kitos/Aegis
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
128 Commits 2 Branches 0 Tags
d2a46feba8746d3f0101a8a6001d4fee49ddcb9f
Commit Graph

95 Commits

Author SHA1 Message Date
kitos d2a46feba8 refactor(docs+comments): add Google-style docstrings and inline comments across backend 
Task D — Google-style docstrings (Args/Returns) on every public function,
method, and class across all 158 Python files in the backend. Zero ruff D
violations (pydocstyle Google convention).

Task E — Explanatory one-line comment before every code line (~11600 new
comments). ruff check passes clean after isort re-sort.
 2026-06-11 11:06:55 +02:00
kitos 9ff0f04ba3 refactor(types): add comprehensive type annotations across backend Python codebase 
Enable ANN rules in ruff.toml (flake8-annotations) and resolve all 221 violations:

ANN201/ANN202 — return types on 168 public/private functions:
- All 28 FastAPI routers: endpoints annotated with dict/list/specific schema/
  StreamingResponse/FileResponse/JSONResponse as appropriate
- main.py: lifespan→AsyncGenerator[None,None], exception handlers→JSONResponse
- database.py: get_db→Generator[Session,None,None], proxy methods→correct types
- middleware/request_context.py: dispatch→Response with Callable call_next type

ANN001/ANN002/ANN003 — 32 missing argument types:
- seed_demo.py: all db parameters typed as Session
- domain/unit_of_work.py: __aexit__ exc_type/exc_val/exc_tb typed with TracebackType
- services: audit_service user_id→UUID|None, heatmap_service query/model/builder,
  notification_service test→Test, tempo_service test→Test/user→User,
  test_workflow_service test_id→UUID, campaign_crud **fields→object,
  test_crud **fields→object (4 sites)

ANN401 — 16 Any usages resolved:
- Domain entities (campaign/technique/threat_actor/test_entity): replaced Any with
  actual ORM types via TYPE_CHECKING guards to avoid circular imports
- detection_rule_service: test_id/detection_rule_id/evaluator_id→UUID
- score_cache: kept Any with # noqa: ANN401 (genuinely generic cache)
- jira_service/tempo_service: kept Any with # noqa: ANN401 (lazy optional deps)
- d3fend_import_service: _to_str(v: Any) kept with # noqa: ANN401

ANN204/ANN205/ANN206 — special/static/class methods:
- database.py proxy __call__/__getattr__: *args: object/**kwargs: object
- schemas/test.py model_validate: obj→object, **kwargs→object
- sa_technique_repository._int_type→type

All 439 unit tests pass. ruff check app/ → All checks passed!
 2026-06-11 11:06:54 +02:00
kitos 8f98bdd273 refactor(pep8): enforce full PEP8 compliance across backend Python codebase 
- ruff.toml: select E/W/F/I/N rules, line-length=120, drop legacy ignores
- Auto-fix: sort 82 import blocks (isort), remove 29 unused imports,
  strip 6 trailing-whitespace blank lines in docstrings
- main.py: move setup_logging and settings imports to top (E402)
- errors.py: noqa N818 on DDD exception names (96 call sites, safe)
- intel_service.py: noqa N817 for universal ET alias
- atomic/elastic/sigma import services: move _MAX_UNCOMPRESSED_SIZE and
  _MAX_ENTRIES to module level (N806)
- compliance_import_service.py: move SAMPLE_CONTROLS / CIS_CONTROLS to
  module level; wrap long description strings (N806 + E501)
- snapshot_service.py: move STATUS_ORDER dict to module level (N806)
- sigma_import_service.py: remove dead dedup_key expression (F841)
- threat_actor_import_service.py: remove dead stix_to_actor expression (F841)
- data_source.py, seed_demo.py, campaign_scheduler_service.py,
  lolbas_import_service.py: wrap lines exceeding 120 chars (E501)
- d3fend_import_service.py: per-file E501 ignore (data file with long strings)

All 439 unit tests pass. ruff check app/ → All checks passed!
 2026-06-11 11:06:54 +02:00
kitos 05b221a22d feat(scoring): composite recency decay and severity weights persisted in DB [FASE-5.1] 2026-05-18 15:07:12 +02:00
kitos 2ee59d4e18 test(intel): verify OSINT enrichment and stale coverage detection [FASE-4] 2026-05-18 14:50:31 +02:00
kitos bdeeed54e1 feat(compliance): data classification fields and retention policies job [FASE-3.5]
Aegis CI / lint-and-test (push) Has been cancelled
Details
2026-05-18 14:17:29 +02:00
kitos 3e854b7b79 feat(security): extend rate limits on sync, tests, evidence and reports [FASE-3.4] 2026-05-18 14:16:53 +02:00
kitos 5b29c2fc56 fix(api): return 422 for validation errors with serializable payloads [FASE-3.3] 2026-05-18 14:16:53 +02:00
kitos 6b076f52b2 feat(auth): audit login success and failure attempts [FASE-3.2] 2026-05-18 14:16:53 +02:00
kitos c0aff4cbeb feat(audit): enhanced audit trail with IP, user-agent and integrity hash [FASE-3.1] 2026-05-18 14:16:18 +02:00
kitos a8a24b5429 fix(metrics): correct never-tested technique query [FASE-2.6]
Aegis CI / lint-and-test (push) Has been cancelled
Details 
Use distinct technique_id list filtering so untested techniques are returned reliably on SQLite and Postgres.
 2026-05-18 14:00:48 +02:00
kitos b6f23f385d fix(analytics): restrict operators endpoint to admin [FASE-2.5] 
Align with BI security spec and add flat JSON API tests for coverage, tests, and operators.
 2026-05-18 14:00:47 +02:00
kitos 6ab950ec42 feat(reports): add quarterly and technique download routes [FASE-2.4] 
Expose GET endpoints for quarterly-summary and technique reports with PDF, DOCX, and HTML formats.
 2026-05-18 14:00:46 +02:00
kitos ed2c34ef28 feat(reports): extend report generation service [FASE-2.3] 
Add quarterly summary and technique detail builders with UUID-safe lookups and unit tests for purple campaign context.
 2026-05-18 14:00:42 +02:00
kitos 96fdd9fa85 feat(reports): add quarterly and technique HTML templates [FASE-2.2] 
Introduce quarterly_summary and technique_detail Jinja layouts; use SVG logo asset across report covers.
 2026-05-18 14:00:40 +02:00
kitos c28a47c43b test(reports): add ReportEngine unit tests [FASE-2.1] 
Stub WeasyPrint for CI-friendly PDF generation and verify HTML render, PDF path, and HTML file output.
 2026-05-18 14:00:37 +02:00
kitos 03d7d1cc80 feat(tempo): harden worklog sync and add tests [FASE-1.4] 
Add tempo-api-python-client dependency, TEMPO_API_VERSION setting, enum-safe Jira link lookup, work type on create_worklog, and mocked auto_log tests.
 2026-05-18 13:36:26 +02:00
kitos b8c9c4ac6a test(jira): add hourly sync job tests [FASE-1.7]
Aegis CI / lint-and-test (push) Has been cancelled
Details 
Verify skip when disabled, per-link sync invocation, and continued batch on single-link failures.
 2026-05-18 13:33:40 +02:00
kitos c5eb6f6dc1 feat(auth): move JWT blacklist to Redis with TTL [FASE-0.2] 
Revoke tokens by jti in a dedicated Redis DB, honor TTL from JWT exp on logout, reject revoked tokens in get_current_user, and add FakeRedis-backed API tests.
 2026-05-18 13:19:15 +02:00
kitos 9b70655b7e feat(infra): add Redis service and client for Phase 0 [FASE-0.1] 
Add Redis 7 to Docker Compose with healthcheck and persistence, separate logical DBs for blacklist and cache, singleton redis client helpers, and unit tests with fakeredis.
 2026-05-18 13:18:45 +02:00
kitos abef2a45e0 fix: production detection only triggers on AEGIS_ENV=production, not SECRET_KEY presence
Aegis CI / lint-and-test (push) Has been cancelled
Details
2026-02-20 17:20:48 +01:00
kitos 79a4772ab5 feat: make heatmap layers extensible via LayerRegistry (OCP) 2026-02-20 16:07:36 +01:00
kitos a9255e15ce refactor: remove db.commit() from audit_service.log_action, all callers use UoW 2026-02-20 15:33:23 +01:00
kitos 0d211d5156 feat: add ThreatActorEntity domain entity with coverage analysis (Tier 4) 2026-02-20 15:02:38 +01:00
kitos 14d995b40c refactor: remove db.commit() from business services, callers use UnitOfWork (Tier 3) 2026-02-20 14:42:20 +01:00
kitos 339d669498 feat: move all remaining inline logic from routers to services (Tier 2) 2026-02-20 14:34:24 +01:00
kitos 9e22fde746 feat: extract advanced_metrics, analytics, test_templates, and auth to services (Tier 1 complete) 2026-02-20 14:28:52 +01:00
kitos d77075272e feat: add ImportService protocol and registry for OCP-compliant import extensibility (LP-7) 2026-02-20 13:31:18 +01:00
kitos c0c6cda11d feat: add Campaign/Compliance domain entities and extract users/audit/data_sources to services (LP-2 through LP-6) 2026-02-20 13:28:14 +01:00
kitos 764a2f7579 feat(logging): add structured JSON logging for production, human-readable text for development 2026-02-19 19:07:08 +01:00
kitos f4c74230ec refactor(campaigns): extract CRUD/business logic to campaign_crud_service, use domain exceptions 2026-02-19 19:04:32 +01:00
kitos 50b70704ae refactor(evidence): extract permission validation and queries to evidence_service, use domain exceptions 2026-02-19 19:02:36 +01:00
kitos 20738d11b3 refactor(tests): extract CRUD/query logic to test_crud_service, router delegates to service with domain exceptions 2026-02-19 18:35:09 +01:00
kitos 4e3787d091 refactor(scoring): persist weights in DB table, replace mutable Settings with scoring_config_service 2026-02-19 17:46:02 +01:00
kitos 93fde55389 refactor(threat-actors): extract query/business logic to threat_actor_service, fix N+1 with grouped subqueries
Aegis CI / lint-and-test (push) Has been cancelled
Details
2026-02-19 17:40:00 +01:00
kitos 560fc0c9f0 refactor(detection-rules): extract query/business logic to detection_rule_service, router is thin HTTP adapter 2026-02-19 17:39:31 +01:00
kitos d305db8794 refactor(compliance): extract business logic to compliance_service, use domain exceptions instead of HTTPException 2026-02-19 17:06:32 +01:00
kitos 25fddad17c refactor(metrics): extract query logic to metrics_query_service, thin down router to HTTP adapter 2026-02-19 17:06:07 +01:00
kitos 8d5c5fa80e refactor(reports): extract query and aggregation logic to coverage_report_service, fix N+1 test-count pattern 2026-02-19 15:56:42 +01:00
kitos 42a9f4dcd4 refactor(status): consolidate status_service to delegate to TechniqueEntity.recalculate_status() eliminating duplicated business logic 2026-02-19 15:23:01 +01:00
kitos 2b6d9090c9 refactor(techniques): wire TechniqueRepository into techniques router replacing direct db.query() with repo pattern, domain exceptions, and UnitOfWork 2026-02-19 15:13:52 +01:00
kitos f41b8fd8c2 fix(security): add username validation, constant-time login, default credential rejection, and tooling 2026-02-18 19:11:14 +01:00
kitos 1521005b62 feat(infra): add repository implementations, mappers, FastAPI wiring, and technique indexes 2026-02-18 19:10:50 +01:00
kitos 5c55e7c17f feat(domain): add domain layer foundation -- enums, value objects, TechniqueEntity, repository ports 2026-02-18 19:10:31 +01:00
kitos e651ef8a8c refactor(heatmap): extract business logic to dedicated service
Aegis CI / lint-and-test (push) Has been cancelled
Details 
Move layer dispatch, entity-not-found checks, and validation from router to heatmap_service. Router now only validates requests, calls service, and formats responses (no HTTPException, no business logic). Service raises EntityNotFoundError/BusinessRuleViolation instead of returning None. Add build_navigator_export() for centralized dispatch. 29 new tests (253 total, 0 failures).
 2026-02-18 16:09:51 +01:00
kitos 1338d52cd0 fix(workflow): enforce domain state machine in dual validation path 
validate_as_red/blue_lead now delegate to TestEntity. check_dual_validation routes through entity instead of assigning test.state directly. Side effects dispatched via domain events. Entity raises InvalidOperationError for backward compat. Removed 4 dead V1 xfail tests, fixed 2 real test issues. 224 passed, 0 xfailed.
 2026-02-18 15:49:59 +01:00
kitos 576705d61d refactor(workflow): delegate start_execution to TestEntity 
Replace manual state+field mutation with entity.start_execution() and apply_to(), keeping audit logging and notifications at the service layer.
 2026-02-18 15:29:36 +01:00
kitos 9e204b78ec test: add TestEntity tests and fix test infrastructure (222 green) 
- Add test_test_entity.py with 46 pure unit tests covering the full domain entity

- Fix _FakeSettings in 11 test files (REPORT_TEMPLATES_DIR, JIRA, TEMPO)

- Fix stale db.commit assertions to db.flush after UoW refactor

- Add missing mock fields for TestEntity.from_orm compatibility

- Make database.py skip pool args for SQLite in test environment

- Disable slowapi rate limiter in test client fixture

- Inject test engine into app.database to fix threading errors

- Update role assertions to match current require_any_role policy

- Mark 6 legacy V1 endpoint tests as xfail (replaced by V2 workflow)
 2026-02-18 15:29:24 +01:00
kitos bc8025ffcf fix(test-entity): resolve ValueError when coercing foreign TestState enum 
str() on models.enums.TestState produces 'TestState.red_executing' instead of 'red_executing'. Use .value to extract the plain string before constructing the domain TestState.
 2026-02-18 14:06:39 +01:00
kitos 633c8e46ad refactor(workflow): delegate transition_state to TestEntity
Aegis CI / lint-and-test (push) Has been cancelled
Details 
transition_state() now hydrates a TestEntity from the ORM model and delegates state validation to entity.transition_to(). The entity is authoritative for which transitions are valid; VALID_TRANSITIONS and can_transition() are kept for backward compatibility.

Also adds public transition_to() method to TestEntity as the stable API surface for callers that need a single validated transition without lifecycle side-effects.
 2026-02-18 13:54:01 +01:00