fix(jira): correct Data Sensitivity field ID and replicate Jira's real classification scheme

The auto-create-ticket call was sending customfield_11233 (a field that
doesn't exist in the project) instead of the real Data Sensitivity field
customfield_11814, which made Jira reject the WHOLE issue and silently
block ticket creation for every new test.

Also replaces Aegis's invented 4-tier data_classification scheme
(public_release/general_use/confidential/restricted) with the 6 values
Jira's Data Sensitivity field actually uses (public/general_use/
internal_use_only/trusted_people/customer_content/pii), since that is
the classification the organization actually applies. Includes a data
migration remapping existing rows and a defensive retry if Jira ever
rejects an unscreened custom field again.

backend/tests/test_data_classification.py

@@ -34,7 +34,7 @@ def _seed_technique(db, tactic="execution") -> Technique:
     return technique
 
 
-def test_new_test_defaults_to_confidential_via_db_default(db, red_lead_user):
+def test_new_test_defaults_to_internal_use_only_via_db_default(db, red_lead_user):
     """A Test() constructed without going through the create_test service
     still gets a safe classification via the column's server_default."""
     technique = _seed_technique(db)
@@ -46,7 +46,7 @@ def test_new_test_defaults_to_confidential_via_db_default(db, red_lead_user):
     db.add(test)
     db.commit()
     db.refresh(test)
-    assert test.data_classification == "confidential"
+    assert test.data_classification == "internal_use_only"
 
 
 def test_create_test_endpoint_uses_tactic_heuristic(client, db, api, auth_headers, technique):
@@ -57,8 +57,8 @@ def test_create_test_endpoint_uses_tactic_heuristic(client, db, api, auth_header
     )
     assert resp.status_code == 201, resp.text
     # The shared `technique` fixture (see conftest/test_tests.py) doesn't set
-    # a restricted-tier tactic, so this should land on the baseline.
-    assert resp.json()["data_classification"] == "confidential"
+    # a pii-tier tactic, so this should land on the baseline.
+    assert resp.json()["data_classification"] == "internal_use_only"
 
 
 def test_admin_can_update_classification(client, db, admin_user, admin_token, red_lead_user):
@@ -74,14 +74,14 @@ def test_admin_can_update_classification(client, db, admin_user, admin_token, re
 
     response = client.patch(
         f"/api/v1/tests/{test.id}/classification",
-        json={"data_classification": "restricted"},
+        json={"data_classification": "pii"},
         headers={"Authorization": f"Bearer {admin_token}"},
     )
     assert response.status_code == 200
-    assert response.json()["data_classification"] == "restricted"
+    assert response.json()["data_classification"] == "pii"
 
     db.refresh(test)
-    assert test.data_classification == "restricted"
+    assert test.data_classification == "pii"
 
 
 def test_operator_can_update_classification(client, db, admin_user, red_lead_token, red_lead_user):
@@ -130,7 +130,7 @@ def test_viewer_cannot_update_classification(client, db, admin_user, red_lead_us
 
     response = client.patch(
         f"/api/v1/tests/{test.id}/classification",
-        json={"data_classification": "restricted"},
+        json={"data_classification": "pii"},
         headers={"Authorization": f"Bearer {viewer_token}"},
     )
     assert response.status_code == 403
@@ -142,15 +142,15 @@ def _technique_stub(tactic):
     return t
 
 
-def test_determine_initial_classification_defaults_to_confidential():
-    assert determine_initial_classification(_technique_stub("execution")) == "confidential"
-    assert determine_initial_classification(_technique_stub(None)) == "confidential"
-    assert determine_initial_classification(None) == "confidential"
+def test_determine_initial_classification_defaults_to_internal_use_only():
+    assert determine_initial_classification(_technique_stub("execution")) == "internal_use_only"
+    assert determine_initial_classification(_technique_stub(None)) == "internal_use_only"
+    assert determine_initial_classification(None) == "internal_use_only"
 
 
 def test_determine_initial_classification_escalates_for_sensitive_tactics():
-    assert determine_initial_classification(_technique_stub("exfiltration")) == "restricted"
-    assert determine_initial_classification(_technique_stub("collection")) == "restricted"
-    assert determine_initial_classification(_technique_stub("credential-access")) == "restricted"
-    assert determine_initial_classification(_technique_stub("impact")) == "restricted"
-    assert determine_initial_classification(_technique_stub("Exfiltration")) == "restricted"
+    assert determine_initial_classification(_technique_stub("exfiltration")) == "pii"
+    assert determine_initial_classification(_technique_stub("collection")) == "pii"
+    assert determine_initial_classification(_technique_stub("credential-access")) == "pii"
+    assert determine_initial_classification(_technique_stub("impact")) == "pii"
+    assert determine_initial_classification(_technique_stub("Exfiltration")) == "pii"

backend/tests/test_jira_service.py

@@ -279,6 +279,110 @@ def test_search_jira_issues_maps_fields(mock_get_client):
     mock_jira.jql.assert_called_once()
 
 
+def _make_technique(**overrides):
+    from app.models.technique import Technique
+    tech = MagicMock(spec=Technique)
+    tech.mitre_id = "T1003.006"
+    tech.name = "DCSync"
+    tech.tactic = "credential-access"
+    tech.severity = "high"
+    for k, v in overrides.items():
+        setattr(tech, k, v)
+    return tech
+
+
+def _make_test_for_issue(**overrides):
+    from app.models.test import Test
+    t = MagicMock(spec=Test)
+    t.id = uuid4()
+    t.name = "Run DSInternals Get-ADReplAccount"
+    t.technique_id = uuid4()
+    t.procedure_text = "Invoke-DSInternals"
+    t.description = "desc"
+    t.platform = "Windows"
+    t.tool_used = "DSInternals"
+    t.data_classification = "pii"
+    for k, v in overrides.items():
+        setattr(t, k, v)
+    return t
+
+
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_jira_project_key", return_value="SEC")
+@patch("app.services.jira_service.get_jira_parent_ticket_standalone", return_value=None)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_auto_create_test_issue_retries_without_unscreened_data_sensitivity_field(
+    mock_get_client, mock_parent, mock_project_key, mock_configured, db
+):
+    # Regression: Jira rejects the WHOLE issue when the data sensitivity
+    # field isn't on the project's create screen, which would silently
+    # block every test's ticket creation. Must retry once without that field
+    # instead of losing the ticket.
+    mock_jira = MagicMock()
+    mock_jira.issue_create.side_effect = [
+        Exception(
+            f"Field '{jira_service.JIRA_FIELD_DATA_SENSITIVITY}' cannot be set. "
+            "It is not on the appropriate screen, or unknown."
+        ),
+        {"key": "SEC-42", "id": "10042"},
+    ]
+    mock_get_client.return_value = mock_jira
+    from app.models.user import User
+    test = _make_test_for_issue()
+    technique = _make_technique()
+    actor = User(username="gerardo-ruiz", email="gerardo.ruiz@kaseya.com", hashed_password="x")
+    db.add(actor)
+    db.commit()
+
+    issue_key = jira_service.auto_create_test_issue(db, test, actor, technique=technique)
+
+    assert issue_key == "SEC-42"
+    assert mock_jira.issue_create.call_count == 2
+    # Both calls share the same `fields` dict object (mutated in place), so
+    # only the final state is inspectable here — confirming the retry
+    # dropped the field is what matters.
+    final_call_fields = mock_jira.issue_create.call_args_list[1].kwargs["fields"]
+    assert jira_service.JIRA_FIELD_DATA_SENSITIVITY not in final_call_fields
+
+
+@pytest.mark.parametrize(
+    "data_classification,expected_jira_value",
+    [
+        ("public", "Public"),
+        ("general_use", "General Use"),
+        ("internal_use_only", "Internal Use Only"),
+        ("trusted_people", "Trusted People"),
+        ("customer_content", "Customer Content"),
+        ("pii", "PII"),
+    ],
+)
+@patch("app.services.jira_service.has_admin_jira_configured", return_value=True)
+@patch("app.services.jira_service.get_jira_project_key", return_value="SEC")
+@patch("app.services.jira_service.get_jira_parent_ticket_standalone", return_value=None)
+@patch("app.services.jira_service.get_admin_jira_client")
+def test_auto_create_test_issue_maps_data_classification_to_real_jira_field(
+    mock_get_client, mock_parent, mock_project_key, mock_configured, db,
+    data_classification, expected_jira_value,
+):
+    # Regression: the field ID was wrong (customfield_11233, which doesn't
+    # exist in the project) and the classification scheme didn't match
+    # Jira's actual 6-option "Data Sensitivity" field at all.
+    mock_jira = MagicMock()
+    mock_jira.issue_create.return_value = {"key": "SEC-1", "id": "1"}
+    mock_get_client.return_value = mock_jira
+    from app.models.user import User
+    test = _make_test_for_issue(data_classification=data_classification)
+    technique = _make_technique()
+    actor = User(username="gerardo-ruiz", email="gerardo.ruiz@kaseya.com", hashed_password="x")
+    db.add(actor)
+    db.commit()
+
+    jira_service.auto_create_test_issue(db, test, actor, technique=technique)
+
+    fields = mock_jira.issue_create.call_args.kwargs["fields"]
+    assert fields["customfield_11814"] == expected_jira_value
+
+
 def _make_user(**overrides):
     from app.models.user import User
     u = MagicMock(spec=User)