463dff883b
- FastAPI backend: auth, findings, dashboard, attack paths, footprint, AI translator, risk calculator, PDF report generator - Next.js frontend: Vault dashboard, login, findings table, finding detail with AI coach, digital footprint, reports - PostgreSQL data model: tenants, users, assets, findings, risk scores, audit reports, attack paths - Docker Compose + Dockerfiles for all services - Demo seed data: Acme Corp with 6 findings and 90-day risk score history - AI Risk Translator (OpenAI/Anthropic) with plain-English business impact - Role-based access: executive / it_admin / trustos_admin - Scope-lock engine: authorization required before any assessment Stage 1-8 complete: Phase 1 Vault Audit product ready
50 lines
2.0 KiB
Python
50 lines
2.0 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, Query
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from sqlalchemy import select
|
|
|
|
from app.db.session import get_db
|
|
from app.models.models import Finding
|
|
from app.core.security import require_it_or_above
|
|
|
|
router = APIRouter(prefix="/ai", tags=["ai"])
|
|
|
|
|
|
@router.post("/translate/{finding_id}")
|
|
async def translate_finding(
|
|
finding_id: str,
|
|
payload: dict = Depends(require_it_or_above),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
"""Trigger or re-trigger AI translation for a specific finding."""
|
|
result = await db.execute(select(Finding).where(Finding.id == finding_id))
|
|
finding = result.scalar_one_or_none()
|
|
if not finding:
|
|
raise HTTPException(status_code=404, detail="Finding not found")
|
|
if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != finding.tenant_id:
|
|
raise HTTPException(status_code=403, detail="Access denied")
|
|
|
|
from app.services.ai_translator import translate_finding_async
|
|
import asyncio
|
|
asyncio.create_task(translate_finding_async(finding_id))
|
|
return {"status": "queued", "finding_id": finding_id}
|
|
|
|
|
|
@router.get("/explain/{finding_id}")
|
|
async def explain_finding(
|
|
finding_id: str,
|
|
question: str = Query(default="Why does this matter to our business?"),
|
|
payload: dict = Depends(require_it_or_above),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
"""AI Security Coach: answer a specific question about a finding."""
|
|
result = await db.execute(select(Finding).where(Finding.id == finding_id))
|
|
finding = result.scalar_one_or_none()
|
|
if not finding:
|
|
raise HTTPException(status_code=404, detail="Finding not found")
|
|
if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != finding.tenant_id:
|
|
raise HTTPException(status_code=403, detail="Access denied")
|
|
|
|
from app.services.ai_translator import answer_finding_question
|
|
answer = await answer_finding_question(finding, question)
|
|
return {"question": question, "answer": answer, "finding_id": finding_id}
|