463dff883b
- FastAPI backend: auth, findings, dashboard, attack paths, footprint, AI translator, risk calculator, PDF report generator - Next.js frontend: Vault dashboard, login, findings table, finding detail with AI coach, digital footprint, reports - PostgreSQL data model: tenants, users, assets, findings, risk scores, audit reports, attack paths - Docker Compose + Dockerfiles for all services - Demo seed data: Acme Corp with 6 findings and 90-day risk score history - AI Risk Translator (OpenAI/Anthropic) with plain-English business impact - Role-based access: executive / it_admin / trustos_admin - Scope-lock engine: authorization required before any assessment Stage 1-8 complete: Phase 1 Vault Audit product ready
89 lines
2.9 KiB
Python
89 lines
2.9 KiB
Python
from fastapi import APIRouter, Depends, HTTPException, Query
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from sqlalchemy import select
|
|
from typing import List
|
|
|
|
from app.db.session import get_db
|
|
from app.models.models import Finding, Executive, AuthorizedAsset
|
|
from app.schemas.schemas import AuthorizedAssetCreate, AuthorizedAssetOut
|
|
from app.core.security import require_admin, require_it_or_above
|
|
|
|
router = APIRouter(prefix="/footprint", tags=["footprint"])
|
|
|
|
|
|
@router.get("/{tenant_id}")
|
|
async def get_footprint(
|
|
tenant_id: str,
|
|
payload: dict = Depends(require_it_or_above),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != tenant_id:
|
|
raise HTTPException(status_code=403, detail="Access denied")
|
|
|
|
# Digital footprint findings
|
|
from app.models.models import FindingCategory
|
|
fp_result = await db.execute(
|
|
select(Finding).where(
|
|
Finding.tenant_id == tenant_id,
|
|
Finding.category == FindingCategory.digital_footprint
|
|
)
|
|
)
|
|
footprint_findings = fp_result.scalars().all()
|
|
|
|
# Executives
|
|
exec_result = await db.execute(
|
|
select(Executive).where(Executive.tenant_id == tenant_id, Executive.is_enrolled == True)
|
|
)
|
|
executives = exec_result.scalars().all()
|
|
|
|
return {
|
|
"tenant_id": tenant_id,
|
|
"executives": [
|
|
{"id": e.id, "name": e.full_name, "title": e.title, "email": e.corporate_email}
|
|
for e in executives
|
|
],
|
|
"footprint_findings": [
|
|
{
|
|
"id": f.id,
|
|
"title": f.title,
|
|
"severity": f.severity.value,
|
|
"ai_summary": f.ai_summary,
|
|
"status": f.status.value,
|
|
"source": f.source,
|
|
}
|
|
for f in footprint_findings
|
|
],
|
|
"total_exposures": len(footprint_findings),
|
|
}
|
|
|
|
|
|
@router.get("/authorized-assets/{tenant_id}", response_model=List[AuthorizedAssetOut])
|
|
async def list_authorized_assets(
|
|
tenant_id: str,
|
|
payload: dict = Depends(require_it_or_above),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != tenant_id:
|
|
raise HTTPException(status_code=403, detail="Access denied")
|
|
result = await db.execute(
|
|
select(AuthorizedAsset).where(
|
|
AuthorizedAsset.tenant_id == tenant_id,
|
|
AuthorizedAsset.is_active == True
|
|
)
|
|
)
|
|
return result.scalars().all()
|
|
|
|
|
|
@router.post("/authorized-assets/{tenant_id}", response_model=AuthorizedAssetOut, status_code=201)
|
|
async def add_authorized_asset(
|
|
tenant_id: str,
|
|
body: AuthorizedAssetCreate,
|
|
payload: dict = Depends(require_admin),
|
|
db: AsyncSession = Depends(get_db),
|
|
):
|
|
asset = AuthorizedAsset(tenant_id=tenant_id, **body.model_dump())
|
|
db.add(asset)
|
|
await db.commit()
|
|
await db.refresh(asset)
|
|
return asset
|