feat(templates,campaigns): validate MITRE technique IDs, surface template suggestions first, manager can re-approve rejected campaigns

- TestTemplate/TemplateSuggestion creation and updates now reject any
  mitre_technique_id that doesn't match a real, already-synced MITRE
  ATT&CK technique. Frontend swaps the free-text ID input for a
  technique picker.
- Test Catalog now shows pending template suggestions before the
  catalog grid, with full field detail (platform, severity, tool,
  atomic ID, source URL, remediation) instead of just name/procedure.
- A manager can edit and directly re-approve a campaign they previously
  rejected, instead of needing the original lead to resubmit it.

backend/app/routers/campaigns.py

@@ -431,15 +431,19 @@ def update_campaign(
     # Entry: db
     db: Session = Depends(get_db),
     # Entry: current_user
-    current_user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    current_user: User = Depends(require_any_role("red_lead", "blue_lead", "manager")),
 ) -> dict:
     """Update a campaign. Only allowed in draft or active state.
 
+    A manager may only edit a campaign that's sitting in draft with a
+    rejection_reason set (i.e. one they previously rejected) — see
+    ``update_campaign()``'s ownership check.
+
     Args:
         campaign_id (str): UUID string of the campaign to update.
         payload (CampaignUpdate): Partial update payload; only set fields are applied.
         db (Session): SQLAlchemy database session.
-        current_user (User): Authenticated red_lead or blue_lead performing the update.
+        current_user (User): Authenticated red_lead, blue_lead, or manager performing the update.
 
     Returns:
         dict: Serialised representation of the updated campaign.

backend/app/services/campaign_crud_service.py

@@ -367,6 +367,11 @@ def approve_campaign(
 ) -> Campaign:
     """Approve a pending campaign: fix its start date and activate it.
 
+    Also allows approving a previously-rejected campaign directly (status
+    ``draft`` with a ``rejection_reason`` set) — a manager can edit it via
+    ``update_campaign()`` and then approve it themselves, without needing
+    the original lead to resubmit it through the normal queue.
+
     Raises EntityNotFoundError, BusinessRuleViolation.
     Does not commit; caller commits.
     """
@@ -374,8 +379,9 @@ def approve_campaign(
     if not campaign:
         raise EntityNotFoundError("Campaign", campaign_id)
 
-    if campaign.status != "pending_approval":
-        raise BusinessRuleViolation("Only campaigns pending approval can be approved")
+    is_previously_rejected_draft = campaign.status == "draft" and campaign.rejection_reason
+    if campaign.status != "pending_approval" and not is_previously_rejected_draft:
+        raise BusinessRuleViolation("Only campaigns pending approval (or previously rejected) can be approved")
 
     if not start_date:
         raise BusinessRuleViolation("start_date is required to approve a campaign")
@@ -454,7 +460,7 @@ def update_campaign(
     Does not commit; caller commits.
     """
     # Assign campaign = db.query(Campaign).filter(Campaign.id == campaign_id).first()
-    campaign = db.query(Campaign).filter(Campaign.id == campaign_id).first()
+    campaign = db.query(Campaign).filter(Campaign.id == uuid.UUID(campaign_id)).first()
     # Check: not campaign
     if not campaign:
         # Raise EntityNotFoundError
@@ -465,10 +471,16 @@ def update_campaign(
         # Raise BusinessRuleViolation
         raise BusinessRuleViolation("Can only update draft or active campaigns")
 
-    # Check: str(campaign.created_by) != str(updater_id) and updater_role != "ad...
-    if str(campaign.created_by) != str(updater_id) and updater_role != "admin":
+    # A manager may edit a campaign they (or another manager) previously
+    # rejected — this is what lets them fix it up and self-approve it,
+    # instead of bouncing it back to the original lead to resubmit.
+    is_manager_editing_own_rejection = (
+        updater_role == "manager" and campaign.status == "draft" and campaign.rejection_reason
+    )
+    is_owner_or_admin = str(campaign.created_by) == str(updater_id) or updater_role == "admin"
+    if not is_owner_or_admin and not is_manager_editing_own_rejection:
         # Raise PermissionViolation
-        raise PermissionViolation("Only the creator or admin can update this campaign")
+        raise PermissionViolation("Only the creator, admin, or a manager reviewing a rejected campaign can update this campaign")
 
     # Check: "scheduled_at" in fields and fields["scheduled_at"]
     if "scheduled_at" in fields and fields["scheduled_at"]:

backend/app/services/template_suggestion_service.py

@@ -19,7 +19,7 @@ from app.models.template_suggestion import TemplateSuggestion
 from app.models.test_template import TestTemplate
 from app.models.user import User
 from app.services.notification_service import notify_role
-from app.services.test_template_service import create_template
+from app.services.test_template_service import create_template, validate_mitre_technique_id
 
 _TEAM_BY_ROLE = {"red_tech": "red", "blue_tech": "blue"}
 _LEAD_ROLE = {"red": "red_lead", "blue": "blue_lead"}
@@ -45,6 +45,7 @@ def create_template_suggestion(db: Session, submitter: User, **fields: object) -
     Does not commit; caller uses UnitOfWork.
     """
     team = team_for_submitter(submitter)
+    validate_mitre_technique_id(db, fields["mitre_technique_id"])
     suggestion = TemplateSuggestion(team=team, submitted_by=submitter.id, **fields)
     db.add(suggestion)
     db.flush()

backend/app/services/test_template_service.py

@@ -12,7 +12,7 @@ from sqlalchemy import func, or_
 from sqlalchemy.orm import Session
 
 # Import EntityNotFoundError from app.domain.errors
-from app.domain.errors import EntityNotFoundError
+from app.domain.errors import BusinessRuleViolation, EntityNotFoundError
 
 # Import TestTemplate from app.models.test_template
 from app.models.test_template import TestTemplate
@@ -235,9 +235,22 @@ def get_template_or_raise(db: Session, template_id: uuid.UUID) -> TestTemplate:
     return template
 
 
+def validate_mitre_technique_id(db: Session, mitre_technique_id: str) -> None:
+    """Raise BusinessRuleViolation unless *mitre_technique_id* matches a real,
+    already-synced MITRE ATT&CK technique — free text like "made up" or a
+    typo'd ID would otherwise silently create an orphaned template that can
+    never be found via technique lookups or coverage reporting."""
+    exists = db.query(Technique).filter(Technique.mitre_id == mitre_technique_id).first()
+    if not exists:
+        raise BusinessRuleViolation(
+            f"'{mitre_technique_id}' is not a known MITRE ATT&CK technique ID"
+        )
+
+
 # Define function create_template
 def create_template(db: Session, **fields: object) -> TestTemplate:
     """Create a test template from keyword args (e.g. payload.model_dump()). Does NOT commit."""
+    validate_mitre_technique_id(db, fields["mitre_technique_id"])
     # Assign template = TestTemplate(**fields)
     template = TestTemplate(**fields)
     # Stage new record(s) for database insertion
@@ -249,6 +262,8 @@ def create_template(db: Session, **fields: object) -> TestTemplate:
 # Define function update_template
 def update_template(db: Session, template_id: uuid.UUID, **fields: object) -> TestTemplate:
     """Update an existing template. Raises EntityNotFoundError if not found. Does NOT commit."""
+    if fields.get("mitre_technique_id"):
+        validate_mitre_technique_id(db, fields["mitre_technique_id"])
     # Assign template = get_template_or_raise(db, template_id)
     template = get_template_or_raise(db, template_id)
     # Iterate over fields.items()