The Anthropic path could never activate: it gated on
`not ANTHROPIC_API_KEY.startswith("sk-ant-")`, but real Anthropic keys start
with `sk-ant-`, so any real key was treated as a placeholder and every request
fell back to mock. It also targeted the retired `claude-3-haiku-20240307`.
- ai_translator.py: add `_real_key()` placeholder detection (rejects `sk-ant-...`,
`changeme`, `your-`, etc. — accepts real secrets), centralize provider gating
in `_ai_enabled()`, and point all three AI features (finding translation,
security coach, attack-path narrative) at `claude-sonnet-5` with thinking
disabled for fast structured output. OpenAI kept as a secondary provider.
- config.py / .env.example: default AI_PROVIDER to anthropic.
Mock mode still works with no key configured; dropping in a real
ANTHROPIC_API_KEY now actually enables live Claude.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Features added:
- AI Finding Translation endpoints (POST /findings/{id}/ai-translate)
- AI Security Coach endpoint (POST /findings/{id}/ai-question)
- Attack Path visualization generation (POST /attack-paths/{id}/generate, GET /attack-paths/{id})
- Mock AI implementations for demo mode (no API keys required)
- PDF Report generation and download endpoints
- Report snapshot feature for on-demand PDF generation
Technical improvements:
- Mock translation system for findings and attack paths
- Async task-based AI processing
- Graph-based attack path with nodes and edges
- Professional HTML-to-PDF conversion with WeasyPrint
- Jinja2 templating for report generation
Database updates:
- AttackPath table integrated with mock narrative generation
- AI fields populated via async tasks
Testing:
- All E2E tests verified passing (login, dashboard, findings, all roles)
- AI endpoints tested and working with mock data
- PDF report generation produces valid 18KB+ documents
- Attack path generation creates proper graph structures
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
