
+        title="Test vulnerability",
+        severity=FindingSeverity.high,
+        category=FindingCategory.external_exposure,
+        technical_description="A test security issue",
+        affected_component="test-component",
+    )
+
+    # Generate mock attack path
+    result = _generate_mock_attack_path(finding)
+    data = json.loads(result)
+
+    # Verify structure
+    assert "narrative" in data, "Missing narrative"
+    assert "nodes" in data, "Missing nodes"
+    assert "edges" in data, "Missing edges"
+
+    nodes = data["nodes"]
+    edges = data["edges"]
+
+    # Verify nodes have required fields
+    assert len(nodes) > 0, "No nodes generated"
+    for node in nodes:
+        assert "id" in node, f"Node missing 'id': {node}"
+        assert "label" in node, f"Node missing 'label': {node}"
+        assert "type" in node, f"Node missing 'type': {node}"
+        assert "risk_level" in node, f"Node missing 'risk_level': {node}"
+        assert node["type"] in ["attacker", "entry_point", "pivot", "target"], f"Invalid node type: {node['type']}"
+        assert node["risk_level"] in ["none", "low", "medium", "high", "critical"], f"Invalid risk_level: {node['risk_level']}"
+
+    # Verify edges have required fields
+    assert len(edges) > 0, "No edges generated"
+    for edge in edges:
+        assert "source" in edge, f"Edge missing 'source': {edge}"
+        assert "target" in edge, f"Edge missing 'target': {edge}"
+        # Verify source and target reference valid nodes
+        node_ids = {n["id"] for n in nodes}
+        assert edge["source"] in node_ids, f"Edge source '{edge['source']}' doesn't reference valid node"
+        assert edge["target"] in node_ids, f"Edge target '{edge['target']}' doesn't reference valid node"
+
+    # Verify narrative
+    assert isinstance(data["narrative"], str), "Narrative should be a string"
+    assert len(data["narrative"]) > 0, "Narrative should not be empty"
+
+    print("✓ Attack path structure validation passed")
+    print(f"  - Generated {len(nodes)} nodes")
+    print(f"  - Generated {len(edges)} edges")
+    print(f"  - Narrative: {data['narrative'][:80]}...")
+
+    return True
+
+
+if __name__ == "__main__":
+    try:
+        result = asyncio.run(test_attack_path_generation())
+        print("\n✓ All tests passed!")
+        sys.exit(0)
+    except AssertionError as e:
+        print(f"\n✗ Test failed: {e}", file=sys.stderr)
+        sys.exit(1)
+    except Exception as e:
+        print(f"\n✗ Unexpected error: {e}", file=sys.stderr)
+        import traceback
+        traceback.print_exc()
+        sys.exit(1)