feat(tests): operator assignment — two queues for techs, assign endpoint for leads

backend/alembic/versions/b050_add_operator_assignees.py

@@ -0,0 +1,24 @@
+"""Add red_tech_assignee and blue_tech_assignee to tests.
+
+Revision ID: b050
+Revises: b049
+Create Date: 2026-06-19
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "b050"
+down_revision = "b049"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("tests", sa.Column("red_tech_assignee", UUID(as_uuid=True), sa.ForeignKey("users.id"), nullable=True))
+    op.add_column("tests", sa.Column("blue_tech_assignee", UUID(as_uuid=True), sa.ForeignKey("users.id"), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("tests", "blue_tech_assignee")
+    op.drop_column("tests", "red_tech_assignee")

backend/app/models/test.py

@@ -129,6 +129,14 @@ class Test(Base):
     blue_validator = relationship("User", foreign_keys=[blue_validated_by])
     # Assign remediation_user = relationship("User", foreign_keys=[remediation_assignee])
     remediation_user = relationship("User", foreign_keys=[remediation_assignee])
+
+    # ── Assignment fields ──────────────────────────────────────────
+    red_tech_assignee = Column(UUID(as_uuid=True), ForeignKey("users.id"), nullable=True)
+    blue_tech_assignee = Column(UUID(as_uuid=True), ForeignKey("users.id"), nullable=True)
+
+    red_tech_assigned_user = relationship("User", foreign_keys=[red_tech_assignee])
+    blue_tech_assigned_user = relationship("User", foreign_keys=[blue_tech_assignee])
+
     # Assign original_test = relationship("Test", remote_side="Test.id", foreign_keys=[retest_of])
     original_test = relationship("Test", remote_side="Test.id", foreign_keys=[retest_of])
     # Assign retests = relationship("Test", foreign_keys=[retest_of], back_populates="orig...

backend/app/routers/tests.py

@@ -51,6 +51,7 @@ from app.models.user import User
 
 # Import  from app.schemas.test
 from app.schemas.test import (
+    TestAssign,
     TestBlueUpdate,
     TestBlueValidate,
     TestClassificationUpdate,
@@ -563,6 +564,15 @@ def update_test_red(
     Returns:
         TestOut: The updated test with refreshed red-team field values.
     """
+    # Assignee lock: red_tech cannot work a test assigned to someone else
+    _pre_test = crud_get_test_or_raise(db, test_id)
+    if (
+        _pre_test.red_tech_assignee is not None
+        and current_user.role == "red_tech"
+        and _pre_test.red_tech_assignee != current_user.id
+    ):
+        raise HTTPException(status_code=403, detail="Test is assigned to another operator")
+
     # Assign update_data = payload.model_dump(exclude_unset=True)
     update_data = payload.model_dump(exclude_unset=True)
     # Open context manager
@@ -620,6 +630,15 @@ def update_test_blue(
     Returns:
         TestOut: The updated test with refreshed blue-team field values.
     """
+    # Assignee lock: blue_tech cannot work a test assigned to someone else
+    _pre_test = crud_get_test_or_raise(db, test_id)
+    if (
+        _pre_test.blue_tech_assignee is not None
+        and current_user.role == "blue_tech"
+        and _pre_test.blue_tech_assignee != current_user.id
+    ):
+        raise HTTPException(status_code=403, detail="Test is assigned to another operator")
+
     # Assign update_data = payload.model_dump(exclude_unset=True)
     update_data = payload.model_dump(exclude_unset=True)
     # Open context manager
@@ -676,10 +695,22 @@ def start_execution(
     """
     # Assign test = crud_get_test_or_raise(db, test_id)
     test = crud_get_test_or_raise(db, test_id)
+
+    # Assignee lock: red_tech cannot start a test assigned to someone else
+    if (
+        test.red_tech_assignee is not None
+        and current_user.role == "red_tech"
+        and test.red_tech_assignee != current_user.id
+    ):
+        raise HTTPException(status_code=403, detail="Test is assigned to another operator")
+
     # Open context manager
     with UnitOfWork(db) as uow:
         # Assign test = wf_start_execution(db, test, current_user)
         test = wf_start_execution(db, test, current_user)
+        # Auto-assign: if no assignee set, claim this test for the current operator
+        if test.red_tech_assignee is None:
+            test.red_tech_assignee = current_user.id
         # Call uow.commit()
         uow.commit()
     # Reload ORM object attributes from the database
@@ -715,6 +746,15 @@ def submit_red(
     """
     # Assign test = crud_get_test_or_raise(db, test_id)
     test = crud_get_test_or_raise(db, test_id)
+
+    # Assignee lock: red_tech cannot submit a test assigned to someone else
+    if (
+        test.red_tech_assignee is not None
+        and current_user.role == "red_tech"
+        and test.red_tech_assignee != current_user.id
+    ):
+        raise HTTPException(status_code=403, detail="Test is assigned to another operator")
+
     # Open context manager
     with UnitOfWork(db) as uow:
         # Assign test = wf_submit_red(db, test, current_user)
@@ -754,6 +794,15 @@ def submit_blue(
     """
     # Assign test = crud_get_test_or_raise(db, test_id)
     test = crud_get_test_or_raise(db, test_id)
+
+    # Assignee lock: blue_tech cannot submit a test assigned to someone else
+    if (
+        test.blue_tech_assignee is not None
+        and current_user.role == "blue_tech"
+        and test.blue_tech_assignee != current_user.id
+    ):
+        raise HTTPException(status_code=403, detail="Test is assigned to another operator")
+
     # Open context manager
     with UnitOfWork(db) as uow:
         # Assign test = wf_submit_blue(db, test, current_user)
@@ -779,8 +828,20 @@ def start_blue_work(
 ):
     """Blue tech picks up the test to start evaluating. Sets the Tempo timer start."""
     test = crud_get_test_or_raise(db, test_id)
+
+    # Assignee lock: blue_tech cannot pick up a test assigned to someone else
+    if (
+        test.blue_tech_assignee is not None
+        and current_user.role == "blue_tech"
+        and test.blue_tech_assignee != current_user.id
+    ):
+        raise HTTPException(status_code=403, detail="Test is assigned to another operator")
+
     with UnitOfWork(db) as uow:
         test = wf_start_blue_work(db, test, current_user)
+        # Auto-assign: if no assignee set, claim this test for the current operator
+        if test.blue_tech_assignee is None:
+            test.blue_tech_assignee = current_user.id
         uow.commit()
     db.refresh(test)
     return test
@@ -1017,6 +1078,48 @@ def reopen(
     return test
 
 
+# ---------------------------------------------------------------------------
+# POST /tests/{id}/assign  —  assign red_tech / blue_tech operators (leads + admin)
+# ---------------------------------------------------------------------------
+
+
+@router.post("/{test_id}/assign", response_model=TestOut)
+def assign_test_operators(
+    test_id: uuid.UUID,
+    payload: TestAssign,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
+):
+    """Assign red_tech and/or blue_tech operators to a test. Admin/leads only."""
+    test = crud_get_test_or_raise(db, test_id)
+
+    if payload.red_tech_assignee is not None:
+        u = db.query(User).filter(User.id == payload.red_tech_assignee).first()
+        if not u or u.role not in ("red_tech", "red_lead", "admin"):
+            raise HTTPException(status_code=400, detail="Invalid red tech assignee")
+        test.red_tech_assignee = payload.red_tech_assignee
+
+    if payload.blue_tech_assignee is not None:
+        u = db.query(User).filter(User.id == payload.blue_tech_assignee).first()
+        if not u or u.role not in ("blue_tech", "blue_lead", "admin"):
+            raise HTTPException(status_code=400, detail="Invalid blue tech assignee")
+        test.blue_tech_assignee = payload.blue_tech_assignee
+
+    # Handle intentional null (clearing) — model_fields_set tracks which keys were sent
+    if "red_tech_assignee" in payload.model_fields_set and payload.red_tech_assignee is None:
+        test.red_tech_assignee = None
+    if "blue_tech_assignee" in payload.model_fields_set and payload.blue_tech_assignee is None:
+        test.blue_tech_assignee = None
+
+    log_action(db, current_user.id, "assign_test", str(test_id), {
+        "red_tech_assignee": str(payload.red_tech_assignee) if payload.red_tech_assignee else None,
+        "blue_tech_assignee": str(payload.blue_tech_assignee) if payload.blue_tech_assignee else None,
+    })
+    db.commit()
+    db.refresh(test)
+    return test
+
+
 # ---------------------------------------------------------------------------
 # PATCH /tests/{id}/remediation  —  update remediation fields
 # ---------------------------------------------------------------------------

backend/app/schemas/test.py

@@ -134,6 +134,13 @@ class TestRemediationUpdate(BaseModel):
     remediation_assignee: uuid.UUID | None = None
 
 
+class TestAssign(BaseModel):
+    """Payload for assigning operators to a test."""
+
+    red_tech_assignee: uuid.UUID | None = None
+    blue_tech_assignee: uuid.UUID | None = None
+
+
 # ── Legacy validate (kept for backwards compat) ────────────────────
 
 
@@ -221,6 +228,10 @@ class TestOut(BaseModel):
     # Assign remediation_assignee = None
     remediation_assignee: uuid.UUID | None = None
 
+    # Assignment fields
+    red_tech_assignee: uuid.UUID | None = None
+    blue_tech_assignee: uuid.UUID | None = None
+
     # Re-test fields
     retest_of: uuid.UUID | None = None
     # Assign retest_count = 0

frontend/src/api/tests.ts

@@ -63,6 +63,9 @@ export interface TestListFilters {
   created_by?: string;
   pending_validation_side?: "red" | "blue";
   not_in_any_campaign?: boolean;
+  assigned_to_me?: boolean;
+  unassigned_red?: boolean;
+  unassigned_blue?: boolean;
   offset?: number;
   limit?: number;
 }
@@ -222,6 +225,17 @@ export async function reopenTest(testId: string): Promise<Test> {
   return data;
 }
 
+// ── Assignment ─────────────────────────────────────────────────────
+
+/** Assign red_tech and/or blue_tech operators to a test. Admin/leads only. */
+export async function assignTest(
+  testId: string,
+  payload: { red_tech_assignee?: string | null; blue_tech_assignee?: string | null },
+): Promise<Test> {
+  const { data } = await client.post<Test>(`/tests/${testId}/assign`, payload);
+  return data;
+}
+
 // ── Timeline ───────────────────────────────────────────────────────
 
 /** Get the audit-log timeline for a test. */

frontend/src/pages/TestsPage.tsx

@@ -109,23 +109,9 @@ function formatElapsed(dateStr: string | null | undefined): string {
   return `${days}d ${hours % 24}h`;
 }
 
-/* ── Component ──────────────────────────────────────────────────────── */
+/* ── Shared sort key type ────────────────────────────────────────────── */
 
-export default function TestsPage() {
-  const navigate = useNavigate();
-  const { user } = useAuth();
-
-  const canCreate =
-    user?.role === "admin" || user?.role === "red_lead" || user?.role === "blue_lead";
-
-  // ── Filter state ──────────────────────────────────────────────────
-  const [stateFilter, setStateFilter] = useState<TestState | "">("");
-  const [platformFilter, setPlatformFilter] = useState("");
-  const [searchText, setSearchText] = useState("");
-  const [showMyTasks, setShowMyTasks] = useState(false);
-
-  // ── Sort state ────────────────────────────────────────────────────
-  type SortKey =
+type SortKey =
   | "name"
   | "technique"
   | "state"
@@ -134,6 +120,27 @@ export default function TestsPage() {
   | "created_at"
   | "updated_at"
   | "waiting_time";
+
+/* ── Component ──────────────────────────────────────────────────────── */
+
+const isTechRole = (role?: string) => role === "red_tech" || role === "blue_tech";
+
+export default function TestsPage() {
+  const navigate = useNavigate();
+  const { user } = useAuth();
+
+  const canCreate =
+    user?.role === "admin" || user?.role === "red_lead" || user?.role === "blue_lead";
+
+  const techRole = isTechRole(user?.role);
+
+  // ── Filter state ──────────────────────────────────────────────────
+  const [stateFilter, setStateFilter] = useState<TestState | "">("");
+  const [platformFilter, setPlatformFilter] = useState("");
+  const [searchText, setSearchText] = useState("");
+  const [showMyTasks, setShowMyTasks] = useState(false);
+
+  // ── Sort state ────────────────────────────────────────────────────
   const [sortKey, setSortKey] = useState<SortKey>("created_at");
   const [sortDir, setSortDir] = useState<"asc" | "desc">("desc");
 
@@ -290,6 +297,52 @@ export default function TestsPage() {
 
   const totalTests = allTestsUnfiltered?.length || 0;
 
+  // ── Two-queue split for tech roles ────────────────────────────────
+  const { availableTests, myAssignedTests } = useMemo(() => {
+    if (!techRole || !user || !allTests) {
+      return { availableTests: [] as typeof tests, myAssignedTests: [] as typeof tests };
+    }
+
+    let searchFiltered = allTests.filter((t) => t.state !== "validated");
+    if (searchText.trim()) {
+      const q = searchText.toLowerCase();
+      searchFiltered = searchFiltered.filter(
+        (t) =>
+          t.name.toLowerCase().includes(q) ||
+          (t.technique_mitre_id && t.technique_mitre_id.toLowerCase().includes(q)) ||
+          (t.technique_name && t.technique_name.toLowerCase().includes(q))
+      );
+    }
+    if (platformFilter) {
+      searchFiltered = searchFiltered.filter((t) =>
+        t.platform?.toLowerCase().includes(platformFilter.toLowerCase())
+      );
+    }
+
+    if (user.role === "red_tech") {
+      const available = searchFiltered.filter(
+        (t) =>
+          (t.state === "draft" || t.state === "red_executing") &&
+          t.red_tech_assignee === null
+      );
+      const mine = searchFiltered.filter((t) => t.red_tech_assignee === user.id);
+      return { availableTests: available, myAssignedTests: mine };
+    }
+
+    if (user.role === "blue_tech") {
+      const available = searchFiltered.filter(
+        (t) =>
+          t.state === "blue_evaluating" &&
+          t.blue_tech_assignee === null &&
+          t.blue_work_started_at === null
+      );
+      const mine = searchFiltered.filter((t) => t.blue_tech_assignee === user.id);
+      return { availableTests: available, myAssignedTests: mine };
+    }
+
+    return { availableTests: [] as typeof tests, myAssignedTests: [] as typeof tests };
+  }, [techRole, user, allTests, searchText, platformFilter]);
+
   // ── Formatting helpers ─────────────────────────────────────────────
   const formatDate = (dateStr: string | null | undefined) => {
     if (!dateStr) return "-";
@@ -425,8 +478,8 @@ export default function TestsPage() {
       {/* ── Filters Bar ───────────────────────────────────────────────── */}
       <div className="rounded-xl border border-gray-800 bg-gray-900 p-4">
         <div className="flex flex-wrap items-center gap-3">
-          {/* My tasks toggle */}
-          {user?.role !== "admin" && user?.role !== "viewer" && (
+          {/* My tasks toggle — hidden for tech roles (they have the two-queue view below) */}
+          {user?.role !== "admin" && user?.role !== "viewer" && !techRole && (
             <button
               onClick={() => {
                 setShowMyTasks(!showMyTasks);
@@ -525,7 +578,40 @@ export default function TestsPage() {
         )}
       </div>
 
-      {/* ── Tests Table ───────────────────────────────────────────────── */}
+      {/* ── Tests Table / Two-Queue View ─────────────────────────────── */}
+      {techRole ? (
+        /* Two-section queue for red_tech and blue_tech */
+        <div className="space-y-6">
+          {/* Available Tests */}
+          <div className="rounded-xl border border-gray-800 bg-gray-900 p-6">
+            <div className="mb-4 flex items-center justify-between">
+              <div className="flex items-center gap-2">
+                <h2 className="text-lg font-semibold text-white">Available Tests</h2>
+                <span className="rounded-full border border-cyan-500/30 bg-cyan-500/10 px-2 py-0.5 text-xs font-medium text-cyan-400">
+                  {availableTests.length}
+                </span>
+              </div>
+              <span className="text-xs text-gray-500">Unassigned — pick one to claim it</span>
+            </div>
+            <TestTable tests={availableTests} columns={mainTableColumns} sortKey={sortKey} sortDir={sortDir} handleSort={handleSort} navigate={navigate} formatDate={formatDate} emptyMessage="No available tests right now." />
+          </div>
+
+          {/* My Assigned Tests */}
+          <div className="rounded-xl border border-gray-800 bg-gray-900 p-6">
+            <div className="mb-4 flex items-center justify-between">
+              <div className="flex items-center gap-2">
+                <h2 className="text-lg font-semibold text-white">My Assigned Tests</h2>
+                <span className="rounded-full border border-orange-500/30 bg-orange-500/10 px-2 py-0.5 text-xs font-medium text-orange-400">
+                  {myAssignedTests.length}
+                </span>
+              </div>
+              <span className="text-xs text-gray-500">Tests assigned to you</span>
+            </div>
+            <TestTable tests={myAssignedTests} columns={mainTableColumns} sortKey={sortKey} sortDir={sortDir} handleSort={handleSort} navigate={navigate} formatDate={formatDate} emptyMessage="No tests currently assigned to you." />
+          </div>
+        </div>
+      ) : (
+        /* Normal single-table view for leads, admin, viewer */
         <div className="rounded-xl border border-gray-800 bg-gray-900 p-6">
           <div className="mb-4 flex items-center justify-between">
             <h2 className="text-lg font-semibold text-white">
@@ -533,12 +619,40 @@ export default function TestsPage() {
             </h2>
             <span className="text-sm text-gray-400">{tests.length} tests</span>
           </div>
+          <TestTable tests={tests} columns={mainTableColumns} sortKey={sortKey} sortDir={sortDir} handleSort={handleSort} navigate={navigate} formatDate={formatDate} emptyMessage={showMyTasks ? "No pending tasks for your role." : "No tests found matching your filters."} />
+        </div>
+      )}
+    </div>
+  );
+}
 
+/* ── Shared test table component ────────────────────────────────────── */
+
+function TestTable({
+  tests,
+  columns,
+  sortKey,
+  sortDir,
+  handleSort,
+  navigate,
+  formatDate,
+  emptyMessage,
+}: {
+  tests: Test[];
+  columns: { key: SortKey; label: string; cls: string }[];
+  sortKey: SortKey;
+  sortDir: "asc" | "desc";
+  handleSort: (key: SortKey) => void;
+  navigate: (path: string) => void;
+  formatDate: (d: string | null | undefined) => string;
+  emptyMessage: string;
+}) {
+  return (
     <div className="overflow-x-auto">
       <table className="w-full text-left text-sm">
         <thead>
           <tr className="border-b border-gray-800">
-                {mainTableColumns.map(({ key, label, cls }) => (
+            {columns.map(({ key, label, cls }) => (
               <th
                 key={key}
                 className={`pb-3 ${cls} font-medium text-gray-400 cursor-pointer select-none hover:text-white transition-colors`}
@@ -636,14 +750,8 @@ export default function TestsPage() {
       </table>
 
       {tests.length === 0 && (
-            <div className="py-12 text-center text-gray-400">
-              {showMyTasks
-                ? "No pending tasks for your role."
-                : "No tests found matching your filters."}
-            </div>
+        <div className="py-12 text-center text-gray-400">{emptyMessage}</div>
       )}
     </div>
-      </div>
-    </div>
   );
 }

frontend/src/types/models.ts

@@ -110,6 +110,10 @@ export interface Test {
   remediation_status: string | null;
   remediation_assignee: string | null;
 
+  // Assignment fields
+  red_tech_assignee: string | null;
+  blue_tech_assignee: string | null;
+
   // Re-test fields
   retest_of: string | null;
   retest_count: number;